Handling Security Objections to DevOps
summary
Argues that security joins DevOps by doing concrete things: use ticketing/workflow for consults, operate a shared responsibility model, and secure the tool chain (IAM, signing, pentesting each CI/CD tool) so pipelines emit telemetry into the SOC. Recommends checking a threat model into the source repo, turning abuse/use cases into security unit tests, and shows that the same deployment pipeline can deploy Lime memory snapshots and deliver dashboards and CloudFormation-to-PCI mapping as evidence.
AI-written summary · about
chapters (13)
- 0:00Intro
- 0:55Telling The Story & Showing Results
- 3:03Security program - Ownership as part of DNA
- 5:37Operating with Shared Responsibility
- 9:46Security as code: A shorter path to the customer
- 12:36Continuous Integration
- 14:37DevSecOps: Core Principles
- 19:39Building DevSecOps teams
- 20:09Key security enablers
- 21:55Security Epics
- 26:32Security Cartography: Mapping the Landscape
- 27:45Security As Code: Using AWS CodeDeploy
- 28:51Planetary Scale from Day 1
related talks
31mDevOps: You Build It, You Secure It
27mMulti Security Checkpoints on DevOps Platform
39mDevOps: The Return of Security
04mThe relationship between DevOps and security
01h 02mDevSecOps for Developers: How To Start
22mShifting left, how security fits into the DevOps story
06mDevSecOps – Security Throughout the DevOps Pipeline
31mWhy SecDevOps is the new way in Cybersecurity?