Building SSDLC in an Enterprise Environment
summary
Company builds a secure SDLC on Open Shift Kubernetes after a gap analysis, POCs and a huge Excel of tools and pricing; platform choices include sonar cube for SAST, ZAP for DAST, dependency track with CycloneDX for SCA, and a container scanner (integrated with Quay), plus Jenkins, Argo CD and Nexus in CI/CD. New DevSecOps and SRE roles enforce pipelines and alerts; SBOMs and CI integration work, but adoption needs technical champions, repeated training and phased migrations of legacy projects.
AI-written summary · about
chapters (15)
- 0:00Introduction and motivation
- 1:18Company background and goals
- 3:08Challenges and standardization needs
- 6:45Platform selection and requirements
- 7:27OpenShift Kubernetes platform overview
- 9:17Static application security testing
- 10:41Container scanning with Clair
- 11:48Dynamic application security testing
- 12:52Software composition analysis
- 15:46Dependency Track setup and workflow
- 17:32Summary of tools and platform
- 18:38New roles and security enforcement
- 19:22Target state visualization
- 20:04Lessons learned and future plans
- 21:31AI integration and closing remarks
related talks
48mDesigning a Secure Software Development Lifecycle with DevOps
50mCase Study: 10 Steps to Agile Development without Compromising Enterprise Security
26mSimple Guide to Secure SDLC
35mSecurity Culture: Why is it important?
47m101 - Deploy with OpenShift in an Enterprise Context
39mDevOps to DevSecOps journey: what is possible to cover with free and open source tools
13mUnderstanding DevSecOps: Risk defense across your SDLC
37mDevSecOps Guide to Bulletproof Your Development Workflow