How a 0-day event galvanized a developer-led security mindset at DISH
summary
DISH moves from ad hoc security to a developer-led program using Snyk and AWS, covering ~3,000 devs and several hundred apps; rollout hits thousands of repositories in ~60 days and CICD next. One team fixes nine unique critical Java vulnerabilities across ~200 instances in 15 days, another remediates ~800 high/critical issues in 30 days, and a 20‑week analysis shows a 70% reduction in preventable vulnerabilities, proving shift-left prevention and risk‑based rollout scale rapidly.
AI-written summary · about
chapters (24)
- 0:00Introduction and speakers
- 2:27Dish Network’s diverse services
- 3:08Application environment at Dish
- 4:31Dish’s AWS and 5G network
- 5:56Modern apps and infrastructure as code
- 7:01Security before Log4Shell
- 9:26Log4Shell galvanizing event
- 10:35Snyk POC after Log4Shell
- 12:20Spring4Shell and compliance deadlines
- 13:46Choosing Snyk for coverage
- 15:13March incident and prevention focus
- 16:16Risk-based Snyk rollout
- 18:24Quick wins with Snyk
- 19:52Measuring 70% vulnerability reduction
- 21:38Developer-security team collaboration
- 22:43Usage scorecards for teams
- 23:44CICD integration and policy gates
- 24:47Patching policies and accountability
- 25:52Key benefits of Snyk at Dish
- 26:59Ideal state of DevSecOps
- 28:04Evaluating AppSec tools
- 28:47Advice for shift left adoption
- 31:11ROI and developer training
- 33:18Closing and Q&A
related talks
40mEmbracing Security - A Changing DevOps Landscape
30mDevSecOps: How to Level Up IT Security Expertise in Your Organization
48mThe Quick Wins of DevSecOps
57mDev-first security: From code to cloud, and back to code (PRT291)
36mThe Road To Being Rugged
39mFrom Auditions to Opening Night: Selecting Security Tools that... (Saurabh Sharma)
01h 01mDefendable Products: How we try to improve security in our products
46mApplication security from start to finish