SecDevOps: Current Research and Best Practices
summary
Covers concrete SecDevOps moves: build secure-by-default libraries (example wrapper that bans MD5), run fast git hooks and linters like eslint to block eval and detect leaked keys, and enforce code-host checks that block new inline JS while migrating legacy instances. Integrate fuzzing with AFL by adding ~12 harnesses, run a fuzzing cluster that auto-files JIRA tickets and finds ~13–15 unique crashes in days, and use tools like repo-git and chaos monkey to auto-reduce AWS permissions and harden services.
AI-written summary · about
chapters (21)
- 0:00Intro
- 2:48Agile and DevOps
- 4:15How to scale security
- 8:52Overview
- 13:53Static vs Dynamic Analysis
- 15:20Types of Static Analysis
- 17:03Good Hooks
- 20:22Start a Conversation
- 23:23Dependencies
- 24:47Running arbitrary checks
- 25:19Should I buy a static analysis tool
- 27:29Calculating the ROI
- 28:53Dynamic Analysis
- 29:36Security Baselines
- 30:40Unit Tests
- 31:56Background
- 33:24What we did
- 37:56Doing this well
- 40:11Infrastructure best practices
- 44:58Detecting attacks
- 48:39Questions
related talks
34mDevSecOps: How to Use DevOps to Make You More Secure
38mDevOps Meet Sec: Your Journey To Delivering Secure Code Fast
32mHow to fit Sec into DevOps without Security team
30mDevSecOps State of the Union
31mDevSecOps, or How to Integrate Security into DevOps Practices
31mDevOps: You Build It, You Secure It
45mDevSecOps : add Security to your DevOps!
01h 02mDevSecOps for Developers: How To Start