The DevSecOps Journey at Prudential Asia
summary
Prudential runs four concrete DevSecOps tracks: SAST with IDE plugins and CI integration, DAST in CD pipelines against preprod apps, SCA with artifact repo and production monitoring enabled, and container scans tied to registries and orchestrators. Practices include automated build breakers/gates, documented onboarding and issue metrics, a triage workflow because tools produce false positives, a staffing ratio of ~1 security engineer per 200 developers, tool refresh every 2–3 years, and continued manual pen testing for at least 7–10 years.
AI-written summary · about
chapters (8)
- 0:00Introduction
- 0:47DevSecOps Definition
- 6:01Requirements
- 15:35Track
- 15:47sass
- 21:05task
- 30:28Container Security
- 33:40Conclusion
related talks
39mPragmatic Security for SRE
30mDevSecOps: More Than Just Pipelines
31mDevSecOps, or How to Integrate Security into DevOps Practices
44mThe Implementation and Practice of DevSecOps
48mHow practical is “DevSecOps” really? – A field report
45mDevSecOps : add Security to your DevOps!
40mDevSecOps Guide to Bulletproof Your Development Workflow
57mDev-first security: From code to cloud, and back to code (PRT291)