Practical DevSecOps for private and open source projects
summary
Practical plan: prioritize scanning dependencies across source, binaries and containers because they represent the largest attack surface and are the fastest low‑hanging fruit; run scans inside the IDE (IntelliJ/Eclipse/VSCode plugin) to catch transitive-vulnerability and license issues before CI; store immutable toolchains and artifacts in a repository and build an impact graph to pinpoint which service/helm chart/container contains the vulnerable artifact; automate fixes and repository promotion with vulnerability-triggered workflows. shift-left Artifactory and X‑Ray IDE plugin
AI-written summary · about
chapters (11)
- 0:00Intro
- 2:50Cloud Native
- 7:40Single Point
- 10:22Repository
- 13:43Time to Market
- 17:25Compliance vs Vulnerability
- 19:43Impact Graph
- 21:47Dependency Management
- 25:52Integration
- 29:35Reporting
- 32:38Platform overview
related talks
28mDevSecOps - Security from Scratch
48mThe Quick Wins of DevSecOps
45mDevSecOps : add Security to your DevOps!
40mDevSecOps Guide to Bulletproof Your Development Workflow
37mDevSecOps Guide to Bulletproof Your Development Workflow
30mSupply Chain Security for OpenSource Projects
32mHow to fit Sec into DevOps without Security team
45mSo Happy Together: Making the Promise of DevSecOps a Reality