Security & DevEx: Can We Have Both?
summary
Argument: invest in secure defaults and a composable internal platform API so teams get guarded S3/bucket configurations, vetted base images, and TLS key workflows without redoing infra; supply‑chain tooling and Chainguard‑style signed images address npm/CVE chaos and the broken CVE process (curl spam cited); continuous delivery reduces stale vulnerable deps; password managers and CI pipelines improve DevEx; unclear ownership and incentives remain the biggest barrier to scaling supply‑chain focus and a true shared responsibility model.
AI-written summary · about
chapters (9)
- 0:00Intro
- 1:32Why does security feel scary?
- 3:38Perfect security is invisible
- 5:44Platform engineering vs security friction
- 10:34“Shift‑left” mindset: Embed security early
- 14:18Centralized platform defaults vs team autonomy
- 19:54Supply‑chain focus & open source dependencies: Proactive security
- 35:50Infrastructure guardrails & shared‑responsibility
- 43:00Outro
related talks
31mDevOps: You Build It, You Secure It
30mHandling Security Objections to DevOps
48mImplement ZeroTrust with Dedicated DevSecOps Pipeline
46mWhat Security People Want: Making DevSecOps Happen with Containers
45mSo Happy Together: Making the Promise of DevSecOps a Reality
32mRugged Building Materials & Creating Agility with Security
34mDevSecOps: How to Use DevOps to Make You More Secure
31mWhy SecDevOps is the new way in Cybersecurity?