November 9, 2022

Building a Secure CI/CD Pipeline with Google's Anjali Khatri and Nitin Vashishtha

How to Subscribe
Share In

DevOps is a concept that has exploded in the past few years, allowing software development teams to release software and automate the process. This decreases time to market and speeds up learning cycles. Continuous Integration and Continuous Delivery (CI/CD), automates the software delivery pipeline, continuously deploying new software releases in an automated fashion.

But when we deploy code quickly, it's imperative that we don't ignore the security aspect from the beginning. Ideally, we shift security left and incorporate it into the pipeline right from the start. This reduces software vulnerabilities and makes sure our cloud resources are configured following the best practices in terms of security.

Google Cloud Principle Architect Anjali Khatri and Google Cloud Solutions Engineer Nitin Vashishtha join the show to discuss DevOps, DevSecOps, the shift left movement, and how to use Google Cloud to create a secure CI/CD pipeline.

Topics:

  • How has the cloud changed the way people need to think about architecting secure systems?
  • How does the scale of cloud potentially impact the scale of a security or privacy issue?
  • What is DevOps?
  • Why is this area so hot right now?
  • What problems has the DevOps movement helped solve that were traditionally difficult or impossible to address?
  • How does the Shift Left movement for security relate to what’s happening in DevOps?
  • What is DevSecOps?
  • How does DevSecOps fit into a company’s overall security and privacy program and strategy?
  • When it comes to things like CI/CD, what are the common mistakes people can make when it comes to security, privacy, or compliance?
  • Cloud Build is a serverless CI/CD platform, why do I need something beyond this to automate my pipeline?
  • What other Cloud tools and components should I be using to make sure my CI/CD system is not only able to support my team’s day to day development but is actually secure?
  • Can you talk about Artifact Registry and what that product means in terms of security?
  • How does Cloud’s Binary Authorization system work? Why would I use it and how does that improve my security posture?
  • Does the addition of security as part of say my CI/CD pipeline impact performance in a meaningful way?
  • Can you walk me through what the CI/CD process looks like using the combination of Cloud tools and resources?
  • How much knowledge and experience do I need to set this up?
  • How does a combination of tools like this play with configuring Cloud resources directly within the Google Cloud Console?
  • Are there Cloud products that help me lock down my source code?
  • Are there Cloud products that automatically scan my code for security or privacy vulnerabilities?
  • What are your thoughts on the future of cloud security?
  • Are there technologies in this space that you are particularly excited about?
  • Where should someone looking to learn more DevSecOps and cloud security?

Resources:

Other Podcast

September 11, 2024

Pseudo-anonymization of Data with Jack Godau

In this episode, Sean sat down with Jack Godau to dive deep into the world of pseudoanonymization. Jack shared how pseudoanonymization differs from anonymization, explaining its value for maintaining data utility while complying with stringent regulations like GDPR.

August 28, 2024

The Evolution of Certificate Management with Anchor Security's Ben Burkert

In this episode we explore how certificates and TLS function, the inherent difficulties in managing internal TLS certificates, and why nearly every engineer has a horror story related to it.

August 14, 2024

What is a Data Lakehouse with Upsolver's Ori Rafael

In this episode, we sit down with Ori Rafael, CEO and Co-founder of Upsolver, to explore the rise of the lakehouse architecture and its significance in modern data management.