Trust Teams but Verify: Compliance as Code Done Right
summary
Shows that converting policy to automated checks cuts delays and surfaces problems earlier: a policy "all data encrypted at rest" becomes an S3 buckets must use KMS control, implemented as an Inspec control that runs locally, in CI and against production. Running it found one of two buckets unencrypted, triggered alerts into chatops and shortened remediation cycles. Warns against brittle preventative rules, black‑box automation and dashboard‑only monitoring; recommends mixing detective and preventative checks and reuseable shared rule libraries.
AI-written summary · about
chapters (4)
related talks
39mTrust teams but verify: compliance as code done right
33mCompliance as Code - Lessons Learned From Regulated Organizations
17mEnhancing cloud security with continuous compliance
47mDetection as Code: The Engineering-Focused Future...
22mRethinking Risk, Governance, and Compliance Applying Automation
03mCompliance-As-Code For API Security - session preview
31mShifting Left Securely
54mCompliance-As-Code For API Security