Hell Has Frozen Over: DevOps & Security
summary
Argues DevOps and security can cooperate by changing behavior and using tooling: configuration management reduces drift and low‑hanging risks, provisioning APIs enable self‑service firewall and port changes, and logging/aggregation (Logstash) plus CM builds an always‑fresh inventory so audits stop taking weeks. Claims Google runs Puppet manages 30,000 desktops and turns a 6–8 week audit into an immediate audit report in real time, shifting security from “no” to quantifying business risk and workable controls.
AI-written summary · about
chapters (14)
- 0:00Intro
- 0:35Who me?
- 2:55Three things I hated about Security
- 4:09What IT think Security do
- 4:32What the business think Security do
- 4:55What Security people think they do
- 5:20What Security Isn't
- 6:00What Security Is (or Should Be)
- 7:26The Intersection
- 8:54Security people are people too
- 10:35DevOps & Security
- 13:04Getting Security to Listen
- 19:28Talking Controls
- 25:38Ideas for Collaboration
related talks
34mDevOps and Security: The Facts, The Myths, The Legend
29mAn Unlikely Happy Couple - DevOps and IT Audit?
39mDevOps: The Return of Security
30mHandling Security Objections to DevOps
31mDevOps: You Build It, You Secure It
04mThe relationship between DevOps and security
58mWhy Infosec Needs Rugged DevOps Now: A Study Of High Performing IT Organizations
44mDevSecOps: Balancing Agility, Security & Stability in a Continuous Software Business