REX QuickSign/Integrating security into a DevOps environment: Mission Impossible?
summary
A small company migrated a legacy Java monolith to Kubernetes and integrated security across pipeline and runtime: SAST and SCA scans at merge, daily CVE scans of registry images, runtime behavioral detection correlating exposures, and an admission-controller that can block deployments. The demo built a Python Docker image reporting three critical CVEs (one fixable), showed the admission controller preventing deployment until the base image was updated, and then allowed rollout; operational rollout included a two-person security team plus Slack channels and brown-bag training to spread practices.
AI-written summary · about
chapters (13)
- 0:00Introduction
- 1:48QuickSign context
- 3:57Security challenges
- 5:23Software factory vision
- 7:07Vulnerability detection
- 9:14Real-time attack detection
- 10:16Cloud shift
- 12:03Microservices security
- 13:30Behavioral security
- 17:16App security in dev
- 22:58Security tools demo
- 32:33Security best practices
- 36:03Q&A
related talks
46mA Security State of Mind: Continuous Security with Kubernetes
37mAchieving High Security at Scale with Microservices
28mDevSecOps - Security from Scratch
29mFrom Vulnerabilities to Vigilance
31mContinuous Security – integrating security into your pipelines
36mThe Road To Being Rugged
20mSimplifying Kubernetes: Streamlining Secure App Deployment in DevSecOps
48mHow practical is “DevSecOps” really? – A field report