DevSecOps: The Good, the Bad and the Ugly
summary
Claims that DevSecOps scales security through automation with real metrics: 30 microservices onboarded in two hours and a security team of four supporting 700 apps with a team of four after automation. Real problems include slow rollouts, a yearlong minimum implementation, tool gaps (SAST SCA DAST, Burp lacking CI until recently), build fragility from Visual Studio vs MSBuild and CI instability (Jenkins outages), and noisy outputs like 360+ critical false positives that still demand manual triage.
AI-written summary · about
chapters (10)
- 0:00Introduction to speaker
- 0:45What is DevSecOps
- 3:33DevSecOps culture mindset
- 7:01DevSecOps tools landscape
- 8:49Automation benefits
- 13:25Advantages of DevSecOps
- 19:01Challenges in DevSecOps
- 21:31Implementation complexity
- 24:16Developer challenges
- 25:20Closing and Q&A
related talks
45mDevSecOps Worst Practices
39mDevOps: The Return of Security
32mDevSecOps is Dead, Long Live DevSecOps
30mDevSecOps: More Than Just Pipelines
06mDevSecOps is a Misnomer
31mDevSecOps, or How to Integrate Security into DevOps Practices
48mDevOps Is Automation, DevSecOps Is People
01h 02mDevSecOps for Developers: How To Start