Pragmatic Security for SRE
summary
Pragmatic approach maps security controls to five pipeline phases—develop, inherit, build, deploy, operate—and gives concrete tools and checks: pre-commit hooks and IDE SAST, secrets scanning with get-secrets and retire.js, dependency checks like bundler-audit and a published bill of materials, CI probes with the open-source gauntlet framework (used at scale and credited with saving millions), infra tests via serverspec/inspec, cloud guard tools, regular red-team sessions, and security chaos engineering to validate detection and recovery.
AI-written summary · about
chapters (7)
- 0:00Introduction to DevSecOps
- 3:01Rethinking security
- 12:44Develop phase
- 20:21Inherit phase
- 23:25Build phase
- 26:32Deploy phase
- 29:27Operate phase and conclusion
related talks
44mSecurity Practices Useful in Agile Development
39mSecurity Tooling in Your DevOps Pipeline
35mRole of SRE in DevSecOps
30mIntegrating cloud native security into the SRE culture
45mDevSecOps : add Security to your DevOps!
29mSecuring Your Web Application Pipeline From Intruders
35mThe DevSecOps Journey at Prudential Asia
40mSecurity-as-Code to Accelerate DevSecOps, a Practical Guide to Get Started