DevSecOps is a Misnomer
summary
Argues that "DevSecOps" mislabels the work and shows exactly where security sits across plan→code→build→test→deploy→operate→monitor with 1 slide overlaying security. Recommends threat modeling cadence, enforced peer review via GitLab/GitHub controls, hardened images, SAST/DAST and vulnerability scanning with Qualys and Nessus, automated key rotation, and RASP for runtime protection; describes which tools run in which pipeline stage and which measures actually stop incidents.
AI-written summary · about
related talks
23mDevSecOps - By Any Other Name
38mDevSecOps - what does it mean and where is it taking us?
06mDevSecOps – Security Throughout the DevOps Pipeline
30mDevSecOps: More Than Just Pipelines
32mDevSecOps is Dead, Long Live DevSecOps
39mDevSecOps: What, Why and How
36mUnderstanding the Sec in DevSecOps: Beyond Just Shifting Left
31mWhy SecDevOps is the new way in Cybersecurity?