DevSecOps: Balancing Agility, Security & Stability in a Continuous Software Business
summary
A concrete incident shows public GitHub credentials allowing attackers to spin up 21,000 CPUs across every region in a Google development org, costing $70,000 (later refunded); responses include stricter guardrails, account segregation, service control policies to block IAM user creation, ephemeral credentials and assume-role patterns, and automated auditing plus bug bounties on HackerOne. Tools and approaches deployed or recommended include Terraform, AWS GuardDuty, Kubernetes, Vault and DataDog, team rotations to embed ops, and budget/usage alerting to detect abuse.
AI-written summary · about
chapters (23)
- 0:00Intro
- 0:23A real story
- 1:30How did this happen
- 3:14Shift Left
- 4:57Specializations
- 6:05InfoSec
- 9:40Postmortem
- 10:55Communication
- 11:55Cybersecurity
- 12:16Tradeoffs
- 15:56Blast Radius
- 17:54Incident Reporting Process
- 18:42DevSecOps Roles
- 20:35Crossfunctional Teams
- 22:44Bug Bounty Programs
- 25:39IAM in AWS
- 28:08Monitoring and alerting
- 29:37Best practices
- 32:19New alerts
- 33:19Embedding ops
- 34:41Caution
- 35:58Automation
- 37:47QA
related talks
35mDevSecOps in practice. Tools vs People!
32mHell Has Frozen Over: DevOps & Security
34mDevSecOps: How to Use DevOps to Make You More Secure
31mDevSecOps, or How to Integrate Security into DevOps Practices
48mHow practical is “DevSecOps” really? – A field report
33mDevSecOps: How to Use DevOps to Make You More Secure
36mDevOps Security - Is It Really So Difficult?
31mDevOps: You Build It, You Secure It