What you need to know about security for cloud DevOps
summary
Shows how to move security from gates to continuous assurance with concrete tools and demos: runs an ad hoc scan and an automated daily scan via Secure DevOps Kit for Azure that checks 28 controls, creates autofix PowerShell scripts and an Azure Automation runbook, integrates Azure Policy into release gates, and plugs WhiteSource Bolt and OWASP ZAP into CI/CD to surface 21 vulnerable libraries, license risks, and 110 outdated packages so pipelines fail fast on real findings.
AI-written summary · about
chapters (22)
- 0:00Start
- 1:50Agenda
- 9:11The Security Development Lifecycle
- 13:41Overview about Vulnerabilities
- 15:20Static Application Security Testing
- 17:51Secure Devops Kit for Azure
- 20:24Install the Azure Devops Security Kit
- 21:10Running Security Verification Test Ad Hoc Scan Using Azure Devops Kit
- 31:17How To Set Up and Run Continuous Assurance Scan for Azure Subscription
- 35:25Log Analytics
- 37:18Using the Azure Devops Kit Extension
- 40:19Azure Policy
- 40:58Integrate Azure Policy
- 43:45Verification Time
- 45:23Azure Pipeline Security Extension
- 50:00Scanning Report
- 50:33Security Analysis
- 51:00Vulnerabilities Libraries
- 51:20Severity Distribution
- 51:49Securing Vulnerabilities
- 52:46License Risk and Compliance
- 53:32Outdated Libraries
related talks
52mImplement DevSecOps in Azure
25mSecuring Your DevOps Transformation
44mAzure DevSecOps
32mHow to fit Sec into DevOps without Security team
45mDevSecOps : add Security to your DevOps!
42mContinuous Security: Integrate security tools into your DevOps Pipeline
50mBest Practices for Securing CI/CD Pipelines
43mSecurity in DevOps Strategies