Security as Code: A DevSecOps Approach
summary
A practical recipe: codify checks as queries, run them in CI/CD, and catch real bugs before deploy. Demonstrations use CodeQL queries integrated into GitHub code scanning, including a live SQL injection data-flow query that finds sources-to-sinks. Concrete claims: GitHub Security Lab reports one vulnerability every three days in OSS and NASA finds ~30 similar bugs from a single array-off-by-one pattern. Also shows using GitHub Copilot to speed query authoring and how alerts appear directly in pull requests.
AI-written summary · about
chapters (13)
- 0:00Security as Code intro
- 2:52NASA Mars Rover parachute bug
- 7:53CodeQL community security
- 9:38Developer-first security culture
- 10:01Security as Code methodology
- 13:49How CodeQL works
- 14:12Code scanning workflow
- 18:27SQL injection demo
- 36:05CodeQL templates
- 37:28CodeQL future with Copilot
- 45:28CodeQL features
- 46:13CodeQL learning resources
- 47:17Q&A
related talks
33mSecurity as Code: A DevSecOps Approach
59mSecurity as Code: A DevSecOps Approach
37mSecurity as Code: A DevSecOps Approach
22mSecurity as Code: A DevSecOps Approach
38mCode Security Reinvented: Navigating the era of AI
41mBake Security into your workflow with GitHub Advanced Security and AI
23mStopping vulnerabilities at the source
58mSecuring Code in the Age of AI