DevSecOps: tips and tricks.
summary
Concrete integrations that run without blocking development: post-build triggers launch static scans and return simple statuses, a reusable TeamCity meta-runner injects security steps into any pipeline, and Bitbucket webhooks run scans on merges and post delta-only PR comments listing only newly introduced vulnerabilities. Open-source control uses Nexus Firewall plus continuous monitoring to quarantine risky artifacts and report affected services, with custom static rules to allow needed libraries safely. Runtime coverage improves by routing auto-tests and manual testing through a proxy-driven DAST collector.
AI-written summary · about
chapters (10)
- 0:00Introduction
- 3:32What is DevSecOps
- 6:21Security in CI/CD
- 12:21Static code analysis
- 21:39Open source vulnerability scanning
- 27:46Dependency monitoring in production
- 30:59Dynamic application analysis
- 36:22Automated acceptance testing
- 38:54Summary
- 40:17Q&A
related talks
42mContinuous Security: Integrate security tools into your DevOps Pipeline
39mContinuous Security at the Next Level
28mDevSecOps - Security from Scratch
45mDevSecOps : add Security to your DevOps!
43mSecurity in DevOps Strategies
59mDevOps for the Discouraged
30mDevSecOps: More Than Just Pipelines
39mSecurity Tooling in Your DevOps Pipeline