SECOPS – Verifying Application, Environment and Organization
summary
Operational Security Verification focuses on concrete checks: verify logs are produced collected and protected, inventory third party components (often ~99% of shipped product), and confirm CI/CD and deployment systems reject unauthorized changes and do not run development in production. It specifies dynamic and static testing, privileged-account monitoring, incident playbooks with automated responses, patch and lifecycle plans, and regular recovery drills so backups actually restore — each control must be shown working with measurable results.
AI-written summary · about
chapters (17)
- 0:00Introduction
- 1:53Survivorship Bias
- 4:18Security Testing vs Traditional
- 4:54Big Picture
- 5:14Secure Operations
- 6:30Application Security
- 8:04Security Monitoring
- 9:00Logging
- 9:42Users
- 11:50Organization
- 12:48Application
- 14:08Landscape Management
- 15:18Lifecycle Management
- 16:30Infrastructure
- 17:32NFR
- 18:29Security survivorship bias
- 21:11QA
related talks
06mDevSecOps – Security Throughout the DevOps Pipeline
34mDevSecOps: How to Use DevOps to Make You More Secure
29mBuilding a Security Operations Program
06mDevSecOps is a Misnomer
27mMulti Security Checkpoints on DevOps Platform
41mWhat Is Devsecops? Key Steps to Do It Well
27mDevSecOps: How to Use DevOps to Make You More Secure
37mSecure Software, Inside and Out: Seven Steps