Rugged Building Materials & Creating Agility with Security
summary
Argues that DevOps creates the first real chance to do security as code by fixing inventory, config and change visibility; cites a CA survey of ~14,000 enterprises showing security/compliance as the top DevOps blocker. Recommends prioritizing identity for privileged users and infrastructure, managing secret management (no keys in source), and using crypto tooling like Cloud HSM or AWS KMS with careful key management. Notes open tools (Conjur, HashiCorp Vault, Keywhiz, Barbican, Square Bletchley), warns crypto and key loss risks, and urges automated logging for auditable compliance.
AI-written summary · about
chapters (14)
- 0:00Intro
- 2:46Security Challenges
- 4:26Security Stack
- 5:33Security Automation
- 9:51Identity
- 10:31Privilege
- 13:12Identity Management
- 15:56Secret Management
- 16:55What NOT to do
- 18:09How to protect a secret
- 19:32How to manage a secret
- 23:46Crypto is scary
- 24:40Trust Anchors
- 27:47Logging Auditing
related talks
31mDevOps: You Build It, You Secure It
30mHandling Security Objections to DevOps
25mKeynote: DevOps - The Return of Security
34mDevSecOps: How to Use DevOps to Make You More Secure
39mDevOps: The Return of Security
32mHow to fit Sec into DevOps without Security team
39mSecurity in a DevOps World
27mMulti Security Checkpoints on DevOps Platform