Co-Hosting with Tanya Janca, senior cloud advocate for Microsoft.
The OWASP DevSlop team is dedicated to learning and teaching DevSecOps via examples, and “Patty the Pipeline” is no exception: we ensure all the 3rd party components are known-secure, retrieve secrets from a secret store, and the code must pass negative unit tests, dynamic application security testing (DAST), static application security testing (SAST), and encryption and infrastructure VA verification. This entire system/project is open-sourced as part of the OWASP DevSlop project on GitHub and as live streaming and recorded videos, so that developers can watch each of the lessons, add it to their own pipelines, giving them a head start on DevSecOps. The talk will consist mostly of a start-to-finish demo of each part of the pipeline. Tools showcased include SSL Labs, Key Vault, SonarCloud, Cred Scan, White Source Bolt, Azure DevOps Security Toolkit and OWASP Zap. Supporting videos available here: https://aka.ms/DevSlopShow
Afterwards open discussion on: key goals and strategies behind security practices in our DevOps process.
If you prefer Tuesday or Thursday night week of September 2 please let me know as some maybe still on their labour long weekend!
2nd Floor, 1824 Store Street
Victoria, BC, CA, V8T 4R4