Understanding the Sec in DevSecOps: Beyond Just Shifting Left
Talkat Open Source Summit Europe 2023 · on Tuesday, 2023-09-19· at 12:20· Room 0E-1 (Floor 0), Abandoibarra Etorb., 4, 48011 Bilbao, Bizkaia, Spain·
summary
Argues that security already must be 360 and not just "shift left," insisting on zero trust across developers, CI, build servers, production and suppliers; recommends CI pipelines that run SAST, DAST, container scanning, dependency + license checks, secret detection, IaC scans and fuzzing; highlights vulnerability management, automated secret rotation and generating an SBOM for provenance; cites fast infra provisioning (minutes) and names tooling fragments like kicks and TV to scan configurations.
AI-written summary · about
chapters (22)
- 0:00DevSecOps introduction
- 1:27Evolution of software development and security as an afterthought
- 2:51Shifting security left
- 4:17Zero trust & supply chain
- 8:12Attack vectors overview
- 10:40Common dev attack vectors
- 12:28Bad practices & risks
- 14:14Vulnerable builds & deps
- 15:19Zero trust in org
- 16:03CI security scans
- 16:25Static application security testing explained
- 18:34Dynamic application security testing methods
- 19:58IaC security scan
- 22:07Container & runtime sec
- 24:13Dependency scanning
- 26:43Secret detection
- 28:10Fuzz testing
- 29:14Vuln management
- 30:20Compliance policies
- 32:27Supply chain & SBOM
- 33:35Rising attack surfaces
- 35:28Q&A
related talks
31mWhy SecDevOps is the new way in Cybersecurity?
30mDevSecOps: More Than Just Pipelines
32mHow to fit Sec into DevOps without Security team
22mShifting left, how security fits into the DevOps story
30mThe 3 Ways of DevSecOps – Making Shift Happen
06mDevSecOps – Security Throughout the DevOps Pipeline
06mDevSecOps is a Misnomer
31mDevSecOps, or How to Integrate Security into DevOps Practices