Paving a Secure Road
summary
John Lewis & Partners moves from a monolith to 100 digital services and 7,000 deployments per year while cutting risk-assessment time by about 50%. Platform team builds a paved Road that provisions GCP projects, Kubernetes namespaces, secrets, logging and IAM in ~15 minutes from one YAML. A homegrown vulnerability database and Grafana dashboards aggregate many scanners; a bill of materials dashboard fingerprints every Docker image with SIFT and finds affected services in seconds. Result: faster, smaller releases, daily Slack digests for teams, and measurable reduction in late pen‑test delays.
AI-written summary · about
chapters (14)
- 0:00Secure platform journey
- 1:25Speakers and background
- 4:18Monolith to microservices
- 5:43DevSecOps security
- 7:09Slow risk assessments
- 9:15Security controls standardization
- 10:58YAML to production
- 12:19Shifting left scanning
- 14:04Bring your own scanner
- 15:30Security dashboards
- 17:38Making security visible
- 19:02Log4Shell response
- 21:55Future plans
- 22:58Summary
related talks
36mThe Road To Being Rugged
40mConstruction Time Again: A Lesson in Paving Paths for Security
43mBuilding a Secure DevOps Pipeline
13mBreaking Down Silos
35mSecuring digital services
24mBeing secure by design: Engineer-led security
32mBuilding a Secure By-Design Pipeline with an Open Source Stack
38mBuilding Security at Speed