Building a Secure CI/CD Pipeline with Google's Anjali Khatri and Nitin Vashishtha

Share In
How to Subscribe

DevOps is a concept that has exploded in the past few years, allowing software development teams to release software and automate the process. This decreases time to market and speeds up learning cycles. Continuous Integration and Continuous Delivery (CI/CD), automates the software delivery pipeline, continuously deploying new software releases in an automated fashion.

But when we deploy code quickly, it's imperative that we don't ignore the security aspect from the beginning. Ideally, we shift security left and incorporate it into the pipeline right from the start. This reduces software vulnerabilities and makes sure our cloud resources are configured following the best practices in terms of security.

Google Cloud Principle Architect Anjali Khatri and Google Cloud Solutions Engineer Nitin Vashishtha join the show to discuss DevOps, DevSecOps, the shift left movement, and how to use Google Cloud to create a secure CI/CD pipeline.

Topics:

  • How has the cloud changed the way people need to think about architecting secure systems?
  • How does the scale of cloud potentially impact the scale of a security or privacy issue?
  • What is DevOps?
  • Why is this area so hot right now?
  • What problems has the DevOps movement helped solve that were traditionally difficult or impossible to address?
  • How does the Shift Left movement for security relate to what’s happening in DevOps?
  • What is DevSecOps?
  • How does DevSecOps fit into a company’s overall security and privacy program and strategy?
  • When it comes to things like CI/CD, what are the common mistakes people can make when it comes to security, privacy, or compliance?
  • Cloud Build is a serverless CI/CD platform, why do I need something beyond this to automate my pipeline?
  • What other Cloud tools and components should I be using to make sure my CI/CD system is not only able to support my team’s day to day development but is actually secure?
  • Can you talk about Artifact Registry and what that product means in terms of security?
  • How does Cloud’s Binary Authorization system work? Why would I use it and how does that improve my security posture?
  • Does the addition of security as part of say my CI/CD pipeline impact performance in a meaningful way?
  • Can you walk me through what the CI/CD process looks like using the combination of Cloud tools and resources?
  • How much knowledge and experience do I need to set this up?
  • How does a combination of tools like this play with configuring Cloud resources directly within the Google Cloud Console?
  • Are there Cloud products that help me lock down my source code?
  • Are there Cloud products that automatically scan my code for security or privacy vulnerabilities?
  • What are your thoughts on the future of cloud security?
  • Are there technologies in this space that you are particularly excited about?
  • Where should someone looking to learn more DevSecOps and cloud security?

Resources:

Other Podcast

Bug Bounties, Pentesting, and Automated Security Workflows with Trickest's Nenad Zaric

Former pentester and bug bounty hunter Nenan Zaric joins the show to talk about the types of vulnerabilities that companies should be looking for and about how to automate security workflows through the Trickest platform, a company he founded.

Machine Learning and Privacy at the Edge with Edge Impulse's Daniel Situnayake

Dan Situnayake, Head of Machine Learning at Edge Impulse, joins the show to share his knowledge about the practical privacy and security concerns when working with edge IoT devices and how to still leverage this incredible technology but do so in an ethical and privacy-preserving way.

November 16, 2022

Inside PCI DSS and Privacy for Payments with Skyflow's Bjorn Ovick

Bjorn Ovick joins the show to share his background, thoughts on the evolution of technology in this space, break down PCI DSS, payment processors, and how Skyflow helps not only offload PCI compliance but gives businesses flexibility to work with multiple payment processors.