Love Your Security Engineer as Yourself
summary
Proposes shifting security left by enforcing quality gates in CI pipelines that fail builds on static analysis or SBOM problems, using SonarQube and Black Duck as concrete tools. Describes measuring process efficiency (22-day cycle with only 5 days of productive work) and Microsoft-style team metrics where small teams pause developers after accumulating bug points. Reports a ~38% reduction in code review effort from this approach and warns about over 2,000 infected Docker images found in public registries.
AI-written summary · about
chapters (8)
- 0:00Introduction
- 1:48Security integration importance
- 3:12Vulnerability metrics and accountability
- 5:02Security automation in process
- 6:49Code and container analysis tools
- 8:13Infrastructure active monitoring
- 9:17Successful practices examples
- 10:46Summary
related talks
31mSharing Security Secrets: How to Encourage Security Advocates
42mContinuous Security: Integrate security tools into your DevOps Pipeline
01h 04mShifting Security Everywhere
43mDeveloper Driven Security In High-Growth Environments
40mDevSecOps Guide to Bulletproof Your Development Workflow
27mStandard Classification: Automate Security, Don't Tell Your Boss
27mSecurity Learns to Sprint: DevSecOps
43mBuilding a Secure DevOps Pipeline