Implementing Critical Cybersecurity Controls in a DevOps Environment
summary
Claims that DevOps must embed security by design and assume breach, with measurable actions: use MITRE ATT&CK for threat modeling, COBIT/NIST CSF for governance, and tools like Jenkins, Docker, Kubernetes, Terraform, Chef/Puppet/Ansible, Qualys, SCAP, CIS benchmarks, SIEM/SOAR for detection. Cites real failures — Docker Hub cryptomining, Meltdown/Spectre urgency — and prescribes shift left code scans, continuous audit and monitoring, incident drills with cloud providers, retention of forensic images, and rollout strategies such as A-B testing or spinning up remediated VMs then scaling down.
AI-written summary · about
chapters (20)
- 0:00Intro
- 1:16Backdrop - New Cybersecurity Normal
- 2:27Backyard - DevOps and Cloud
- 3:28Infrastructure as Code
- 7:06What is your Cyber Security and Risk Culture?
- 7:55DevSecOps & Security Responsibility
- 9:11Governance underscores the ability to Future-proof against Threats
- 10:09Adopt IT Risk Management Framework
- 11:45Risk of Adoption vs Risk of Non-adoption
- 12:37Perform Threat Modelling
- 13:36Adopt Key Principles - Security as Code
- 14:49Privacy-by-Design (integrated with Security-by-Design)
- 15:04Adopt Cyber Security Framework (1)
- 16:52Key Cloud Security Considerations
- 18:46Cloud Security Key Considerations
- 20:01Determine Key Security Controls (5)
- 20:52Active Cyber Defense Strategy
- 21:25Determine Architecture
- 21:49Baking Security into DevOps
- 24:34What it really means to the DevOps Practitioner
related talks
31mDevOps: You Build It, You Secure It
31mWhy SecDevOps is the new way in Cybersecurity?
30mHandling Security Objections to DevOps
32mHow to fit Sec into DevOps without Security team
27mMulti Security Checkpoints on DevOps Platform
45mDevSecOps : add Security to your DevOps!
30mThe 3 Ways of DevSecOps – Making Shift Happen
45mSo Happy Together: Making the Promise of DevSecOps a Reality