Building a secure future using DEVSECOPS practices and technologies
summary
Equifax exposes 147 million Equifax accounts because Apache Struts went unpatched within 48 hours, Uber leaks 57 million via credentials left on GitHub, and Log4Shell (Log4J December 2021) plus an XZ Utils supply‑chain takeover show attackers target dependencies. Claim: about 78% of vulnerabilities come from indirect open‑source dependencies. Practical fixes: shift‑left threat modeling, integrate SAST and DAST in CI/CD, automate SBOM/patching and policy checks so critical CVEs are found and rolled out rapidly.
AI-written summary · about
chapters (7)
- 0:00Introduction and real-world breaches
- 3:48Supply chain vulnerabilities explained
- 11:13DevOps and security integration
- 18:12Building security into DevOps pipelines
- 22:49Cultural enablers for secure DevOps
- 27:02Open source software risks and patching
- 30:35Key takeaways and conclusion
related talks
39mWe Are All Equifax: The Data Behind DevSecOps
40mEmbracing Security - A Changing DevOps Landscape
46mThe Supply Chain Conundrum: Why Traditional Application Security Is...
13mKeynote: Hacking the OSS Supply Chain
50mStranger Danger: Your Java Attack Surface Just Got Bigger
46mLive hacking: Breaking into your Java web app
41mThe Divine and Felonious Nature of Cyber Security
18mIT Security – Don’t let Open Source Software become the next menace