Operational Compliance: From Requirements to Reality
summary
Onyx Point operationalizes compliance by integrating scanners and policy checks into GitLab CI pipelines, using open tools like the SCAP Security Guide, InSpec, and custom SCAP profiles to map PCI DSS HIPAA and NIST 800‑53 rules to tests. Systems run auditd and other modules configured by code, scans record oval reports and failures stop promotion to production. The result is reproducible compliance-as-code with saved reports auditors can consume and pipelines that fail-fast on policy violations.
AI-written summary · about
chapters (20)
- 0:00Intro
- 0:31About Onyx Point
- 0:59Onyx Point Headquarters
- 1:11Disclaimer
- 1:34Scenario
- 3:40Requirements
- 6:02PCI
- 6:38NIST
- 8:16DevOps
- 8:55Conflict Between Teams
- 10:41Policies Not Scanners
- 11:20Open Source
- 13:16InSpec
- 14:29Continuous Integration
- 18:17Command and control utilities
- 18:35Standard tools
- 18:58Security team
- 20:36Security teams
- 22:38Demo
- 24:41Operationalize Security
related talks
05mHow To Automate Compliance If You Aren't Chuck Norris
11mRealizing DevSecOps with GitLab and Infrastructure as Code
37mDevOps - The Automation of Compliance
32mAutomating Security Compliance at Scale
30mEnhance your Compliance with Policy-Based CI/CD
42mSolving for DevOps Auditors with Automated Compliance
33mCompliance Without the Chaos: Building It Right Into Your DevOps...
37mPath To Production: Sustainable Compliance In Strict Environments