Designing a Secure Software Development Lifecycle with DevOps
summary
Argues that DevOps can deliver a provable SDLC for regulated orgs by pushing controls into pipelines: use compliance as code, record evidence in git as the system of record, enforce static analysis, vulnerability scans, artifact version control and cryptographically verifiable builds and hashes, and run immutable infrastructure containers with read‑only filesystems. Gives concrete examples: Google’s binary authentication with audit/deploy/continuous modes, Capital One’s single pipeline handling ~740 apps, and DORA data showing CAB-style approvals slow lead time and recovery.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 2:38The history of software development
- 7:43What can we learn from different methodologies
- 15:02Dont follow the rules
- 21:53Staying compliant while staying secure
- 33:42Security
- 41:53Compliance Data
- 43:25Security Culture
- 44:42Binary Authentication
related talks
27mMulti Security Checkpoints on DevOps Platform
23mTrue DevSecOps with People, Processes, and Technologies
30mHandling Security Objections to DevOps
31mDevOps: You Build It, You Secure It
30mThe 3 Ways of DevSecOps – Making Shift Happen
37mDevOps - The Automation of Compliance
32mHow to fit Sec into DevOps without Security team
31mWhy SecDevOps is the new way in Cybersecurity?