From Devops to DevSecOps
summary
Claim: establishing a STRIDE-based threat modeling process turns security from late-stage audit pain into continuous DevSecOps practice. Workshops run 2–4 hours, recur every 3–6 months, and produce a prioritized security backlog, updated architecture diagrams and evidence for GDPR/ISO/PCI audits. Practical controls discussed include MFA, AWS CloudTrail and VPC Flow Logs, WAF/CDN (CloudFront/Shield), bastion host hardening and row‑level encryption; the Microsoft Elevation of Privilege card game helps teams run sessions and surface actionable fixes.
AI-written summary · about
chapters (7)
- 0:00Start
- 1:15futurice
- 2:04What is DevOps?
- 5:15Role Convergence in Software Development
- 9:06How Engineers Typically "Sell" Security
- 36:00Make it Fun
- 37:21What is the value you create with this?
related talks
29mA Threat Modeling Process can Help you Transition from DevOps to DevSecOps
45mDevSecOps : add Security to your DevOps!
22mEmpowering Developers through Threat Modeling Excellence
39mValue driven threat modelling - security by design
29mRedefining Threat Modeling: Security team goes on vacation
33mOvercoming the DevSecOps Imposter Syndrome
30mSecuring DevOps using OWASP DevSecOps Tools
28mImplementing Critical Cybersecurity Controls in a DevOps Environment