Our Journey to Shift-left Security with Infrastructure as Code
summary
Audit of 22 Visma projects across GCP, AWS and Azure evaluates three IaC scanners (2 commercial, 1 open source) using ease of install, docs, interoperability, data residency and cost, scanning real repos provided by teams. Findings: lots of publicly exposed storage and IAM misconfigurations and missing encryption defaults, no hard‑coded secrets, some infra provisioned by bash/PowerShell scripts that scanners miss. Teams prefer a single tool for app+infra scanning and Shift‑Left plus CSPM/CWPP for runtime drift.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 3:10Visma’s security program
- 6:03Shift-left security
- 7:07IaC security risks
- 9:35Evaluating scanning tools
- 13:32Tool evaluation results
- 14:37Cloud security issues
- 16:47Teams’ feedback
- 17:52Beyond IaC scanning
- 19:18Security by design
- 20:41Conclusion and key takeaways
related talks
42mContinuous Security: Integrate security tools into your DevOps Pipeline
18mInfrastructure as Code Security Best Practices & Strats
14mHow Security as Code Transforms Platform Engineering at Scale
37mDevSecOps Guide to Bulletproof Your Development Workflow
07mCI/CD Evolution: Ensuring Security and Overview During Rapid Growth
22mShifting left, how security fits into the DevOps story
46mShift-left! Scanning for Security Compliance from Day Zero
39mSecurity Tooling in Your DevOps Pipeline