Transform Your Security Practices With DevOps
summary
Describes converting thousands of manual SSH checks across several thousand servers into automated ansible remediation plus InSpec audits run from Jenkins, wired into Sensu and ELK. Builds several hundred InSpec tests, links failures to remediation docs, and measures fleet compliance, MTTR and monthly reports. Results cut thousands of audit-hours to near zero, required months of testing to avoid app breakage, and yields measurable cost savings (tens of thousands of dollars) while increasing percent-of-fleet compliance.
AI-written summary · about
chapters (39)
- 0:00Introduction
- 0:49What is compliance
- 2:05Three main aspects of compliance
- 2:56Red Hat Security Technical Implementation Guide
- 3:26PCI Compliance
- 3:52Discovery Meetings
- 4:37Compliance Groups
- 5:18DevOpsDays
- 5:49Continuous Improvement
- 6:07DevOpsDays London
- 6:30DevOpsDays Seattle
- 7:04Security
- 7:31Rugged DevOps
- 7:49Fannie Mae
- 8:11John Willis
- 8:46Pivotal
- 9:17Bosh
- 9:36Be Pragmatic
- 9:51Culture
- 10:27High Performance
- 11:04Improving Compliance
- 11:42Security Compliance
- 12:19Value Stream Map
- 13:06Push Button Receive
- 13:19Kanban Boards
- 13:49Automation
- 16:23Using DevOps tools
- 16:57Inspect for SSH
- 17:28Compliance Safe
- 17:53Compliance Safe Implementation
- 18:23Service Spec Check
- 18:41Ansible hardening
- 19:37Jenkins
- 20:26Monitoring Logging
- 20:53Measuring Compliance
- 21:27Easy to Measure
- 22:04Monitoring
- 22:21Sharing
- 23:24Compliance Tools
related talks
36mImproving Security while Reducing Toil with DevSecOps
36mImproving Security while Reducing Toil with DevSecOps
31mDevSecOps, or How to Integrate Security into DevOps Practices
43mBuilding a Secure DevOps Pipeline
33mAutomating Cloud Security and Incident Response (DevSecOps)
48mThe Quick Wins of DevSecOps
45mLessons From DevOps: Taking DevOps Practices Into Your AppSec Life
36mThe Road To Being Rugged