Automate Vulnerability Detection in DevOps with Spinnaker
summary
Claims that 80–90% of apps include open source components and that about 11% of those components are known vulnerable, backed by a cited 376 billion Java downloads figure. Shows a concrete pipeline: local component repository + CI build server that enforces policy, Spinnaker deployment stage that runs automated scans, and post-deploy continuous monitoring. Recommends blocking bad components, enforcing CVSS thresholds (example: block >=5), standardizing component versions and tracking transitive dependencies.
AI-written summary · about
chapters (9)
- 0:00Introduction to vulnerability automation
- 1:06Problem with open source components
- 3:57Risks of malicious code injections
- 8:11Impact of data breaches from components
- 9:35Automation in vulnerability detection
- 13:07Typical DevOps pipeline with Spinnaker
- 17:00Best practices for policy enforcement
- 20:54Long-term vulnerability management
- 24:47Closing and contact information
related talks
08mAutomated & Immutable Spinnaker Deployments with Security...
11mIdentifying Security Vulnerabilities at Scale: Venture Inside a Pipeline
32mAdapting DevOps in a World of Growing Software Supply Chain Attacks
30mDevSecOps: Understanding Open Source Software risk in your applications
18mDevOps Tools for Java Developers
27mFind and Track the hidden vulnerabilities inside your dependencies
52mApplication Security at DevOps Speed and portfolio scale
20mAutomated Verification of Deployments for Risk Assessment