Security Tooling in Your DevOps Pipeline
summary
Argues security must shift left into CI/CD pipelines and shows concrete tools and tradeoffs: use SAST like PMD/Bandit/Brakeman or Checkmarx for fast code checks, DAST with OWASP ZAP or Burp for slower runtime testing, SCA with Snyk or OWASP Dependency-Check (SCA yields very low false positives), secret scanning with TruffleHog, container scanners like Clair and Docker Bench, ModSecurity for WAF testing in-pipeline, and infra-as-code checks for Terraform/CloudFormation; recommends an async heavier pipeline so builds stay under ~10 minutes.
AI-written summary · about
chapters (14)
- 0:00Intro
- 1:35Security
- 3:57Shifting Left
- 7:46Gatekeeping
- 9:34Waterfall vs Agile
- 11:59Security Tooling
- 15:30OASP
- 17:23Static Application Security
- 19:15Dynamic Application Security
- 20:25Software Composition Analysis
- 23:06Secret Detection
- 25:40Containers
- 28:33Infrastructure
- 34:19Resources
related talks
42mContinuous Security: Integrate security tools into your DevOps Pipeline
44mSecurity Practices Useful in Agile Development
29mSecuring Your Web Application Pipeline From Intruders
45mDevSecOps : add Security to your DevOps!
25mDecoupling DevSecOps from CI/CD Pipelines
40mSecurity-as-Code to Accelerate DevSecOps, a Practical Guide to Get Started
07mInterview
37mDevSecOps Guide to Bulletproof Your Development Workflow