The Quick Wins of DevSecOps
summary
SolarWinds infects ~300,000 customers and compromises ~15–20k networks, so focus shifts from source-only checks to supply-chain hygiene: prioritize scanning produced binaries and dependency metadata, not just source. Use SAST early in the dev loop, combine with DAST/IAST where skilled, and avoid RASP as a first step. Generate an SBOM from build-info, scan artifacts in Artifactory with Xray, use IDE and CLI plugins (and Docker Desktop integrations) to catch vulnerable transitive deps, and follow SLSA levels; consider mutation testing and strong test suites.
AI-written summary · about
chapters (10)
- 0:00Start
- 6:36What happened: SolarWinds Hack
- 10:51What is Supply Chain Security?
- 20:04Basics of Cybersecurity
- 24:29BirdEye View - Cloud Native
- 31:51Low-hanging Fruits - Dependencies
- 39:00Executive Order of Cybersecurity
- 42:06Supply Chain Security for Software Development
- 42:27Supply Chain Security for Open Source Projects
- 43:50Shift Left int the IDE
related talks
54mSupply Chain Security for OpenSource Projects
45mDevSecOps : add Security to your DevOps!
35mPractical DevSecOps for private and open source projects
40mDevSecOps Guide to Bulletproof Your Development Workflow
28mDevSecOps - Security from Scratch
12mKeynote: DevSecOps and the Art of Not Ending Up On the Front Page
30mSecuring DevOps using OWASP DevSecOps Tools
46mApplication security from start to finish