Securing DevOps using OWASP DevSecOps Tools
summary
Walks through a concrete DevSecOps pipeline: use Threat Dragon for threat modeling, generate a CycloneDX SBOM, push it into Dependency-Track for hourly comparison against CVEs, and feed findings into DefectDojo to auto-create Jira tickets. Claims that application source is only about 10–15% of the attack surface while dependencies dominate, that automated SBOM+DT can surface new vulnerabilities within an hour, and that end-to-end automation turns scans into prioritized, trackable remediation work.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 3:19OWASP overview and tools
- 5:29Dragon threat modeling
- 7:39CycloneDX SBOM generation
- 11:14Dependency-Track integration
- 14:37DefectDojo vulnerability tracking
- 16:45Vulnerability prioritization
- 19:58DevSecOps pipeline mapping
- 23:11Security in SDLC
- 26:23Benefits of DevSecOps
- 28:30Team awareness and automation
related talks
51mThe End of DevSecOps?
45mDevSecOps : add Security to your DevOps!
32mHow to fit Sec into DevOps without Security team
31mDevOps: You Build It, You Secure It
40mDevSecOps Guide to Bulletproof Your Development Workflow
13mUnderstanding DevSecOps: Risk defense across your SDLC
27mMulti Security Checkpoints on DevOps Platform
30mDevSecOps: More Than Just Pipelines