Introduction to CDD and Security Centric System Design
summary
Explains Compliance Driven Development by showing a working pipeline that maps tests to controls and produces evidence: uses Pivotal platform, an on‑demand broker to deploy Crunchy Certified PostgreSQL‑as‑a‑Service tile, InSpec profiles and PG Audit to collect events, and automated reports the assessor understands. Claims 111 automated controls and about 1,400 automated checks, converts STIG requirements into base profiles plus overlays, fixes 5 failing items and reduces rejects to zero, and achieves an ATO in the NGA “ATO In a Day” pilot.
AI-written summary · about
chapters (20)
- 0:00Intro
- 0:23CRUNCHY DATA: ABOUT US
- 1:07Our Contributions to the PostgreSQL
- 2:10Lets Talk about Compliancel
- 3:10CDD/TDD Processes Evolution
- 6:52What is Compliance?
- 8:47Compliance Standards
- 9:12Risk Management Framework
- 12:17Compliance and Risk Assessment Rules
- 13:32Lets build a system
- 14:38Test Driven / Behavior Driven Development
- 15:21Writing Test Cases Upfront
- 16:20TDD / BDD Test Code Coverage
- 18:01Us vs Them Moment (Developers)
- 19:32We were not compliant!
- 21:59So what is CDD?
- 22:49Compliance Driven Development (CDD) Example
- 24:40CDD Example: PostgreSQL DISA STIG Automation
- 26:55Automated STIG Compliance Verification
- 31:25Questions?
related talks
24mSecurity Compliance as Code
38mPostgreSQL and DevSecOps: Ensuring database security
10mTest Driven Compliance
05mHow To Automate Compliance If You Aren't Chuck Norris
42mSolving for DevOps Auditors with Automated Compliance
36mBuilding Security Frameworks Into Your CI/CD Pipelines
52mContinuous Security
17mEnhancing cloud security with continuous compliance