DevOps to DevSecOps journey: what is possible to cover with free and open source tools
summary
Two-year migration from DevOps to DevSecOps standardizes pipelines across ~17 product teams and automates artifact and dependency tracking with GitLab + GitHub Actions for CI, Argo CD for GitOps, Terraform for infra as code, and SBOMs via dependency-track + CycloneDX (with helper scripts to massage repos). Static analysis uses SonarQube (OSS → paid) and quality gates, dynamic testing via OWASP ZAP/Qualys, Renovate for updates, Cypress/Newman for E2E tests. Rollout completes gradual adoption by December but some license and vulnerability fixes remain ongoing.
AI-written summary · about
chapters (6)
- 0:00Introduction and company background
- 5:05Starting DevSecOps journey goals
- 12:26Tools and security integration
- 25:21Implementation challenges and solutions
- 29:18Results and team engagement
- 36:00Gamification and Champions program
related talks
23mTrue DevSecOps with People, Processes, and Technologies
45mDevSecOps : add Security to your DevOps!
30mSecuring DevOps using OWASP DevSecOps Tools
40mSecure by Default: Building an AI-Augmented, OSS-Powered Reusable CI/CD Pipeline
30mDevSecOps: More Than Just Pipelines
32mHow to fit Sec into DevOps without Security team
38mDevOps Meet Sec: Your Journey To Delivering Secure Code Fast
31mDevSecOps, or How to Integrate Security into DevOps Practices