DevOps Days MTL 2019 - Philippe Lafoucrière
summary
Describes integrating security into the CI/CD pipeline by automating dependency scanning with open-source and OWASP tools, shifting security checks left, and adding merge-time checkpoints so decisions occur before code reaches master. Recommends starting with dependency scans (noting Node/NPM trees create many noisy/transitive alerts), iterating on the riskiest projects, and closing the SDLC loop to reduce friction and lower costly production fixes.
AI-written summary · about
chapters (6)
- 0:00Welcome to GitLab
- 4:44Security in production
- 11:47Devs and security balance
- 18:44Closing dev cycle loop
- 24:36Three key practices 2019
- 25:44Q&A
related talks
42mContinuous Security: Integrate security tools into your DevOps Pipeline
38mDevOps Meet Sec: Your Journey To Delivering Secure Code Fast
45mDevSecOps : add Security to your DevOps!
30mHandling Security Objections to DevOps
31mDevSecOps, or How to Integrate Security into DevOps Practices
27mMulti Security Checkpoints on DevOps Platform
22mShifting left, how security fits into the DevOps story
32mHow to fit Sec into DevOps without Security team