How to Create a DevSecOps CI/CD Pipeline

Want to get into the world of DevSecOps? In this video we go over important DevSecOps Principles like SCA, SAST, SBOM, SecretScanners and removing vulnerabilities by reducing your security footprint with Distroless images.


---
Support the Channel:
---

📘 Chapters:
0:00 Intro
1:13 Shifting Security Left
3:25 DevSecOps Pipeline whiteboarding
16:45 Lab Intro
19:54 Finding Vulnerabilities using Docker Scout
27:10 Secure Distroless Images
32:25 Generating SBOM (Software Bill of Materials)

Sponsorships:

[DevOpsJourney]

What are your favorite DevSecOps tools? LMK!

[ranjansoumyab]

I completely agree on the statement made 16:40, I got more than a decade experience in securing DevOps but most organisation don't have this practice.

[samhaddison]

🎉 I loved every bit of the video. Clear and precise... watching all over again. Thanks a million... Waiting for part 2 😊

[yyev]

Thanks for the simple and clean explanation where to start with secops. Great tutorial!

[akshaygp]

Thank you for sharing your experience in detail and requesting you to make these kind of knowledgebase videos.

[realamrutpatil]

Great video and explanation at the beginning of the video!

[DK-vhkt]

Thank you for sharing an awesome video 🙂

[saivarun]

This is great loved it, How do we measure the authenticity of the sbom generated? And also can you show us how to integrate other security tools such as snyk, veracode into the pipeline. Thanks in advance.

[baivabmukhopadhyay]

Nice information sir. Would like to know how to implement it with pre commit and block the commit

[hookahel]

Great video.
I'm also interested which theme do you using for you terminal?

[DevOpsPi]

Thank you so much for your informative video. I think you need to change Dockerfile and remove line "CMD ["nginx", "-g", "daemon off;"]" from it. Otherwise you get an error "nginx: invalid option: "nginx" and your container will be exited.

[AnsonHopkins]

why does DevSecOps positions require so much experience when it seems this simple? and great video by the way helped me a lot

[stevejohnny]

Would love some coverage of how to go from having none of this to implementing some of it. It's not overnight. Takes a lot of time. My company wants to 'shift left' for the support function but struggles to understand the need in the dev team. I'm at the point where I've got azure devops doing some basic builds and deployments but nowhere near being able to use containers or anything. Most of our stuff is windows services or IIS :/

[HarshitaAggarwal]

My container is not running after adding cves and sbom commands. It's exiting instead of running when i execute the script. How to resolve this and get my container running?

[MikeZadik]

ZAP is not OWASP anymore.

From Wikipedia:
"As of August 1, 2023, the ZAP development team announced that ZAP was leaving the OWASP Foundation to join The Software Security Project, as a founding project [7][8] and henceforth will be simply called ZAP. "

[kuchambiatud]

Hello, I came across this amazing video on DevSecOps and can anyone help me on where to find the github repo He mention in the video?

[Games-zone]

could you please share the flowchart what you have created

[MadalinIgnisca]

Pushing security towards developers. First improvement, ban AI coding tools.