Putting the Sec in “DevSecOps”, automating cloud security as an enabler

The security function in most development environments is broken. With engineers focused on features and devops allowing them to move rapidly and self-provision around their own hurdles, it’s impossible for reactive, traditional security tools to keep up with an ever changing production environment. Even with a security engineer within the team, the chance of catching every bad-default in Terraform, or hidden * in a wide-open IAM policy is next to impossible with the ever growing suite of cloud services. In this talk, we’ll show how to, with very little effort, shift security left into code, enabling automated scanning and highlighting of security risks at build time, with helpful remediation advice for all. Knowing is the first step to improving, and automation makes knowing easy. You bring your DevOps pipeline, we’ll show you how.