DevSecOps : add Security to your DevOps!
summary
Practical roadmap to add security into DevOps with concrete tools and steps: add SAST via editor plugins and CI to catch code bugs early, generate an SBOM/bill of materials and run dependency scans against NVD/MITRE, scan container images and registries and protect runtime with Falco, run DAST in staging and IAST for deeper runtime coverage, scan Terraform/IaC for misconfigurations, use nmap and scripted pentest templates, apply STRIDE threat modeling, track KPIs and start small continuous checks.
AI-written summary · about
chapters (9)
- 0:00Introduction DevSecOps
- 5:07Security in DevOps culture
- 10:32Vulnerability databases and tools
- 17:12Automated security scanning
- 24:01Cloud security challenges
- 30:14Developer training and best practices
- 36:04Risk assessment and threat modeling
- 41:07Starting small with security
- 43:42Q&A and closing remarks
related talks
31mDevSecOps, or How to Integrate Security into DevOps Practices
32mHow to fit Sec into DevOps without Security team
30mDevSecOps: More Than Just Pipelines
31mDevOps: You Build It, You Secure It
42mContinuous Security: Integrate security tools into your DevOps Pipeline
37mDevSecOps Guide to Bulletproof Your Development Workflow
40mSecurity-as-Code to Accelerate DevSecOps, a Practical Guide to Get Started
39mSecurity Tooling in Your DevOps Pipeline