Rethinking the “Sec” in DevSecOps for modern architectures
summary
Cuscal describes a move to product teams with a mono-repo, a self‑service registry and Terraform Cloud workspaces that cut cloud team bottlenecks; toolset includes Terraform Cloud and GitHub Enterprise, OPA for policy checks, Inspector/GuardDuty/SecurityHub pilots, and Jira ticket automation proof‑of‑concepts. Architecture hits: ~800 pipelines, ~100 fine‑grained deployment roles across five domains (avg six envs each), 200–300 Amazon WorkSpaces for externals, StackSets driven from Terraform, scheduled Terraform state backups to S3; most changes are incremental and the automation sandpit and registry are already working.
AI-written summary · about
chapters (27)
- 0:00Introduction
- 1:21Context and challenges
- 6:18Cuscal cloud adoption
- 10:28Cultural shifts
- 12:27Security culture
- 13:54Process improvement
- 15:47Self-service capabilities
- 18:15Automation over clickops
- 20:37Pipeline maturity poll
- 22:28Tooling and complexity
- 25:52Onboarding security
- 26:52Least privilege access
- 28:06Deployment tools poll
- 29:19Approval workflows
- 32:04Automation risks
- 34:26Distributed team security
- 36:12Pipeline segmentation
- 37:43StackSets in terraform
- 41:03Guardrail adoption
- 44:40SCP rule toggling
- 48:07Scanning capabilities poll
- 49:22Vulnerability scanning
- 51:57ECR testing instructions
- 53:09CI/CD toolchain poll
- 54:44Advanced security scanning
- 56:48Module governance
- 58:30Conclusion
related talks
28mHow Remote Work is Driving the Need for Multi-Cloud DevSecOps: How to Build a Pipeline
53mGround Truths of a Rugged DevOps Practitioner
27mOur DevOps Journey So Far (and Terraforming)
32mHow to fit Sec into DevOps without Security team
07mCI/CD Evolution: Ensuring Security and Overview During Rapid Growth
31mDevSecOps Ain't That Hard, a Framework
30mHandling Security Objections to DevOps
39mDevOps to DevSecOps journey: what is possible to cover with free and open source tools