From Code to Cloud: Embedding Security
summary
Walks through concrete checkpoints: STRIDE threat modeling with examples (public-read bucket found, missing gateway for DDoS, need tenant isolation), developer-side static analysis using Checkov catching a public S3/Terraform misconfig, build-time image and manifest scans with Trivy flagging missing CPU limits and root containers, SBOM generation, and cryptographic image signing with cosign to verify integrity. Recommends two reviewers (CNCF), inventorying configs across ~10–15 teams, and using minimal base images.
AI-written summary · about
chapters (10)
- 0:00Introduction to Embedding Security
- 0:28Speaker Introduction
- 0:51Overview of Software Development Stages
- 1:30Development Phase: Threat Modeling
- 6:09Development Phase: Static Code Analysis
- 7:35Code Reviews and Distribution Phase
- 8:51Image and Manifest Scanning
- 10:01Signing and Hardening
- 15:51Runtime Security
- 18:21Conclusion and Tools Recap
related talks
24mCracking the Code of Cloud Security
47mBuilding Trust in Open Source: A Practical Guide to Securing Your ...
21mMake threats visible in your cloud environment — Eric Jung
58mHow to embed security into your process
40mSecurity-as-Code to Accelerate DevSecOps, a Practical Guide to Get Started
28mCode, Dependencies and Security: Where Is the Risk
41mIdentifying and Mitigating Cloud and Container Threats- 41mIdentifying and Mitigating Cloud and Container Threats