From security theater to DevSecOps: Why security must be ingrained
summary
Argues that checkbox controls become security theater and promotes DevSecOps as a continuous, end-to-end approach; recommends a CNAPP that ingests CloudTrail, workloads, vuln scans and GuardDuty and applies a behavior analysis engine to correlate events. Claims integration with Amazon GuardDuty produces composite alerts that cut investigation time and alert noise — two customers catch compromised credentials within two weeks of deployment — and says unified visibility replaces costly point-solution stitching.
AI-written summary · about
chapters (15)
- 0:00Intro
- 0:44Compliance
- 2:13Security Teams
- 3:31Complexity
- 3:58Struggle Bus
- 4:43DevSec Ops
- 5:22Operational Environment
- 6:13Fragmented Visibility
- 10:05Vendor Pitch
- 11:38How do we do it
- 11:56Behavior analysis engine
- 12:11Composite alerts
- 12:46Guard Duty integration
- 13:06Customer references
- 13:25Conclusion
related talks
30mHandling Security Objections to DevOps
16mDevOps and Security
04mThe relationship between DevOps and security
10mKeynote: CloudNativeDevSecOps
31mDevSecOps, or How to Integrate Security into DevOps Practices
31mWhy SecDevOps is the new way in Cybersecurity?
36mUnderstanding the Sec in DevSecOps: Beyond Just Shifting Left
32mHow to fit Sec into DevOps without Security team