devsecopsday 2024
who it's for
platform engineers, site reliability engineers, security engineers, devops engineers, cloud engineers, compliance engineers, application developers
topics
distroless container images; SBOM generation for builds; ML security operations (MLSecOps); model provenance and ML bill of materials; vulnerability management lifecycle; CVSS 4.0 with EPSS prioritization; Cloudflare SSL for SaaS migrations; edge caching and Argo Tunnel; AIGenOps in platform engineering; Jenkins pipelines for generative AI fixes; FinOps tag strategy on AWS (DynamoDB+Lambda+EventBridge); runtime application self protection (RASP) integration
| title | author | length |
|---|---|---|
| A Journey to Distroless | M. Buccarello, M. Bisi | 39m |
Distroless container images are presented as a concrete way to cut system CVEs by roughly 60–70% by using minimal OS layers. The talk demonstrates creating a… | ||
| A Gentle Introduction to MLSecOps | Alessandra Bilardi | 27m |
Defines a concrete ML security threat model (supply‑chain compromise, data exfiltration, membership inference) and prescribes measurable MLSecOps practices… | ||
| Vulnerability Management Lifecycle in DevSecOps | Alessandro Braccio | 33m |
Describes how pipeline scan results are consolidated into a central vulnerability management system and how asset inventories (including Arduino Cloud devices)… | ||
| Scaling and Securing 12 Million Websites | Mario Trucco | 32m |
Jimdo migrated 12 million websites to Cloudflare in front of an AWS origin using Cloudflare SSL for SaaS, regional edge caching, cashtag headers to avoid purge… | ||
| AIGenOps: Integrating Generative AI into Platform Engineering | Riccardo Soro | 24m |
A proof-of-concept integrates generative AI into platform engineering for regulated software by running nightly Jenkins jobs that clone repositories, analyze… | ||
| Where SRE Can Go Wrong | Riccardo Carlesso | 43m |
Practical observations on why SRE adoption fails, identifying organizational antibodies that turn good intentions into silos and estimating real costs (about… | ||
| DevSecOps Stories | S. Sensini, M. Buccarello, A. Bilardi, R. Carlesso | 27m |
Panelists describe concrete DevSecOps work: building and deploying a catalog of base container images to customers, integrating image scanning and containerd… | ||
| FinOps and Tag Strategy on AWS | F. De Nardi, G. Magnante | 38m |
Describes implementing a tag strategy on AWS to reduce cloud waste and enable security and finance workflows. Uses DynamoDB + Lambda + EventBridge to store and… | ||
| (More than) One Vulnerability in a Thousand Makes It | Emilio Tonelli | 33m |
A live exploit against a vulnerable OpenWASP app shows how a single successful command‑line injection (triggered by a crafted ping) can create files on the… | ||
| nothing matches | ||