Security: The Thing That Everyone...
summary
Panelists call out concrete failures and fixes: a new quishing scam example and Log4j panic motivate practices like generate SBOMs and run image/infra scans in CI, using Kerno-style policy engines to enforce guard rails (e.g., GDPR checks) and VEX-style attestations to acknowledge irrelevant CVEs. They recommend gating merges — reject PRs with high severity — prioritize highest-risk fixes first, automate checks so security isn’t manual tech debt, and invest in training so teams share ownership rather than blame.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 1:25Panel introduction
- 3:33Security blackbox for devs
- 6:25Blame culture in security
- 9:32Prioritizing security in products
- 13:06CNCF security landscape
- 16:57Long-tail vulnerabilities
- 19:27Compliance vs real security
- 22:00Closing thoughts
related talks
49mPragmatic Approaches To Building Secure Software
50mRunning in the Shadow: Perspectives on Securing the Software Supply Chain
54mSecuring the Digital Supply Chain: What we should do for Supply Chain Security in DevSecOps?
01h 04mShifting Security Everywhere
38mDevSecOps Panel "AppSec Would Never Catch Me"
33mLearning from Past Security Breaches: Strengthening AppSec Efforts and Focus
40mMaking Security an integrated part of the SW Dev Lifecycle
49mEverything is Terrible: Three Perspectives on Building, Configuring, and Securing Software