DevSecOps, or How to Integrate Security into DevOps Practices
summary
Practical DevSecOps setup integrating linters, dependency scanners and SAST into CI (including yarn audit blocking deploys on a single critical finding) while acknowledging long scan times and false positives. Security scaled by appointing security champions across ~350 engineers supported by a six-person security team, using secret managers/KMS, MFA, auto-remediation (AWS Lambda), cloud checks like AWS Inspector, and training incentives that certified about 100 people via MOOCs.
AI-written summary · about
chapters (14)
- 0:00DevSecOps intro
- 2:28Secure apps at high freq
- 3:35Security paradigm shift
- 4:59Early security collab
- 6:46Security champions role
- 8:14Developer training
- 12:08Security tests in pipeline
- 15:36Automated security tools
- 19:33Securing public cloud apps
- 22:23Cloud security automation
- 23:46Hardening instances & containers
- 25:53Chaos Engineering resilience
- 26:14Client vs server encryption
- 28:43Q&A
related talks
45mDevSecOps : add Security to your DevOps!
30mDevSecOps: More Than Just Pipelines
32mHow to fit Sec into DevOps without Security team
34mDevSecOps: How to Use DevOps to Make You More Secure
01h 02mDevSecOps for Developers: How To Start
33mDevSecOps: How to Use DevOps to Make You More Secure
32mDevSecOps is Dead, Long Live DevSecOps
06mDevSecOps – Security Throughout the DevOps Pipeline