Implement DevSecOps in Azure
summary
Claims a practical path: isolate environments with a subscription per environment and management groups, enforce Azure policies up-front so infra-as-code fails earlier, and run checks in CI/CD using Security Code Analysis, WhiteSource for dependency and license checks, and ARM template checks. Automated release-stage scans use a Dockerized OWASP ZAP and Azure Security DevOps Kit SVT producing CSV/ZIP reports that found credentials in web.config and missing HTTPS. Starts from the premise 1 security person per 100 developers and says 6–8 controls yield ~80% coverage.
AI-written summary · about
chapters (24)
- 0:00Intro
- 0:21About Victoria
- 1:47Statistics
- 2:30DevOps
- 4:43Security Patterns
- 5:08Plan wisely
- 5:43Subscription per environment
- 6:49Apply the policies
- 7:45Security Center
- 9:20CICD Pipeline
- 11:12Management Groups
- 12:35Policies
- 13:42Development
- 17:31Static code analysis
- 23:59Azure DevOps
- 29:35Phoenix Project
- 38:28Security Code Analysis
- 39:16Build Pipeline
- 41:40Licensing
- 42:14Pentesting
- 43:37Release Pipeline
- 44:04Release Report
- 45:34AZS Toolkit
- 47:07SPT Test
related talks
55mWhat you need to know about security for cloud DevOps
54mImplement DevSecOps in Azure
39mDevOps: The Return of Security
44mAzure DevSecOps
25mSecuring Your DevOps Transformation
45mDevSecOps : add Security to your DevOps!
32mHow to fit Sec into DevOps without Security team
25mKeynote: DevOps - The Return of Security