Spreading Sec across DevOps loops
summary
Move security checks into the inner development loop by running scans and tests inside Docker images locally instead of waiting for outer-loop CI. Use DevSpace or similar to replicate runtime on a local or remote Kubernetes cluster so permissions and limits match production, replace Bash/docker-compose with formal pipelines and prebuilt images to reduce setup burden (at the cost of more resource usage), and adopt an internal developer platform that unifies controls and secret management (for example, Teller).
AI-written summary · about
chapters (17)
- 0:00DevOps cycle and security
- 3:25Security in Inner Loop
- 5:32Local dev environment
- 8:21Shift left security
- 12:40Local vs remote environments
- 15:49Internal platform support
- 17:38Pros/cons of evolutions
- 19:24Q&A
- 20:47Secure dev approaches
- 22:16Painless security checks
- 23:38Docker vs remote dev
- 25:23Security check criteria
- 27:53Developer training
- 28:38Local cluster resources
- 30:28DevSpace alternatives
- 31:32Kubernetes dev and cloud
- 33:26Closing
related talks
32mHow to fit Sec into DevOps without Security team
46mWhat Security People Want: Making DevSecOps Happen with Containers
45mDevSecOps : add Security to your DevOps!
31mDevSecOps, or How to Integrate Security into DevOps Practices
37mDevSecOps Guide to Bulletproof Your Development Workflow
21mSecurity That Enables: Breaking Down Security Silos in the DevOps Ecosystem
36mUnderstanding the Sec in DevSecOps: Beyond Just Shifting Left
25mDecoupling DevSecOps from CI/CD Pipelines