Defense-Oriented DevOps for Modern Software Development - James Wickett, Signal Sciences
summary
Argues that security must join DevOps with concrete practices: run Gauntlet tests (Ruby gem, .attack files, Docker sidecar, Travis CI) in CI, use runtime visibility via web‑app firewalls and WAF/WPA platforms, and adopt chaos engineering and bug bounties. Gives numbers: company does about 15 deploys/day and ~10,000 deploys in 2.5 years on <100 staff, cites 30% of Docker Hub official images with high‑severity flaws, and points to zero‑trust and non‑blocking fast validation.
AI-written summary · about
chapters (18)
- 0:00Introduction to talk
- 1:47DevOps at risk today
- 2:28Speaker's DevOps journey
- 7:05DevOps culture and friendship
- 10:34Security in crisis
- 13:23Security tools under scrutiny
- 15:50Rugged software and DevOps
- 17:16Old vs new security feedback
- 19:48Compliance adding value
- 21:38Chaos engineering in security
- 23:05Zero trust networks explained
- 24:50Fast validation in CI/CD
- 26:33Adversarial testing shift
- 28:00Gauntlet security testing tool
- 30:48Shift left in security
- 31:51Container security concerns
- 32:33Paved road for security
- 32:56Closing remarks and resources
related talks
31mDevOps: You Build It, You Secure It
39mThe Path Of DevOps Enlightenment For InfoSec
39mDevOps: The Return of Security
34mDevSecOps: How to Use DevOps to Make You More Secure
30mSecuring DevOps using OWASP DevSecOps Tools
01h 02mDevSecOps for Developers: How To Start
45mSo Happy Together: Making the Promise of DevSecOps a Reality
27mDevSecOps: How to Use DevOps to Make You More Secure