Integrating cloud native security into the SRE culture
summary
Argues that SRE practices (observability, automation, postmortems) can absorb security by wiring scanners into pipelines, dashboards and alerts instead of siloing them. Shows PoCs using Trivy operator alongside Thanos Prometheus Grafana Loki, automating image and filesystem scans, exporting findings to the GitHub security tab, and filtering noise so teams act on issues. Demonstrates a container with 750 vulnerabilities, cites a 2021 dataset of exposed cloud misconfigs, and describes pipeline guards that prevent accidental destructive actions.
AI-written summary · about
chapters (8)
- 0:00Introduction and speaker background
- 3:14SRE culture and security integration
- 7:26Why SRE and security work together
- 10:58Automating security in pipelines
- 14:50Choosing security tooling and scanners
- 21:50Team education and dashboard setup
- 25:01Iterating and evolving security tooling
- 26:04Q&A on security education and challenges
related talks
31mIntegrating Cloud Native Security into the SRE culture
34mIntegrating Cloud Native Security into the SRE culture
35mRole of SRE in DevSecOps
39mPragmatic Security for SRE
33mSecurity and SRE: Natural Force Multipliers
28mDefending against SRE with SRE
52mSecurity in Cloud-Native
25mHow do we help enterprise to adopt SRE and DevSecOps practices?