Azure DevSecOps
summary
Quick, concrete signals: demo pipelines show how Azure DevOps branch policies and code scanners stop bad commits, Azure marketplace lists 94 Azure DevOps security extensions (and 132 Visual Studio security extensions), and integrating Azure Key Vault into variable groups replaces checked-in secrets. A live demo accidentally publishes a personal access token to GitHub and Microsoft Security immediately flags and blocks it, proving the detection workflow works end to end. Tools shown include WhiteSource, Aqua, OWASP rules, Defender for Cloud and Sentinel.
AI-written summary · about
chapters (12)
- 0:00DevSecOps introduction
- 1:48DevOps vs DevSecOps explained
- 8:35Shifting left security
- 11:45Threat modeling workflows
- 14:51Branch policies security
- 19:27Code scanning validation
- 22:13Security tools in CI/CD
- 28:07Secrets and credentials
- 33:05Azure Key Vault integration
- 38:27Docker container security
- 40:55Web app firewall security
- 41:56Summary & Q&A
related talks
42mAzure DevOps security - Lessons learned
56mSeamlessly integrate security throughout your code to cloud workflow
49mAzure DevOps security - Lessons learned
20mDeliver Secure Software with Azure Devops & Github
52mImplement DevSecOps in Azure
50mBest Practices for Securing CI/CD Pipelines
50mBest practices for securing CI/CD pipeline
55mWhat you need to know about security for cloud DevOps