Shifting Left Securely
summary
Argues that security and compliance must be treated as quality by moving tests left into the pipeline, versioning the workflow and running checks locally so defects surface when cheap to fix. Shows infrastructure and pipeline as code, uses Test Kitchen for fast feedback, demonstrates InSpec as a compliance-as-code tool, and enforces controls like selinux enabled against the artifact (a converged machine). Continuous audit reduces exceptions and audit theater and lets teams ship with fewer surprises.
AI-written summary · about
chapters (7)
- 0:00Start
- 11:43NOT SURE IF SHIFTING LEFT
- 13:52MY TESTS DIDN'T PASS
- 14:52I DON'T ALWAYS USE A PIPELINE
- 16:33YOU HAVE TESTS IN THE PIPELINE
- 19:40PROBLEM WITH DISTRIBUTED
- 25:53PLEASE DEMOCRATIZE
related talks
49mBaking Safety into Infrastructure Testing
05mHow To Automate Compliance If You Aren't Chuck Norris
57mShift Left Security with the Security Test Pyramid
22mShifting left, how security fits into the DevOps story
33mTest Driven DevOps
39mTrust teams but verify: compliance as code done right
01h 04mShifting Security Everywhere
17mEnhancing cloud security with continuous compliance