Lightning Talk: Automating Industry Regulation (SoX, SoC...
summary
Shows an implementation that integrates OPA policy engine with Spinnaker via a cloud driver plugin and Orca hooks, backed by a centralized metadata store of image tags, scan results and pipeline events. Policies run at deploy time to enforce rules like SoX/SoC2 Separation of Duties (require two distinct approvers) and admission checks for VPC, LB ports, and vulnerability thresholds. Demo includes policy-triggered enforcement and an audit trail; the system enforces rules without adding explicit developer-only stages.
AI-written summary · about
chapters (8)
- 0:00Introduction to compliance automation
- 1:05Motivations and challenges
- 2:30Integrating security into delivery
- 3:59Compliance dimensions in Spinnaker
- 6:05Data collection for policy checks
- 8:12Policy engine and enforcement
- 9:38Key requirements for automation
- 11:05Q&A
related talks
33mAutomating Industry Regulation (SoX, SoC 2) Enforcement...
24mAutomating Enterprise/Industry Regulation Enforcements During Software Delivery
13mLightning Talk: (Micro)Chips and SLSA
20mUsing OPA to Ensure Compliant Software Delivery in a Highly Regulated Finance Envi...
23mPolicy-driven Deployments in Spinnaker
36mPolicy To Pipeline: How OSPOs Can Power Regulatory Readines...
37mPath To Production: Sustainable Compliance In Strict Environments
15mPolicy control for Software Supply Chain