What Security People Want: Making DevSecOps Happen with Containers
summary
Argues that containers let security shift left by treating OS and runtime as code: build an base image pipeline that scans images against policy, signs them, and pushes approved artifacts into CI so patching is done by rebuilding and redeploying rather than SSHing servers. Recommends Docker + orchestrators (Marathon/Kubernetes), image scanning, secrets management, and inventory/attestation. Claims this yields image signing integrity, no SSH into containers operational model, and continuous compliance by design rather than manual post-production fixes.
AI-written summary · about
chapters (25)
- 0:00Intro
- 0:56Why do we care
- 1:39Business
- 3:02Low Risk Code
- 6:18DevOps
- 7:04Security vs DevOps
- 8:26DevOps is hard
- 10:33DevOps is a mess
- 11:54Security on the outside
- 12:55A promise
- 14:30Base images
- 17:00Reduce bloat
- 18:20No more patching
- 21:32Pipeline
- 21:45Image
- 24:38Trustworthy images
- 25:22Automation vs human
- 30:37What Security People Want
- 32:10Communication
- 34:42counterintuitive
- 37:01tolerance for change
- 38:05super tight DevOps
- 39:02code host operations in cybersecurity
- 41:18scan the images
- 44:04Containers can be replaced
related talks
48mContainer Security: It’s All About the Supply Chain
40mSecuring Containers on the High Seas
32mHow to fit Sec into DevOps without Security team
45mSo Happy Together: Making the Promise of DevSecOps a Reality
31mWhy SecDevOps is the new way in Cybersecurity?
30mHandling Security Objections to DevOps
31mDevOps: You Build It, You Secure It
36mUnderstanding the Sec in DevSecOps: Beyond Just Shifting Left