Navigating the security compliance maze of an ML service
summary
Practical run-through of compliance chores with concrete tools and outcomes: ISO-27001 certification completed, discussion of sift/trivy scans, generation of an SBOM, use of pixie lockfiles, OpenSSF scorecard and model cards, plus advice on pentests and automated linters. Presents a live example of a Jupyter/Polars/LightGBM environment that yields 2,382 packages and flags 19 vulnerabilities, with guidance on triage, risk matrices, phantom deps and what actually needs fixing versus what can be ignored.
AI-written summary · about
chapters (7)
- 0:00Software engineers and compliance
- 3:53Compliance requirements and roles
- 8:04Compliance and risk theory
- 10:11Third-party dependencies
- 14:20Automating compliance checks
- 18:38Secure ML pipeline example
- 27:51Q&A
related talks
26mRunning Secure AI/ML Experiment in a Unified MLOPS-DevSecOps Pipeline
15mApplying DevSecOps Lessons To MLSecOps
25mSecure ML: Automated Security Best Practices in Machine Learning
41mEfficient DevSecOps workflows with a little help from AI
32mClimbing high — getting started with cloud native security through open source
27mA Gentle Introduction to MLSecOps
21mEnd-to-end secure ML Development
45mLeveraging Projects and Tools to Transform Your SDLC