DevSecOps Panel "AppSec Would Never Catch Me"
summary
Panel argues that security gets solved by automating checks inside CI/CD rather than policing releases manually: start with npm audit or a dependency scanner, add container scans and static analysis, and push fixes into the pipeline; Snyk (easy to integrate) and Xray-style reports surface transitive dependency risk. Teams run red/blue exercises and chaos-style hypotheses, then certify the pipeline so releases stay fast. Progress shows up as automated checks failing in CI and engineers complaining.
AI-written summary · about
chapters (9)
- 0:00Intro
- 0:25Meet the panelists
- 1:46What is DevSecOps
- 4:53Rugged DevOps
- 5:57The bottleneck shifted
- 8:17Developers get feedback faster
- 10:12Awareness
- 13:41Unfamiliarity
- 23:23Chaos Engineering
related talks
31mDevSecOps, or How to Integrate Security into DevOps Practices
28mWhy Developers Struggle with AppSec
30mDevSecOps: More Than Just Pipelines
42mContinuous Security: Integrate security tools into your DevOps Pipeline
28mDevSecOps - Security from Scratch
32mHow to fit Sec into DevOps without Security team
27mSecurity Learns to Sprint: DevSecOps
04mContinuous Integration, Continuous Delivery. Continuous Security?