How to Turn DevOps into DevSecOps
summary
Explains how to turn DevOps into DevSecOps by changing culture and processes: identify critical assets, shift security left into the DevOps pipeline, and replace manual approval gates with automated, scriptable checks so approvals are done by code. Describes using infrastructure-as-code and IDE/build-time policies to reduce control overhead, warns against wall-of-shame reporting, and argues that embedding security in DevOps gives about a 5× return versus siloed security; practical advice is to avoid manual approvals and to measure and protect assets.
AI-written summary · about
chapters (8)
- 0:00Introduction
- 3:41Security as culture
- 10:03DevSecOps failure recipe
- 15:58Mindset shift needed
- 20:25Purposeful asset protection
- 26:14Secure infrastructure as code
- 30:18Tools and automation
- 33:53Conclusion
related talks
31mWhy SecDevOps is the new way in Cybersecurity?
39mDevSecOps: What, Why and How
06mDevSecOps – Security Throughout the DevOps Pipeline
50mSeamless Integration of Security Practices into the DevOps Pipeline
39mDevOps: The Return of Security
30mThe 3 Ways of DevSecOps – Making Shift Happen
48mDevOps Is Automation, DevSecOps Is People
16mIntroduction to DevSecOps