Decoupling DevSecOps from CI/CD Pipelines
summary
Argues that security must run outside the main CI/CD pipeline, claiming a separate security escort pipeline owned by security can automatically produce SAST/SCA/DAST results without developer involvement. Cites tools and patterns: Cloud Native Buildpacks (CNB) to build images without Dockerfiles, OPA policies, SCA via Artifactory/JFrog, ZAP/Burp for DAST, and GitOps agents like Argo CD. Uses findings (Unit 42: ~99% insecure Helm charts, ~91% public images with critical issues) to push the pull model for safer production credentials.
AI-written summary · about
chapters (6)
- 0:00Introduction and context
- 2:58Evolution of pipeline security
- 5:32The case for decoupling
- 8:42Implementation strategies
- 13:21Common industry myths
- 17:32Conclusion and remediation
related talks
48mImplement ZeroTrust with Dedicated DevSecOps Pipeline
39mSecurity Tooling in Your DevOps Pipeline
30mHandling Security Objections to DevOps
29mSecuring Your Web Application Pipeline From Intruders
31mWhy SecDevOps is the new way in Cybersecurity?
42mContinuous Security: Integrate security tools into your DevOps Pipeline
23mTrue DevSecOps with People, Processes, and Technologies
31mDevOps: You Build It, You Secure It