Top 10 Challenges for DevSecOps
summary
A concise, actionable checklist: a Top 10 challenges list distilled from work with hundreds of companies since 2015 that names concrete failures — hooking tools into CI/CD without triage, piling on static analysis SCA DAST RASP and container scanners, and inventing bespoke scripts that lack APIs — and prescribes fixes: design for automation, automation of triage to drop false positives and duplicates, use APIs to map repos and images, prioritize risk over raw CVSS, and focus on what’s new so pipelines surface only the genuinely new, actionable issues.
AI-written summary · about
chapters (12)
- 0:00Intro
- 2:23What the heck is this one about?
- 3:21Plan your automation approach
- 6:04Fit security into CI/CD
- 9:28Don't screw up CI/CD
- 12:05Reduce issues, don't increase
- 14:52Handle plenty of tools
- 19:12Automate triage
- 19:48Map to how dev works
- 21:53Prioritize properly
- 23:34Metrics, insights, improvement
- 24:26Communication
related talks
43mTen DevSecOps Culture Failures
45mDevSecOps Worst Practices
38mDevOps Meet Sec: Your Journey To Delivering Secure Code Fast
32mHow to fit Sec into DevOps without Security team
37mDevSecOps Guide to Bulletproof Your Development Workflow
32mCI/CD: Top 10 Security Risks
40mDevSecOps Guide to Bulletproof Your Development Workflow
31mWhy SecDevOps is the new way in Cybersecurity?