Realizing DevSecOps with GitLab and Infrastructure as Code
summary
A demo of an Accurics–GitLab integration that runs GitLab SAST and Infrastructure as Code scans side‑by‑side, enforces top 25 CWE and top 10 CVE policy packs in CI, and can break the build when severity thresholds are met. Shows two concrete use cases—Dockerfile/application SAST enforcement and Helm/Kubernetes YAML IaC checks—configuring environments, assigning policy packs, writing/testing custom regex rules, and a real pipeline failing on an XSS CWE‑79 with ~12 Kubernetes violations detected. Continuous runtime reassessment is included.
AI-written summary · about
chapters (7)
- 0:00Introduction to DevSecOps
- 1:35GitLab SAS integration overview
- 3:43Demo setup and pipeline stages
- 6:14Policy enforcement in CI/CD
- 7:38Configuring GitLab integration
- 9:25Custom policy creation
- 10:52Summary and resources
related talks
17mShift-Left Security in Practice with Gitlab
40mSecure by Default: Building an AI-Augmented, OSS-Powered Reusable CI/CD Pipeline
38mDevOps Meet Sec: Your Journey To Delivering Secure Code Fast
23mTrue DevSecOps with People, Processes, and Technologies
26mAI-Powered Security in GitLab | Sonar Integration Demo
26mOperational Compliance: From Requirements to Reality
27mSecure by Design: Embedding DevSecOps into Your GitOps Workflows
39mContinuous Security at the Next Level