Building a continuous secure delivery pipeline
summary
Describes integrating security into an agile continuous delivery pipeline using practices similar to pairing and TDD, with concrete tools and techniques teams can add to development and delivery workflows. Covers challenges teams face when adopting security as a practice and explains using a continuously evolving threat model to bake security into products rather than adding it later.
AI-written summary · about
chapters (34)
- 0:00Start
- 4:35The Security Sandwich
- 5:53Security by checklist
- 6:07Security by throwing things over the wall
- 7:15No upfront design
- 8:12Microservices
- 10:21Containers
- 18:23Secure defaults
- 20:33Security Requirements
- 21:31Abuse cases
- 21:545 minute threat modelling
- 23:19YOU CAN'T LEAK ANY DATA
- 26:17SAST tools - Strengths
- 27:08SAST tools - Weaknesses
- 28:00IDE plugins - Snyk
- 28:27IDE plugins - FindSec Bugs
- 28:48Pre-commit hooks
- 30:11Dependency Checker
- 31:06Dependency check as service
- 32:31Vulnerability Scanner as service
- 32:55SAST - Fortify (commercial)
- 33:25Pairing
- 33:54DAST tools
- 35:58Automated tests
- 37:05Manual security testing
- 38:14Infrastructure as Code
- 39:49Infrastructure Hardening
- 40:316 stages of secret management
- 42:23Secret Service
- 42:53Continuous Monitoring
- 44:37Take aways
- 45:54Snapshot
- 46:37Books
- 47:05Acknowledgements
related talks
34mContinuous Security - Integrating Pipeline Security
31mContinuous Security – integrating security into your pipelines
37mA Secure Continuous Delivery Pipeline
30mDevSecOps: How Secure Is Your Pipeline?
23mContinuous Security
28mContinuous Integration and Continuous Delivery Pipelines for Beginners and Managers
04mContinuous Integration, Continuous Delivery. Continuous Security?
07mInterview