Lessons from integrating third party library scanning in DevOps workflow
summary
Shows a working CI-integrated scanning pipeline: a local scan script mirrored in Jenkins, a baseline high-watermark to avoid blocking legacy debt, and separate dev and master workspaces in a results portal. Early repo-clone scanning yields 90% irrelevant findings and over half fail to build; the revised approach achieves 100% successful build scans for onboarded teams, catches 63% of fixed vulnerabilities before merge, and scales to 33 projects from 16 teams in one quarter with <1 FTE.
AI-written summary · about
chapters (15)
- 0:00Intro
- 2:54Open Source Libraries 100%
- 3:36Observations
- 4:38Security Use Case Need to Know Vulnerability Exposure
- 6:54Legal Use Case Need to Know Liability
- 7:50Principles Automation & Integration in DevOps
- 8:22Principles Guard Rails, Strategic Toll-Booths
- 9:12Principles Developer Inclusion, Not Just Awareness
- 11:43When to Trigger What factors did we consider?
- 12:16New vs Legacy
- 14:13Legacy Security Debt
- 14:57Where We Are Today What did we decide on?
- 17:20By The Numbers How did the initial approach work out?
- 18:32By The Numbers How about the current implementation? Complete coverage of runtime Ibraries
- 19:15Key Takeaways
related talks
43mBuilding a Secure DevOps Pipeline
49mDevSecOps: tips and tricks.
35mPractical DevSecOps for private and open source projects
19mApplication Security at High Velocity
28mDevSecOps - Security from Scratch
37mDevSecOps Guide to Bulletproof Your Development Workflow
40mDevSecOps Guide to Bulletproof Your Development Workflow
26mMistakes Made Integrating Security Scanning into CI/CD