Automating Security Compliance at Scale
Talkat Continuous Delivery Summit 2019 - San Diego · on Monday, 2019-11-18· at 18:45· San Diego Convention Center - Room 1, 131 W Harbor Dr·
summary
Pipeline security uses concrete automation: a rules engine called GAC auditor runs daily against Jenkins, GitHub/GitLab, SonarQube, Clair/Twistlock, Nexus/Artifactory and flags misconfigurations; enforcement includes SSO, protected branches and Terraform/Kubernetes checks. A secret detector validates suspected tokens (attempts live API checks to reduce false positives), blocks commits via pre‑commit hooks and emails devs, and a weekly production container scan reports new CVEs (they cite ~40 new CVEs/day). A dashboard feeds auditors and the system reduces alerts while blocking real leaks.
AI-written summary · about
chapters (7)
- 0:00Introduction and speakers
- 2:09CI/CD pipeline overview
- 7:31Security off the pipeline
- 13:26Security in the pipeline
- 20:10Secret detection tools
- 25:59Auditor reporting and compliance
- 31:42Q&A session
related talks
42mContinuous Security: Integrate security tools into your DevOps Pipeline
39mContinuous Security at the Next Level
36mBuilding Security Frameworks Into Your CI/CD Pipelines
11mAutomating Cloud Security Compliance: From Patching to Machine Image Building and Auto Scheduling
43mSecurity in DevOps Strategies
27mStandard Classification: Automate Security, Don't Tell Your Boss
20mAI-Driven Security as Code in Jenkins
37mA Secure Continuous Delivery Pipeline