DevSecOps for Developers: How To Start
summary
Claims that building security into DevOps improves both delivery and security (citation: Accelerate) and gives pragmatic steps for a lone security person facing one security per 100 developers. Advises to live off the land: integrate with JIRA, Slack, IDE plugins and dashboards, add fast stable CI checks, use trunk-based development and feature toggles for safe rollbacks and A/B tests, reuse incident channels/war rooms for vulnerabilities, deputize one security engineer per team, and learn from GitLab’s rm catastrophe where public communication and tested backups preserved trust.
AI-written summary · about
chapters (17)
- 0:00Introduction
- 5:07Why DevSecOps
- 10:52Complicated Domain
- 11:15Solving Problems
- 15:12Complex vs Complex
- 20:42Incidents in Production
- 26:12Pre DevOps Deployment Workflow
- 27:40No Security Team
- 28:47Live Off The Land
- 30:45Have the devs build it
- 32:55Trunkbased development
- 37:07Incident response
- 42:05How to find out
- 46:37How to handle a crisis
- 50:33Automate
- 52:47Operations vs Security
- 58:29Shifting Security Left
related talks
39mDevOps: The Return of Security
38mDevOps Meet Sec: Your Journey To Delivering Secure Code Fast
06mDevSecOps – Security Throughout the DevOps Pipeline
34mDevSecOps: How to Use DevOps to Make You More Secure
27mDevSecOps: How to Use DevOps to Make You More Secure
31mDevOps: You Build It, You Secure It
32mHow to fit Sec into DevOps without Security team
25mKeynote: DevOps - The Return of Security