Fortiying Tomorrow’s CD Pipelines: Harnessing the Power of DevSecOps Data Using...
summary
Claims a central evidence store named Ortelius evidence store ingests SBOMs, CVEs and pipeline logs, normalizes and aggregates them into aggregated logical application SBOMs, and continuously pulls vulnerability feeds (every ~10 minutes) to map blast radius and runtime deployments so one search shows where a package like log4j runs. Cites 90 million Jenkins workflows and the industry claim of 227 days to fix a vulnerability, and proposes automated rebuilds and redeploys to remediate quickly.
AI-written summary · about
chapters (11)
- 0:00DevOps pipeline maturity
- 2:09Collecting CI/CD data
- 3:57Microservice data fragmentation
- 6:23Introduction
- 7:28Evidence and CD events
- 8:12ORUS raw data use
- 11:00Consolidated evidence importance
- 13:07Logical apps and SBOMs
- 16:21Security tools tracking
- 18:12AI vulnerability remediation
- 22:27ORUS team acknowledgments
related talks
43mBuilding a Secure DevOps Pipeline
42mThe Data Behind DevSecOps: The Power of Hindsight to Protect your Supply Chain
27mSecuring the Software Supply Chain: Integrating OpenSSF Scorecard, Jenkins, and the O...
24mDependency Track Fortifying The Supply Chain
30mSecuring DevOps using OWASP DevSecOps Tools
11mIdentifying Security Vulnerabilities at Scale: Venture Inside a Pipeline
36mPolicy To Pipeline: How OSPOs Can Power Regulatory Readines...
51mThe End of DevSecOps?