Security as Code: A DevSecOps Approach
summary
Argues for making security decisions executable and shareable by codifying checks as queries and wiring them into CI. Shows CodeQL running on an intentionally vulnerable Android app, tracing data from getText sources to rawQuery sinks and producing confirmed SQL injection findings (two confirmed paths, NASA found 30 similar issues). Demonstrates enabling GitHub code scanning, reusing community queries, and cites GitHub Security Lab impact like 331 zero days published — queries are reusable and free for open source.
AI-written summary · about
chapters (16)
- 0:00DevSecOps and Security as Code
- 4:17NASA’s security checks codified
- 9:39DevOps and QA inspiration
- 12:08Security as Code methodology
- 13:57CodeQL basics and capabilities
- 17:29SQL injection vulnerabilities
- 19:15Live demo setup and query writing
- 22:06First CodeQL queries for sources
- 26:04Sinks and data flow templates
- 31:00Reusing predicates and exists
- 35:37Finalizing SQL injection query
- 37:29Reviewing findings and paths
- 41:49CodeQL for open source
- 43:15CodeQL alerts and remediation
- 44:40Community resources
- 46:06Q&A on CodeQL
related talks
22mSecurity as Code: A DevSecOps Approach
33mSecurity as Code: A DevSecOps Approach
37mSecurity as Code: A DevSecOps Approach
52mSecurity as Code: A DevSecOps Approach
54mFrom App Security to Dev Security – Shift left with GitHub Advanced Security
38mDevOps Meet Sec: Your Journey To Delivering Secure Code Fast
40mSecurity-as-Code to Accelerate DevSecOps, a Practical Guide to Get Started
24mSecurity as Code A SecDevOps Use Case