Scratching the Surface of your CD?
summary
Claims that continuous delivery forces inline, fully automated security: fast IDE "spell‑checker" SAST, incremental SAST on build servers, IAST agent on servers and SCA in pipeline. Presents a three‑track model: an instant fast track, a side full‑build SAST run daily, and slow pen test/compliance track. Recommends soft gates with fix SLAs and hard blocks only for critical public exploits or compliance failures. Describes staged A/B rollouts (1% then 10%), and notes orgs push hundreds or thousands of updates per day.
AI-written summary · about
chapters (14)
- 0:00Introduction
- 3:06Continuous Delivery
- 8:19CICB Pipeline
- 13:44Testing Tracks
- 15:59Fast Tracks
- 17:44Testing Tools
- 20:34Second Track
- 22:44Risk
- 24:09Black and White
- 25:19What are gates
- 26:34Hard gates vs soft gates
- 28:09Hard gates only
- 28:54Be testing
- 32:49QA
related talks
40mDevSecOps Guide to Bulletproof Your Development Workflow
21mAdding DAST to CI/CD, Without Any Losing Friends
04mContinuous Integration, Continuous Delivery. Continuous Security?
27mSecurity Learns to Sprint: DevSecOps
28mThe path to agile DevSecOps – a holistic approach of automation, orchestration and correlation
19mApplication Security at High Velocity
37mDevSecOps Guide to Bulletproof Your Development Workflow
32mCatch Me If You can : Continuous Delivery vs. Security Assurance