The Implementation and Practice of DevSecOps
summary
Since 2018 a bank runs a DevSecOps program that integrates SAST, DAST, IAST and FOSS scanning into Jenkins CI/CD to catch vulnerabilities early, specifically using Checkmarx, Contrast and Sonatype Nexus IQ; the rollout starts in four pilot teams and takes a few months per team. Training combines embedded tool tutorials, a gamified platform and 50+ training modules plus security coding events to create semi‑security experts. A 30+ page maturity model measures teams so security assessments are simplified when maturity proves risk reduction.
AI-written summary · about
chapters (12)
- 0:00Introduction
- 2:28What is DevSecOps
- 11:49DevSecOps Current Status
- 14:46Challenge
- 21:09Static Application Security Testing (SAST)
- 22:45Dynamic Application Security Testing (DAST)
- 24:00Interactive Application Security Testing (IAST)
- 27:25DevSecOps Implementation Model
- 29:56DevSecOps Operating Model
- 31:44Automate DevSecOps Tools into CICD Pipeline
- 34:36FOSS - Sonatype Neuxs IQ Server
- 38:04Cyber Security Event - Security Coding Competition
related talks
31mDevSecOps, or How to Integrate Security into DevOps Practices
13mUnderstanding DevSecOps: Risk defense across your SDLC
45mDevSecOps : add Security to your DevOps!
42mThe Challenge and Solutions to Implement DevSecOps into Large Banks
30mDevSecOps: More Than Just Pipelines
42mThe Challenge and Solutions to Implement DevSecOps into Large Banks
48mHow practical is “DevSecOps” really? – A field report
43mBuilding a Secure DevOps Pipeline