DevSecOps Guide to Bulletproof Your Development Workflow
summary
Argues security must shift left by running SCA, SAST and DAST plus container, IaC and Kubernetes resource scans at the CI/CD or scheduled stages; recommends starting with software composition analysis and adding scans one at a time. Gives a baseline workflow example (initial scan finds 5 critical, 7 high, 10 medium, 22 low), uses mitigation deadlines and Sprint planning to chip away at tech debt, scans Node/Docker base images and manifests, and enforces break the build when the baseline is exceeded.
AI-written summary · about
chapters (22)
- 0:00Introduction and welcome
- 1:50DevSecOps agenda overview
- 3:17The team and development scenario
- 7:08Genesis of DevOps and silos
- 9:54Shift left security concept
- 12:00Defining DevSecOps and trifactor
- 12:43Protecting software like a house
- 14:09Software Composition Analysis
- 14:50Static Application Security Testing
- 15:53Dynamic Application Security Testing
- 17:18Container security analysis
- 18:21Infrastructure as code scanning
- 19:04Kubernetes resource scanning
- 20:29Observability in DevSecOps
- 21:36Integrating scans into workflows
- 25:10Challenges in DevSecOps maturity
- 25:53Start small with security scans
- 27:21Building DevSecOps culture
- 30:29Dealing with security debt
- 34:22Breaking the build and pipelines
- 35:23Summary and key takeaways
- 36:25Q&A and closing
related talks
40mDevSecOps Guide to Bulletproof Your Development Workflow
45mDevSecOps : add Security to your DevOps!
32mHow to fit Sec into DevOps without Security team
13mUnderstanding DevSecOps: Risk defense across your SDLC
39mSecurity Tooling in Your DevOps Pipeline
30mDevSecOps: More Than Just Pipelines
28mThe path to agile DevSecOps – a holistic approach of automation, orchestration and correlation
44mSecurity Practices Useful in Agile Development