Security in a DevOps World
summary
Shows concrete wins and failures: scanning with truffleHog and gitrob finds live secrets — the presenter even uncovers leaks in the HashiCorp namespace — and Dangerous CI policies block risky pull requests. Demonstrates Vault issuing short‑lived credentials with TTLs, automatic rotation for databases, and revocation, plus using AWS Policy Advisor and CloudTrail to cut blast radius. Covers game days and red teams that validate detection, and which parts of this actually reduce incidents versus being friction.
AI-written summary · about
chapters (13)
- 0:00Start
- 1:24What Is Devops
- 16:23Static Code Analysis
- 17:16Game Days and Red Team'S
- 20:05Secret Management
- 23:16Truffle Hog
- 24:53Security Code Review Process
- 25:43Sentry
- 27:54Vaults Authentication Flow
- 29:17Security Team
- 32:30Policy Advisor within Aws
- 35:26Security Onion
- 37:24Secret to a Good Testbed
related talks
24mDeveloper-First Application Security and DevSecOps
38mAdventures in Cloud Security: What DevOps Can Learn from a Security Engineer
07mDon't Go There! Horrible Devops Security Blunders
31mDevOps: You Build It, You Secure It
36mDevOps Security - Is It Really So Difficult?
30mHandling Security Objections to DevOps
30mDevSecOps State of the Union
50mDevOps: Shhhh! It's a secret! - HashiCorp Vault