Mistakes Made Integrating Security Scanning into CI/CD
summary
An expired SSL certificate causes 100+ Slack alerts and a seven to eight hour outage that breaks many Jenkins pipelines, so the team builds a Jenkins shared library that uses Groovy as glue to run Python and bash scanner scripts inside Docker, driven by a layered config.json per org/repo, logs to Splunk for dashboards/alerts, uses fail open by default, and adds a ticket-driven whitelist workflow; the system prevents accidental build breaks and centralizes scanner management.
AI-written summary · about
chapters (12)
- 0:00Introduction and speakers
- 1:04SSL certificate expiry incident
- 2:52DevOps methodology overview
- 5:20Security in CI/CD pipelines
- 8:51Problems with old scanner model
- 9:35New model principles
- 12:48Jenkins shared library design
- 16:46Adding new scanners
- 18:55Logging and alerting setup
- 20:01False positives and whitelisting
- 21:28Key takeaways and future work
- 23:24Q&A session
related talks
39mContinuous Security at the Next Level
43mBuilding a Secure DevOps Pipeline
21mLessons from integrating third party library scanning in DevOps workflow
43mSecurity in DevOps Strategies
23mBuilding a Secure By-Design Pipeline with an Open-Source Stack
37mA Secure Continuous Delivery Pipeline
35mBuilding Reusable DevSecOps Pipelines on a Secure Kubernetes Platform
32mAutomating Security Compliance at Scale