Keynote Presentation Software Defined Security Governance
summary
Argues that modern appsec needs concrete actions not slogans: developers adopt cloud, containers, terraform ansible helm and pipeline-as-a-service, which creates an infrastructure as code gap because scanners for Terraform/Ansible are scarce. Recommends combining telemetry from SCA tools like Dependabot and Dependency-Track plus Semgrep and runtime events — there is no silver bullet so expect 10–30 integrated tools, shift some governance to guardrails-as-config, and focus on the orchestration center for attribution.
AI-written summary · about
chapters (12)
- 0:00Introduction
- 6:05Welcome
- 7:01Trends in Development
- 7:41Digital Transformation
- 17:18Security in Development
- 20:02Generational Gap
- 26:36Technologies
- 31:46Software Defined
- 35:19Open Source Scanning
- 44:37Evolving Past Scans
- 53:23Key Challenges
- 57:40Modern Life Cycle
related talks
10mKeynote: CloudNativeDevSecOps
15mKeynote: The Security Symphony
25mKeynote: DevOps - The Return of Security
09mKeynote: Modern Least Privilege and DevSecOps
38mKeynote: Dumping Traditional Security Teams
49mKeynote: CISO Perspectives
09mKeynote: Supply Chain: The New Threat Vector in Cloud Native Security
11mKeynote: Like a Magic Eye Illusion: Seeing the Bigger Picture for Cloud-Native S...