Turbo Eureka
summary
Stacc turns ISO27001 into continuous DevOps by recording SHA256 digests and build metadata at CI time, enforcing code review evidence in GitHub and Bitbucket pipelines, and using artifact registries plus Docker images to prove binary provenance. A 190‑person company with multiple acquisitions shows a phased rollout: proof‑of‑concept on two platforms, small task force, then org‑wide audits completed within months. Delays shrink via pair/mob programming and automated attestation so audits read machine records instead of pulling paper tickets.
AI-written summary · about
chapters (22)
- 0:00Introduction
- 1:20About Stack
- 8:54About Mike Long
- 9:57How can we merge these two worlds
- 13:38Knight Capital
- 15:42Audits
- 17:12Knight Capital Report
- 17:56Software Process
- 20:28Software development culture
- 22:03Smart developers
- 22:52Compliance and security
- 25:56Provenance
- 27:51Mitigation
- 28:54Software Supply Chain
- 29:27Insider Threat
- 30:27Qualification
- 30:51Work stuff gets delayed
- 33:03Back to the story
- 34:58Another security control
- 36:28Software development lifecycle
- 37:33Back to Stack
- 44:23Key takeaways
related talks
32mFrom Code to Trusted Release
23mProject Everest: Perspectives from Developing Industrial-Grade High-Assurance(…)
23mTurbocharge your development with agile security
50mMapping ISO 27001 to Modern Software Engineering: Secure by Design
35mAchieving End-To-End Software Supply Chain Security With in-toto
30mProve it! The Last Mile for DevOps in Regulated Organizations
42mEngineering Trust: Integrating Security into Your Modern SDLC
32mState of the Art Supply Chain Security