DEVOPS DAYS MTL 2018 - Tsvi Korren
summary
Containers and serverless create a security vacuum between packaging and runtime where short-lived functions can run for minutes and leave no forensic trace, so developers must shift left on dependencies, lean images, non-root users and secret handling and also shift up to harden runtime controls. Practical tooling includes Aqua’s micro scanner for build-time CVE and vendor scoring, plus kube-bench and kube-hunter for cluster checks; these scans produce actionable CVE IDs and remediation steps.
AI-written summary · about
chapters (11)
- 0:00DevOps and security today
- 1:05Security teams traditionally
- 3:13Cloud and containers disrupt security
- 6:21Dangerous void in deployments
- 7:22Shift left for developers
- 10:17Collaborate with security teams
- 12:06Secure runtime environment
- 15:34Serverless security concerns
- 18:03Application as last defense
- 19:28Free tools bridging DevOps and security
- 21:59Closing remarks and Q&A
related talks
40mContainers, Kubernetes and Practical DevSecOps
32mSponsored Session: A New Security Standard for the AI Era: Zero-CVE and Real-Time Threat…
29mZero-Trust Containers: Rethinking Security in the Age of Ephemeral...
46mWhat Security People Want: Making DevSecOps Happen with Containers
37mSecuring Containers by Breaking In
45mSo Happy Together: Making the Promise of DevSecOps a Reality
27mSurviving Day2 : Picking the Right Tool To Secure Your Kubernetes Habitat
22mSecurity vs Dev Experience Threat … or Opportunity