More /w Less ScreenTime: An Application Security Toolchain
summary
A concrete claim: Dracon unifies many open tools into one workflow and actually runs them — tfsec, tfsec-like IaC checks, dependency-check and 3v for composition, SARIF and CycloneDX producers, SBOM support, and OPA-based policy checks — with deduplication to cut noise. It builds Kubernetes pipelines via kustomize so a pipeline deploys in minutes (demo completes in ~2 minutes), and ships Slack and Jira consumers plus webhooks. It is open source at github.com/security/dracon and runs on a cluster.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 3:34Security scaling challenges
- 8:11Introducing Dracon
- 12:13Dracon’s workflow design
- 19:04Low-code pipeline creation
- 21:40Live demo of Dracon
- 29:59Key benefits of Dracon
- 33:13Call to action
- 35:50Q&A
related talks
43mKnative Security Pipelines
30mSecuring DevOps using OWASP DevSecOps Tools
22mSecurity vs Dev Experience Threat … or Opportunity
38mOpen Source Security Tools for Kubernetes Applications
23mSupply Chain Security using Free and Open Tools
32mBuilding a Secure By-Design Pipeline with an Open Source Stack
27mSurviving Day2 : Picking the Right Tool To Secure Your Kubernetes Habitat
28mDevSecOps - Security from Scratch