Design Approaches for Security Automation
summary
Built a modular automation framework that runs tools as Docker worker images, talks to a queuing layer with Celery and RabbitMQ, and exposes results via simple APIs so dashboards stay separate. Design favors many small security assertions that return true false for reliable metrics rather than noisy large scans. Integrations include Jenkins Maven Chef for CI hooks and a third party library tracker that surfaced vulnerable dependencies. Framework uses public internet scan feeds for asset discovery, takes about a year to mature, and is proving useful.
AI-written summary · about
chapters (17)
- 0:00Introduction
- 0:47Overview
- 1:46Have a clear idea
- 2:02Whats the difference
- 3:05The old curmudgeon
- 4:16The young engineer
- 4:46The old engineer
- 5:30Why
- 6:27Metrics
- 7:39Effects Management
- 8:37BehaviorDriven Development
- 11:11Automation
- 20:34Build vs Buy
- 21:08Security Automation Frameworks
- 21:55Tools
- 23:47Dynamic Variables
- 24:24Planning
related talks
40mDesign Approaches for Security Automation
27mStandard Classification: Automate Security, Don't Tell Your Boss
35mContinuous Cloud Security Automation
32mAutomating Security Compliance at Scale
52mContinuous Security
38mOpening Plenaries: Security in Automation
43mBuilding a Secure DevOps Pipeline
41mSkillful, Scalefull Fullstack Security in a State of Constant Flux