Guardians of Code: Continuously Monitoring Security and DevOps Compliance
summary
Claims that 64% attacked on supply chains and that pipelines must auto-generate SBOMs and sign artifacts; shows an open-source Ortelius hero project that ingests CD events into a queue and ArangoDB, correlates build commit → artifact → repo, and emits SBOM commit link scorecard reports per run. Demonstrates integrations with Jenkins, GitHub Actions, Syft, SigStore CoSign and SonarQube, and a dashboard that compares deploy environments to detect drift.
AI-written summary · about
chapters (13)
- 0:00DevOps security monitoring intro
- 1:04Supply chain attacks & compliance
- 2:10Build tools security history
- 4:43Security publications takeaways
- 6:08Automating security in CI/CD
- 7:59Security tools & integrations
- 10:50Hero Project for CD events
- 13:18CD events & data persistence
- 14:22SBOMs limitations
- 16:33Version control security challenges
- 17:36Security metrics & dashboards
- 19:23Artifact deployment tracking
- 20:31Call for collaborators
related talks
35mLearn New Ways of Tracking Security and DevOps Intelligence with Ortelius
42mThe Data Behind DevSecOps: The Power of Hindsight to Protect your Supply Chain
23mMastering Secure Software Supply Chains
27mSecuring the Software Supply Chain: Integrating OpenSSF Scorecard, Jenkins, and the O...
42mHow To Have Visibility And Security OF A CICD Pipeline
40mSecure by Default: Building an AI-Augmented, OSS-Powered Reusable CI/CD Pipeline
20mEnforcing Supply Chain Security and Simplifying Compliance Audit...
37mA Secure Continuous Delivery Pipeline