Taming Vulnerability Remediation at a Fortune 50 Company
summary
A small platform team uses OpenRewrite recipes plus a Python scraper and custom CLI to upgrade 2,700 Java apps across 324 teams, reducing container scanners that report 80–100 vulnerabilities per image and achieving FedRAMP progress. They automate Maven and Helm fixes, hand off recipe maintenance to the framework team, and report a three‑to‑four month effort costing ~$300k versus an estimated $24M manual cost; Kubernetes tuning raises utilization from 3% to 17%.
AI-written summary · about
chapters (13)
- 0:00Introduction and background
- 6:27Identifying the MVP for upgrades
- 12:11Building consensus and piloting
- 15:49Developing OpenRewrite recipes
- 21:58Overcoming technical challenges
- 25:53Kubernetes resource optimization
- 29:02Proxy configuration fix
- 31:30Retrospective and lessons learned
- 33:17Lambda runtime upgrades
- 35:02Patching base containers
- 37:08Roadmap and future plans
- 41:28Key takeaways and conclusion
- 43:19Q&A session
related talks
21mPlatform Security
52mRefactoring the ROI of Software Continuous Mondernization with Tanzu Platform
46mScaling the Security Researcher to Eliminate OSS Security Vulnerabilities Once and For All
36mImproving Security while Reducing Toil with DevSecOps
29mContainer vuln management with (hopefully) minimal...
40mEmbracing Security - A Changing DevOps Landscape
39mFrom Discovery to Fix: What 10,000 Open Source Projects Reveal About CVE Remediation
28mAutomated Java Upgrades: From Pain to Productivity in 30 Minutes