Healthy Agile Product Security
summary
Cloud Foundry creates an open alert channel (security@) and a security triage team to ingest reports, uses Burp Suite discovery to catch bugs, and runs hands‑on security workshops with cognitive scientists to teach threat thinking. The program doubles disclosed CVEs (21 to 42 year‑over‑year) while keeping public repos and pipelines, and builds playbooks so engineers report and fix issues without fear. Early outcomes: faster triage, more transparency, and measurable increases in vulnerability disclosure.
AI-written summary · about
chapters (21)
- 0:00Intro
- 1:55Fearful Face
- 3:11Baking
- 3:21Tears of joy
- 3:33You can be calm
- 4:25Culture
- 5:47Security Culture
- 6:18Security Incident
- 9:08Healthy vs unhealthy culture
- 12:44Data breaches
- 13:44Values
- 15:16Outcome
- 16:19Vision
- 19:08Unhealthy Culture
- 19:32Disclaimer
- 20:22Security at Pivotal
- 23:21CBE
- 23:48CBE Deal Details
- 24:54Cloud Foundry Workshops
- 26:32First Cloud Foundry Workshops
- 28:34Honey Badger
related talks
23mAdvanced Vulnerability Management in Cloud Foundry - Molly Crowther & Stephen Levine, Pivotal
35mBuilding Security In: Using Cloud Foundry to Secure CF Apps
22mKeynote: Cloud Native Security: Rotate, Repair, Repave
37mShift left, shield right: Code-to-cloud strategy for securing apps
01h 01mDefendable Products: How we try to improve security in our products
23mTurbocharge your development with agile security
35mRunning Cloud Foundry in a Compliance and Security Focused Environment
31mStranger Danger: Addressing Vulnerable CF Application Dependencies