DevSecOps - Automating Security in DevOps
summary
A ready-to-run 13GB lab VM bundles Jenkins pipelines, OWASP Dependency-Check, FindSecBugs/FindBugs, OWASP ZAP, OpenVAS, Vault, Weave Scope, MailCatcher and Archery so scans feed a single vulnerability backlog; the pipeline enforces a stop if >10 high vulnerabilities rule, SAST initially spits out 500–900 findings that require tuning, DAST can take days so it runs async, and a WAF returns 403 on SQLi payload while email alerts and Archery track remediation.
AI-written summary · about
chapters (12)
- 0:00Start
- 21:47With rapid development & provisioning the asset inventory can't be a static inventory • We need to monitor the assets constantly both on premise and Cloud
- 26:09Software Composition Analysis OWASP Dependency Check
- 28:07DAST OWASP ZAP Scan
- 29:23Infrastructure - Clair & OpenVAS
- 30:12Compliance - Auditing Tomcat with Inspec
- 51:54Software Composition Analysis (SCA) Dependency Check
- 52:07Let's Fix the issue Update Vulnerable Struts Version
- 52:18Static Application Security Testing (SAST) FindBugs
- 53:33Attacker Compromised EC2 instance using SSH Brute force attack
- 53:45Amazon Guard Duty Alerting about SSH Attack.
- 55:43Investigate whether the Attacker was able to login to the EC2 instance. Using Amazon CloudWatch logs.
related talks
43mBuilding a Secure DevOps Pipeline
46mSecurity DevOps - Staying Secure In Agile Projects
45mAutomated Security Testing in a DevOps world
42mContinuous Security: Integrate security tools into your DevOps Pipeline
43mSecurity in DevOps Strategies
45mDevSecOps : add Security to your DevOps!
59mDevOps for the Discouraged
28mDevSecOps - Security from Scratch