Building a DevOps Supply Chain on Zero Trust Principles
summary
Argues that DevOps must apply Zero Trust from code to cloud, with concrete controls: static analysis, infrastructure-as-code scanning (Terraform/Ansible templates), secret scanning (cites Check Point’s Spectral acquisition), CI/CD image scanning and admission controls for Kubernetes. Offers numbers: top Docker packages see ~18 billion downloads, 63% report API-related breaches, 50% routinely deploy known-vulnerable code, 87% say cloud-native needs different policies. Recommends prioritized, developer-friendly gates, continuous image inspection, and secret rotation automation.
AI-written summary · about
chapters (9)
- 0:00Introduction and disclaimer
- 1:09Zero Trust principles recap
- 2:57Recent breaches and trends
- 8:38DevOps supply chain risks
- 11:50Infusing Zero Trust into DevOps
- 18:18Check Point’s approach and solutions
- 20:47Q&A on secret scanning
- 22:21Q&A on lifecycle phases
- 23:04Q&A on Zero Trust measurement
related talks
43mThe art of secure software: Zero-trust delivery pipelines
27mLeveraging Infrastructure as Code to Create Zero Trust Access to Your Apps and Infrastructure
36mUnderstanding the Sec in DevSecOps: Beyond Just Shifting Left
31mDevOps: You Build It, You Secure It
28mImplementing Critical Cybersecurity Controls in a DevOps Environment
25mSecuring Your DevOps Transformation
51mSecurity 101: A Beginner’s Guide to Cybersecurity and Zero Trust for Developers
26mTaking Your DevOps Tooling To The Dark Side