Secure Delivery in our Remote Reality: Modzy's Approach to DevSecOps
summary
Modzy describes a concrete DevSecOps pipeline that uses AWS accounts separated for dev/test/prod, GitLab or Jenkins for CI, and Armory Spinnaker for CD, ending CI at packaging and handing immutable artifacts to delivery. Non‑prod environments get regularly repaved, artifact tags are enforced with tag immutability and digital signatures are notarized and verified before promotion. The team follows the DoD DevSecOps reference architecture, limits human access to higher environments, and relies on automation and audit logs to prove provenance and prevent unauthorized swaps.
AI-written summary · about
chapters (19)
- 0:00Introduction and speaker background
- 1:44What is DevSecOps and why it matters
- 5:56Basics of information security
- 11:34Security considerations for remote teams
- 15:05Empowering developers in DevSecOps
- 16:07Best practices for non-production environments
- 17:31Automation for integrity and confidentiality
- 18:37Defense in depth in DevSecOps
- 19:59Finding inspiration for your process
- 21:02Practical example with Spinnaker and AWS
- 23:31Infrastructure as code and asset management
- 25:41Continuous integration best practices
- 28:28Build phase security checks
- 30:17Packaging phase hardening
- 32:24Separating CI and CD tools
- 33:29Deployment phase with Spinnaker
- 34:34Promotion phase verification
- 36:01Delivery phase final checks
- 38:29Key takeaways and summary
related talks
27mSecure by Design: Embedding DevSecOps into Your GitOps Workflows
43mThe art of secure software: Zero-trust delivery pipelines
31mDevSecOps, or How to Integrate Security into DevOps Practices
32mHow to fit Sec into DevOps without Security team
31mWhy SecDevOps is the new way in Cybersecurity?
27mMulti Security Checkpoints on DevOps Platform
38mSecuring your CI/CD Pipeline
30mHandling Security Objections to DevOps