Security as Code: A DevSecOps Approach
summary
Describes turning security rules into code using CodeQL queries that run in CI/CD, with the team claiming 356 found vulnerabilities since March 2020 — roughly one every three days — and NASA reusing a generic query to find 30 similar bugs. Shows a live VS Code demo against the intentionally vulnerable Security Shepherd app, builds SQL injection data-flow queries that trace sources to sinks, and notes Log4J detections delivered within minutes.
AI-written summary · about
chapters (9)
- 0:00Introduction to speaker
- 1:50Open source security efforts
- 4:40Security as Code concept
- 7:13Introducing CodeQL basics
- 10:01SQL injection vulnerability
- 12:12CodeQL in action demo
- 20:42Passive vs active users
- 22:09Getting started resources
- 22:51Q&A session
related talks
22mSecurity as Code: A DevSecOps Approach
37mSecurity as Code: A DevSecOps Approach
59mSecurity as Code: A DevSecOps Approach
52mSecurity as Code: A DevSecOps Approach
27mHow to implement Security as Code?
24mSecurity as Code A SecDevOps Use Case
54mFrom App Security to Dev Security – Shift left with GitHub Advanced Security
14mHow Security as Code Transforms Platform Engineering at Scale