Archive
DevSecOps talks from DevOps Stage
18 talks on DevSecOps from the DevOps Stage conference archive, newest edition first. For upcoming events on the subject, see the DevSecOps topic page.
-
Unleash Keyless Cloud Deployments with Workload Identity Authentication using OIDC
Kosseila Haddalene · CloudThrill
Did you know that 10 millions secrets were public in GitHub in 2022 alone? This is additional evidence that leaked secrets rhyme with financial and reputation loss for users, organizations and even states. The worst thing to do is make it easy for hackers to…
-
Secure your software supply chain from dependencies to deployment
Abdel Sghiouar · Google
No matter where you are on your software supply chain security journey, one thing is clear. Security is everyone's responsibility, from the development environment to the runtime. This session will teach you how Google Cloud thinks about end-to-end secure…
-
End-to-end innersourcing and secure development with GitHub
Chris Reddington · GitHub
Many of you may be familiar with GitHub for your own Open Source (OSS) projects. But, did you know that you can run your end-to-end development within your organization using GitHub Enterprise? Join Chris for a whistle-stop tour into GitHub Codespaces…
-
What is "Supply Chain" attack? and How to Prevent it in DevOps Pipeline
Vitaly Davidoff · JFrog
We will provide an overview of "Supply Chain" attacks types (what is it and why it so important). The second part of this talk will be about "how to" protect your software against using malicious 3rd party packages
-
COVID-19 are a cloud security catalyst
Radu Vunvulea · Endava
The pandemic brought an increasing number of cyberattacks in the last 18 months (e.g. phishing attacks increased by 350%). The rush to become a cloud-first business combined with remote work and digitalization made companies vulnerable to cyber threats.…
-
Kubernetes and container security
Volodymyr Shynkar · Intellias
Everyone heard about Kubernetes. Everyone wants to use this tool. However, sometimes we forgot about security, which is important throughout the container lifecycle. Therefore, our journey with Kubernetes security should begin in the build stage when writing…
-
Open Source Components security scan as part of CI/CD process - examples and best practices
Vitaly Davidoff · JFrog
“We all love open source for all the obvious reasons. But it can also become a complicated beast when it comes to ownership, trust, and security. As you operate your mission critical systems with the help of open source libraries, it is critical to…
-
HashiCorp Vault configuration as code via HashiCorp Terraform: stories from trenches
Andrey Devyatkin · FivexL
In this talk, Andrey will share his experience of introducing HashiCorp Vault into AWS based infrastructure - what went well and what not so well, what you should consider before you start. On top of that, we will look into topics on how to incorporate…
-
Static Analysis of Infrastructure Code Talk
Matt Johnson · Bridgecrew
Planning, provisioning, and changing infrastructure are becoming vital to rapid cloud application development. Incorporating infrastructure-as-code into software development promotes transparency and immutability and helps prevent bad configurations…
-
Choosing the right security solution
Alexander Adamov · NioGuard Security Lab
We all use cybersecurity solutions to protect our personal and corporate information against potential cyber threats whether it is a home antivirus or Next-Generation Firewall in hardware for the enterprise. In this regard, the question arises on how to…
-
Designing secure architectures, the modern way
Eugene Pilyankevich · Cossack Labs
Most of the design thinking for preventing security incidents and performance bottlenecks focuses on avoiding known risks in a known way. However, most of the time this approach leads to cost-efficient systems that are prone to unexpected failures and attack…
-
From DevOps to DevSecOps
Vitaly Davidoff · JFrog
There is no «hands on» section in this course in meaning of how to install Jenkins, Vagrant e.c.t since there are many resources in internet that covers those topics… Instead, course will be focused on running simulation for appropriate vendor/solution…
-
Istio Security Overview
Michael Furman · Tufin
Have you heard of Isto and what it can do for your microservice development? This presentation will give an introduction to Isto followed by an overview of the Isto architecture. We will look at the main Isto components, and the benefits of Isto. The…
-
IT Compliance for our products inside AWS Cloud
Oleksandr Glushchenko · Provectus
In my speech, I want to share my experience of successfully passed compliance and audits(ISO27k, SOC2, PCI DSS). Also provide examples of how to prepare the infrastructure deployed in AWS for compliance auditing, what resources AWS provides us to facilitate…
-
Lost in (DevSecOps) Space – practical approach for “Lightway” Threat Modeling as a Code
Vitaly Davidoff · JFrog
“Agile and Microservices created a reality where Threat Modeling becomes a bottleneck - heavily resource intensive, requires a full team of expensive security professionals, takes up far too much time, and does not scalable…” In this session, we’ll review a…
-
Microservice Security: Open Policy Agent (OPA)
Stanislav Kolenkin · SoftServe/Critical Services
OPA is a general-purpose policy engine that makes policy a first-class citizen within the cloud-native ecosystem, putting it on par with servers, networks, and storage. Its uses range from authorization and admission control to data filtering. The community…
-
Top DevOps Security Failures
Pawel Krawczyk · eSynergy Solutions
Docker, Jenkins, network topology, system configuration and software delivery management - all of these are the bread and butter of each DevOps team, but can be also a recipe for a disaster. Walk through the most devastating security failures in DevOps…
-
End 2 End Containers Secure SDLC process
Vitaly Davidoff · JFrog
From the DevOps Stage conference archive. This site is not connected to that conference or its organizer — see our disclaimer.