Age of DevSecOps, How to Take It Into Use and What Does It Mean for QA Specialists
summary
Argues that QA must become QE and own security champions within teams, showing concrete steps across the CI/CD loop: threat-driven planning, secure design checks in VS Code with Dependabot and snook or sonar plugins, dependency risk reviews and staging in Artifactory, container and image scans, locked repo/workflow permissions, bots for environment changes, and traceable automation for production plus monitoring with Sentinel/Defender. Cites the Cloud Native catalog of 1,222 cards to show how many separate security choices and failure modes exist.
AI-written summary · about
chapters (10)
- 0:00Introduction
- 2:57Why I hated DevSecOps
- 6:53DevOps philosophy
- 10:02Why DevSecOps matters in modern software
- 13:33Cognitive load and teams
- 16:00Evolving QA to Quality Engineering
- 18:06Cybersecurity threats and motives
- 22:45Continuous security integration
- 24:08Security in CI/CD
- 35:05Key takeaways
related talks
32mHow to fit Sec into DevOps without Security team
31mWhy SecDevOps is the new way in Cybersecurity?
45mDevSecOps : add Security to your DevOps!
30mThe 3 Ways of DevSecOps – Making Shift Happen
31mDevSecOps, or How to Integrate Security into DevOps Practices
01h 02mDevSecOps for Developers: How To Start
36mUnderstanding the Sec in DevSecOps: Beyond Just Shifting Left
30mDevSecOps: More Than Just Pipelines