Embracing Security - A Changing DevOps Landscape
summary
Equifax exposes 150 million records after an Apache Struts CVE exploited in three days, showing why manual patching fails when mean time to remediation is 233 days. Modern apps are 80–90% assembled from OSS; Nexus/Maven Central audits find ~122,000 components with known vulnerabilities and only ~15.8% fixed. Build-time enforcement plus an Nexus Lifecycle IDE plugin and CI checks can block high-severity CVSS 9–10 artifacts, yield a 48% quality uplift and one bank cuts deploy time from 25 to 2.5 days.
AI-written summary · about
chapters (31)
- 0:00Introduction
- 4:13State of the Software Supply Chain
- 8:39Maven Central
- 12:18DevOps Community Survey
- 13:18Audit Stats
- 14:08jQuery
- 14:38Survey Results
- 15:30Timeline
- 20:57Bouncy Castle
- 22:45Commons Collection
- 24:16Apache Struts
- 24:48Toplevel dependencies
- 25:13Homebrew
- 26:02EventStream
- 27:11Struts
- 27:56Spring
- 28:31Average day before vulnerability
- 29:11Jean Kim
- 30:37Software Development Lifecycle
- 31:01CI Server
- 32:46Next Lifecycle
- 33:10Block bad stuff
- 33:58Know whats in your repository
- 34:21What about legacy applications
- 34:38How would that be great
- 34:53W Edwards Deming
- 36:57Credit Card Company
- 37:13Whitelist
- 37:35Investment Bank
- 38:43Shift Left
- 39:33Booth
related talks
39mWe Are All Equifax: The Data Behind DevSecOps
32mBuilding a secure future using DEVSECOPS practices and technologies
32mAdapting DevOps in a World of Growing Software Supply Chain Attacks
46mThe Supply Chain Conundrum: Why Traditional Application Security Is...
30mDevSecOps: How to Level Up IT Security Expertise in Your Organization
11mIdentifying Security Vulnerabilities at Scale: Venture Inside a Pipeline
37mPlatform and Security Engineering
01h 32mYour Applications are Under Attack: Protecting each step of the development lifecycle