DevSecOops: 15 years of DevOps and patching is still horrible
summary
Customer scan reports show 7 million instances of CVEs but analysis using Excel pivot tables reveals only about 168,000 apply to Red Hat components, with 95% false positives caused by poor RPM, Python and Go parsing. App platform initially reports 20 critical and 69 high issues but only one true critical remains; certified scanner and vendor fixes remove the rest. Original vendor tooling also causes a production outage, leading to replacement and new runtime protection practices.
AI-written summary · about
chapters (8)
- 0:00Introduction and setup
- 1:27Why DevSecOps matters now
- 3:16Analyzing scan results with Excel
- 7:52False positives and vendor issues
- 10:58Does patching still matter?
- 13:49Application code and DevSecOps
- 16:18Mitigating CVEs without patching
- 18:25Conclusion and key takeaways
related talks
40mEmbracing Security - A Changing DevOps Landscape
34mEvolving Secure Development through FedRAMP Continuous Monitoring Trends
47mThe Open Source Paradox: Unpacking Risk, Equity, and Acceptance
42mScan, Patch, VEX - Using Open Source Tools to Manage...
39mFrom Discovery to Fix: What 10,000 Open Source Projects Reveal About CVE Remediation
46mThe Supply Chain Conundrum: Why Traditional Application Security Is...
35mKeeping Up with the CVEs: How to Find a Needle in a Haystack?
39mHard to Port! - A Snapshot of the Vulnerability Landscape in 2015