November 9, 2022

Building a Secure CI/CD Pipeline with Google's Anjali Khatri and Nitin Vashishtha

How to Subscribe
Share In

DevOps is a concept that has exploded in the past few years, allowing software development teams to release software and automate the process. This decreases time to market and speeds up learning cycles. Continuous Integration and Continuous Delivery (CI/CD), automates the software delivery pipeline, continuously deploying new software releases in an automated fashion.

But when we deploy code quickly, it's imperative that we don't ignore the security aspect from the beginning. Ideally, we shift security left and incorporate it into the pipeline right from the start. This reduces software vulnerabilities and makes sure our cloud resources are configured following the best practices in terms of security.

Google Cloud Principle Architect Anjali Khatri and Google Cloud Solutions Engineer Nitin Vashishtha join the show to discuss DevOps, DevSecOps, the shift left movement, and how to use Google Cloud to create a secure CI/CD pipeline.

Topics:

  • How has the cloud changed the way people need to think about architecting secure systems?
  • How does the scale of cloud potentially impact the scale of a security or privacy issue?
  • What is DevOps?
  • Why is this area so hot right now?
  • What problems has the DevOps movement helped solve that were traditionally difficult or impossible to address?
  • How does the Shift Left movement for security relate to what’s happening in DevOps?
  • What is DevSecOps?
  • How does DevSecOps fit into a company’s overall security and privacy program and strategy?
  • When it comes to things like CI/CD, what are the common mistakes people can make when it comes to security, privacy, or compliance?
  • Cloud Build is a serverless CI/CD platform, why do I need something beyond this to automate my pipeline?
  • What other Cloud tools and components should I be using to make sure my CI/CD system is not only able to support my team’s day to day development but is actually secure?
  • Can you talk about Artifact Registry and what that product means in terms of security?
  • How does Cloud’s Binary Authorization system work? Why would I use it and how does that improve my security posture?
  • Does the addition of security as part of say my CI/CD pipeline impact performance in a meaningful way?
  • Can you walk me through what the CI/CD process looks like using the combination of Cloud tools and resources?
  • How much knowledge and experience do I need to set this up?
  • How does a combination of tools like this play with configuring Cloud resources directly within the Google Cloud Console?
  • Are there Cloud products that help me lock down my source code?
  • Are there Cloud products that automatically scan my code for security or privacy vulnerabilities?
  • What are your thoughts on the future of cloud security?
  • Are there technologies in this space that you are particularly excited about?
  • Where should someone looking to learn more DevSecOps and cloud security?

Resources:

Other Podcast

March 27, 2024

Prompt Injection Attacks with SVAM's Devansh

In this episode, we dive deep into the world of prompt injection attacks in Large Language Models (LLMs) with the Devansh, AI Solutions Lead at SVAM. We discuss the attacks, existing vulnerabilities, real-world examples, and the strategies attackers use.

March 20, 2024

The Hidden Hazards of Managing Unstructured Data with Skyflow's Joice John

In this episode, Joice John, Senior Product Manager at Skyflow, joins the show to discuss the complexities of managing privacy and security with unstructured data. Joice explains what unstructured data is and its distinction from structured data, and then dives into the technologies that tackle these challenges.

March 13, 2024

Building Enterprise-grade Security with Skyflow's Daniel Wong

Daniel Wong, Head of Security and Compliance at Skyflow, is back for his third appearance. Daniel discusses his extensive career at the forefront of security engineering, having worked with industry behemoths like Oracle, Salesforce, and CrowdStrike.