The Fifth Element : Azure Secure Devops
summary
Argues that security must be the Fifth Element across the SDLC and backs it with specifics: the SolarWinds supply chain breach happens from a few injected lines and a DLL, CI misconfiguration (TeamCity) enables lateral movement, and an SBOM plus CI gates prevent surprises. Recommends concrete tools and practices: threat modeling tool (TMT) for STRIDE analysis, secret scanning and commit blocking via GitHub Advanced Security, and continuous posture and correlation through Defender for Cloud, plus policy gating, linters for Bicep/ARM, and code signing.
AI-written summary · about
chapters (24)
- 0:00Secure DevOps intro
- 1:38SolarWinds attack lessons
- 3:44Five secure DevOps elements
- 5:28Zero trust in development
- 7:11Secure design with STRIDE
- 9:42Threat modeling demo
- 10:45Secure VS Code Spaces
- 11:52OWASP secure coding
- 12:54Key management secrets
- 14:41GitHub secret scanning
- 15:43IDE security Copilot
- 16:47Least privilege CI/CD
- 17:50Azure permission scanning
- 18:32Secure IaC testing
- 19:55ARM/Bicep linters
- 20:40DevOps CLI Defender
- 21:21GitHub Advanced Security
- 22:24Azure Code Signing
- 23:27NIS 2.0 SBOM
- 24:50Software Bill of Materials in GitHub
- 25:54Secure RBAC governance
- 26:56PSRule policy validation
- 27:38Defender for Cloud
- 29:03Secure DevOps summary
related talks
01h 10mThe Fifth Element : Azure Secure Devops
44mThe Fifth Element : Azure Secure DevOps
27mMulti Security Checkpoints on DevOps Platform
36mUnderstanding the Sec in DevSecOps: Beyond Just Shifting Left
30mHandling Security Objections to DevOps
31mDevOps: You Build It, You Secure It
28mImplementing Critical Cybersecurity Controls in a DevOps Environment
45mDevSecOps : add Security to your DevOps!