DevSecOps: How to Level Up IT Security Expertise in Your Organization
summary
Cites Snyk and Sonatype data: npm vulnerabilities +47% year over year, PHP +56%, and 24% of orgs report a web app breach, with time to exploit falling to about three days. Implements daily known‑vulnerability scans and a free open source script that opens daily automated PRs to patch Node and Angular deps, integrates Signal Sciences and AppScan for live attack visibility, runs security corner 10‑minute briefings and a security guild, and enforces infra as code plus deployment frequency metrics to drive faster patching.
AI-written summary · about
chapters (14)
- 0:00Introduction and speaker intro
- 2:53Why security matters now
- 9:21Traditional security limits
- 12:13What is DevSecOps
- 14:19DevSecOps program journey
- 17:08Security education and training
- 18:12Weekly security corner meetings
- 19:56Security guild and documentation
- 22:03Slack channels for security
- 23:27Rolling out security tools
- 24:52Toolbox summit for developers
- 26:15Visibility over vulnerability reports
- 28:00Automating security checks
- 29:25Future of DevSecOps
related talks
40mEmbracing Security - A Changing DevOps Landscape
34mDevSecOps: How to Use DevOps to Make You More Secure
33mDevSecOps: How to Use DevOps to Make You More Secure
40mSecuring your dependencies
52mApplication Security at DevOps Speed and portfolio scale
53mFlipping the Script on Application Security
14mStranger Danger: Tracking Vulnerabilities in Your Third Party Code
47mSecurity is Everybody's Job