How practical is “DevSecOps” really? – A field report

on YouTube ↗48m

" summary

A large agile project builds two web apps (a point‑of‑sale and a back‑office on MDM cosmo) on Java backends, Angular/React frontends, Docker/Kubernetes and Jenkins, with only 8 hours a week of dedicated security budget. Manual pen tests do not scale; the team embeds automated access-control tests integrated into the QA suite and runs dependency checks (Ross dependency checker) plus periodic Docker/K8s CIS scans. Project grows from dozens to thousands of users and security shifts to high‑level processes, documentation in Confluence, and a single integrated security‑responsible role.

AI-written summary · about

" chapters (44)

1. 0:00Introduction
2. 2:01Definition
3. 3:29About me
4. 4:25Context is important
5. 4:51What are we doing
6. 5:37What we built
7. 6:41Technology stack
8. 7:50Introducing security
9. 8:12Lean applications security
10. 9:08Background
11. 10:41External Security Expert
12. 11:20Security Responsible
13. 13:50Context
14. 14:15Security
15. 14:36Security requirements
16. 16:44First lessons learned
17. 17:00Monetary reasons
18. 17:45Communication and processes
19. 18:47Thirdparty frameworks
20. 20:17Documentation
21. 20:53Security Documentation
22. 23:24Collaborative Documentation
23. 24:20Multitenancy
24. 24:34Brokers
25. 25:18Policies
26. 26:01Access Control
27. 26:37Penetration Testing
28. 27:06Agile Development
29. 27:56Integration
30. 29:16Atlas
31. 30:31OS dependency checker
32. 32:05Initial analysis
33. 33:52The tools
34. 35:14Deep look
35. 36:04Lessons learned
36. 37:23Agile project life
37. 37:40Project growth
38. 38:55Focus on daily security
39. 39:38Changes in daily work
40. 40:27Security responsible role
41. 41:28Politics
42. 42:22Standards
43. 43:51Team Awareness
44. 45:33Summary

" related talks

• 31mDevSecOps, or How to Integrate Security into DevOps PracticesGiuliano Ippoliti · DevOps D-DAY 2019
• 32mHow to fit Sec into DevOps without Security teamRoman Zhukov · Conf42 DevSecOps 2022
• 33mDevSecOps: How to Use DevOps to Make You More SecureZane Lackey · DevOps Enterprise Summit San Francisco 2017
• 30mThe 3 Ways of DevSecOps – Making Shift HappenPeter Chestna · DevOpsDays Seattle 2019
• 45mLessons From DevOps: Taking DevOps Practices Into Your AppSec LifeMatt Tesauro · OWASP AppSec Research (AppSecEU) 2015
• 34mDevSecOps: How to Use DevOps to Make You More SecureZane Lackey · DevOps Pro Europe 2019
• 45mSo Happy Together: Making the Promise of DevSecOps a RealityAlyssa Miller · All Things Open 2020
• 31mDevOps: You Build It, You Secure ItJohn Willis · DevOps Enterprise Summit San Francisco 2017