WEBVTT

1
00:00:17.625 --> 00:00:18.805
<00:00:17.625>Uh, <00:00:17.890>one <00:00:18.156>slide <00:00:18.421>about <00:00:18.687>myself.

2
00:00:18.865 --> 00:00:22.005
<00:00:18.865>My <00:00:19.040>name <00:00:19.215>is <00:00:19.389>Arno. <00:00:19.564>Um, <00:00:19.740>I'm <00:00:19.915>on <00:00:20.090>Twitter, <00:00:20.264>LinkedIn,

3
00:00:22.225 --> 00:00:25.085
<00:00:22.225>and <00:00:22.352>of <00:00:22.479>course, <00:00:22.606>if <00:00:22.734>you <00:00:22.861>have <00:00:22.988>questions <00:00:23.115>about <00:00:23.243>me, <00:00:23.370>uh, <00:00:23.497>feel <00:00:23.625>free

4
00:00:25.085 --> 00:00:26.405
<00:00:25.085>to <00:00:25.283>reach <00:00:25.481>out <00:00:25.679>via <00:00:25.877>email <00:00:26.075>as <00:00:26.273>well.

5
00:00:26.785 --> 00:00:28.205
<00:00:26.785>Um, <00:00:27.211>I'm <00:00:27.637>the <00:00:28.063>CTO

6
00:00:28.225 --> 00:00:30.445
<00:00:28.225>and <00:00:28.505>co-founder <00:00:28.785>of <00:00:29.065>Vision <00:00:29.345>Develops <00:00:29.625>Company

7
00:00:30.535 --> 00:00:31.765
<00:00:30.535>based <00:00:30.904>in <00:00:31.273>Zurich, <00:00:31.642>Switzerland.

8
00:00:32.105 --> 00:00:34.565
<00:00:32.104>Um, <00:00:32.305>we <00:00:32.504>are <00:00:32.705>an <00:00:32.904>operations <00:00:33.105>engineering <00:00:33.305>company, <00:00:33.504>uh,

9
00:00:34.565 --> 00:00:36.325
<00:00:34.565>helping <00:00:34.798>developers <00:00:35.031>to <00:00:35.265>run <00:00:35.498>their <00:00:35.731>own <00:00:35.964>business.

10
00:00:36.745 --> 00:00:40.165
<00:00:36.745>And, <00:00:36.885>um, <00:00:37.025>that <00:00:37.165>is <00:00:37.305>basically <00:00:37.445>why <00:00:37.584>I'm <00:00:37.724>speaking <00:00:37.864>to <00:00:38.004>you <00:00:38.144>today.

11
00:00:40.385 --> 00:00:42.725
<00:00:40.385>Of <00:00:40.525>course, <00:00:40.665>uh, <00:00:40.805>being <00:00:40.945>a <00:00:41.085>Swiss <00:00:41.224>company, <00:00:41.364>we <00:00:41.504>have <00:00:41.644>a <00:00:41.785>lot

12
00:00:42.725 --> 00:00:45.845
<00:00:42.725>of <00:00:42.925>companies <00:00:43.125>in <00:00:43.325>banking <00:00:43.525>and <00:00:43.725>insurance <00:00:43.925>worlds, <00:00:44.125>which

13
00:00:45.845 --> 00:00:50.045
<00:00:45.845>of <00:00:46.019>course, <00:00:46.195>um, <00:00:46.370>security <00:00:46.545>both <00:00:46.720>in <00:00:46.894>checkbox, <00:00:47.070>uh, <00:00:47.245>certification

14
00:00:50.045 --> 00:00:52.445
<00:00:50.045>and <00:00:50.220>stuff, <00:00:50.395>but <00:00:50.570>of <00:00:50.745>course <00:00:50.920>also <00:00:51.095>operation <00:00:51.270>security, <00:00:51.445>um,

15
00:00:52.585 --> 00:00:54.125
<00:00:52.585>is <00:00:52.816>a <00:00:53.047>big <00:00:53.278>topic <00:00:53.509>for, <00:00:53.740>for <00:00:53.971>me.

16
00:00:54.865 --> 00:00:57.405
<00:00:54.865>So <00:00:55.040>let's <00:00:55.215>kick <00:00:55.390>off <00:00:55.565>with <00:00:55.740>a <00:00:55.915>short, <00:00:56.090>you <00:00:56.265>know,

17
00:00:57.555 --> 00:00:58.725
<00:00:57.555>throwback <00:00:58.081>in <00:00:58.608>history.

18
00:00:59.105 --> 00:01:02.245
<00:00:59.105>Um, <00:00:59.305>how <00:00:59.504>do <00:00:59.705>we <00:00:59.904>do, <00:01:00.105>um, <00:01:00.305>like <00:01:00.504>waterfall,

19
00:01:02.425 --> 00:01:03.645
<00:01:02.425>uh, <00:01:02.791>software <00:01:03.157>project <00:01:03.523>management?

20
00:01:03.645 --> 00:01:06.165
<00:01:03.645>Before <00:01:03.878>we <00:01:04.111>had <00:01:04.345>first <00:01:04.578>all <00:01:04.811>the <00:01:05.045>requirements,

21
00:01:06.165 --> 00:01:08.085
<00:01:06.165>then <00:01:06.398>we <00:01:06.631>did <00:01:06.865>all <00:01:07.098>the <00:01:07.331>design <00:01:07.565>necessary.

22
00:01:08.385 --> 00:01:10.045
<00:01:08.385>Uh, <00:01:08.665>we <00:01:08.945>did <00:01:09.225>all <00:01:09.505>the <00:01:09.785>implementation

23
00:01:10.145 --> 00:01:13.005
<00:01:10.145>and <00:01:10.285>of <00:01:10.425>that <00:01:10.565>we <00:01:10.705>were, <00:01:10.845>um, <00:01:10.985>could <00:01:11.125>do <00:01:11.265>validation <00:01:11.405>or <00:01:11.545>testing.

24
00:01:13.545 --> 00:01:15.685
<00:01:13.545>Um, <00:01:13.745>and <00:01:13.945>of <00:01:14.145>that <00:01:14.345>the <00:01:14.545>project <00:01:14.745>was <00:01:14.945>done

25
00:01:15.905 --> 00:01:18.645
<00:01:15.905>and <00:01:16.080>we <00:01:16.255>only <00:01:16.430>did <00:01:16.605>some, <00:01:16.780>some <00:01:16.955>little <00:01:17.130>maintenance, <00:01:17.305>right?

26
00:01:19.145 --> 00:01:22.765
<00:01:19.145>And <00:01:19.272>in <00:01:19.399>ideal <00:01:19.526>world, <00:01:19.654>that <00:01:19.781>might <00:01:19.908>some <00:01:20.035>the, <00:01:20.163>be <00:01:20.290>the, <00:01:20.417>the <00:01:20.545>picture

27
00:01:22.795 --> 00:01:24.885
<00:01:22.795>that <00:01:23.028>some <00:01:23.261>managers <00:01:23.495>you <00:01:23.728>have <00:01:23.961>in <00:01:24.195>their,

28
00:01:25.145 --> 00:01:27.125
<00:01:25.145>in <00:01:25.300>their <00:01:25.456>head <00:01:25.611>when <00:01:25.767>they <00:01:25.922>think <00:01:26.078>about <00:01:26.233>a <00:01:26.389>software <00:01:26.545>product

29
00:01:27.945 --> 00:01:31.125
<00:01:27.945>or <00:01:28.178>software, <00:01:28.411>uh, <00:01:28.645>project, <00:01:28.878>um, <00:01:29.111>uh, <00:01:29.345>process.

30
00:01:31.705 --> 00:01:35.165
<00:01:31.705>Um, <00:01:31.845>but <00:01:31.985>if <00:01:32.125>you <00:01:32.265>have <00:01:32.405>worked <00:01:32.545>in <00:01:32.685>industry <00:01:32.825>for <00:01:32.965>some <00:01:33.105>years,

31
00:01:35.225 --> 00:01:36.565
<00:01:35.225>you <00:01:35.526>might <00:01:35.828>know <00:01:36.129>that <00:01:36.431>there,

32
00:01:36.975 --> 00:01:39.445
<00:01:36.975>there <00:01:37.208>might <00:01:37.441>be <00:01:37.675>some <00:01:37.908>maintenance <00:01:38.141>involved, <00:01:38.375>right?

33
00:01:39.555 --> 00:01:42.365
<00:01:39.555>Whether <00:01:39.788>it's, <00:01:40.021>you <00:01:40.255>know, <00:01:40.488>updating, <00:01:40.721>uh, <00:01:40.955>dependencies

34
00:01:42.365 --> 00:01:43.685
<00:01:42.365>or <00:01:42.662>whatever <00:01:42.959>the <00:01:43.256>maintenance <00:01:43.553>is.

35
00:01:43.985 --> 00:01:46.685
<00:01:43.985>Um, <00:01:44.140>there <00:01:44.296>is <00:01:44.451>maintenance, <00:01:44.607>uh, <00:01:44.762>there <00:01:44.918>might <00:01:45.073>be <00:01:45.229>new <00:01:45.385>features,

36
00:01:46.685 --> 00:01:49.485
<00:01:46.685>there <00:01:46.918>might <00:01:47.151>be <00:01:47.385>more <00:01:47.618>functionality, <00:01:47.851>um, <00:01:48.085>maintenance.

37
00:01:49.995 --> 00:01:52.045
<00:01:49.995>Well, <00:01:50.195>it <00:01:50.395>starts <00:01:50.595>to <00:01:50.795>be <00:01:50.995>pretty <00:01:51.195>big, <00:01:51.395>right?

38
00:01:52.585 --> 00:01:56.765
<00:01:52.585>And <00:01:52.701>so <00:01:52.818>that's <00:01:52.935>why, <00:01:53.051>um, <00:01:53.168>we, <00:01:53.285>we <00:01:53.401>as <00:01:53.518>an <00:01:53.635>industry, <00:01:53.751>um, <00:01:53.868>came <00:01:53.985>up

39
00:01:56.765 --> 00:01:59.725
<00:01:56.765>with <00:01:56.998>the <00:01:57.231>Agile, <00:01:57.465>um, <00:01:57.698>software <00:01:57.931>development <00:01:58.165>process.

40
00:02:00.375 --> 00:02:02.165
<00:02:00.375>Where, <00:02:00.725>where, <00:02:01.075>when <00:02:01.425>we <00:02:01.775>know

41
00:02:02.195 --> 00:02:05.685
<00:02:02.195>that <00:02:02.335>the <00:02:02.475>maintenance <00:02:02.615>will <00:02:02.755>be <00:02:02.895>like <00:02:03.035>a <00:02:03.175>key <00:02:03.315>part, <00:02:03.455>um, <00:02:03.595>hey,

42
00:02:05.735 --> 00:02:08.445
<00:02:05.735>let's <00:02:05.935>grab <00:02:06.135>the, <00:02:06.335>uh, <00:02:06.535>bull <00:02:06.735>by <00:02:06.935>its <00:02:07.135>horns.

43
00:02:08.615 --> 00:02:10.165
<00:02:08.615>Let's <00:02:08.963>do, <00:02:09.312>let's <00:02:09.661>be <00:02:10.009>proactive.

44
00:02:10.165 --> 00:02:11.565
<00:02:10.164>Let's <00:02:10.479>think <00:02:10.794>about <00:02:11.109>the <00:02:11.425>process

45
00:02:11.695 --> 00:02:14.005
<00:02:11.695>where <00:02:12.045>the <00:02:12.394>business <00:02:12.745>has <00:02:13.095>requirements.

46
00:02:14.345 --> 00:02:17.245
<00:02:14.345>We <00:02:14.520>then <00:02:14.695>do <00:02:14.870>one <00:02:15.045>iteration <00:02:15.220>of <00:02:15.395>these <00:02:15.570>requirements <00:02:15.745>up

47
00:02:17.245 --> 00:02:20.565
<00:02:17.245>until <00:02:17.372>the <00:02:17.499>release, <00:02:17.626>and <00:02:17.754>then <00:02:17.881>we <00:02:18.008>can <00:02:18.135>go <00:02:18.263>back <00:02:18.390>to <00:02:18.517>the <00:02:18.645>business

48
00:02:20.565 --> 00:02:23.245
<00:02:20.565>and <00:02:20.720>tell <00:02:20.876>and <00:02:21.031>ask <00:02:21.187>them, <00:02:21.342>okay, <00:02:21.498>what's <00:02:21.653>your <00:02:21.809>next <00:02:21.965>requirement?

49
00:02:23.245 --> 00:02:26.125
<00:02:23.245>What's <00:02:23.420>your <00:02:23.595>next <00:02:23.770>feature? <00:02:23.945>And <00:02:24.120>then <00:02:24.295>continue <00:02:24.470>doing <00:02:24.645>that.

50
00:02:26.705 --> 00:02:30.525
<00:02:26.704>And, <00:02:26.938>um, <00:02:27.171>at <00:02:27.404>each <00:02:27.638>release, <00:02:27.871>it <00:02:28.105>basically

51
00:02:31.455 --> 00:02:33.525
<00:02:31.454>falls <00:02:31.804>out <00:02:32.154>into <00:02:32.505>the <00:02:32.855>operation.

52
00:02:33.905 --> 00:02:37.885
<00:02:33.905>Um, <00:02:34.060>so, <00:02:34.216>um, <00:02:34.371>as <00:02:34.527>an <00:02:34.682>operations <00:02:34.838>engineer, <00:02:34.993>um, <00:02:35.149>we're <00:02:35.305>used

53
00:02:37.885 --> 00:02:40.525
<00:02:37.885>to <00:02:38.084>getting, <00:02:38.285>you <00:02:38.484>know, <00:02:38.685>firefighting <00:02:38.885>as <00:02:39.084>a <00:02:39.285>service.

54
00:02:40.945 --> 00:02:43.965
<00:02:40.945>Um, <00:02:41.120>that's <00:02:41.295>my, <00:02:41.470>that's <00:02:41.644>picture <00:02:41.820>of <00:02:41.995>me <00:02:42.170>In <00:02:42.345>2014,

55
00:02:44.065 --> 00:02:45.965
<00:02:44.065>and <00:02:44.298>I <00:02:44.531>founded <00:02:44.765>a <00:02:44.998>company, <00:02:45.231>or <00:02:45.465>shortly

56
00:02:45.965 --> 00:02:49.205
<00:02:45.965>before <00:02:46.120>I <00:02:46.276>founded <00:02:46.431>a <00:02:46.587>company, <00:02:46.742>I <00:02:46.898>felt <00:02:47.053>that, <00:02:47.209>um, <00:02:47.365>uh,

57
00:02:49.305 --> 00:02:51.965
<00:02:49.305>as <00:02:49.538>an <00:02:49.771>operations <00:02:50.005>engineer <00:02:50.238>doing <00:02:50.471>software <00:02:50.705>operations,

58
00:02:52.025 --> 00:02:53.205
<00:02:52.025>we <00:02:52.379>were <00:02:52.733>being <00:02:53.087>reactive.

59
00:02:53.625 --> 00:02:56.205
<00:02:53.625>And <00:02:53.905>that's <00:02:54.185>why <00:02:54.465>DevOps, <00:02:54.745>the <00:02:55.025>collaboration

60
00:02:56.205 --> 00:02:57.485
<00:02:56.204>between <00:02:56.781>software <00:02:57.357>developers

61
00:02:57.485 --> 00:03:00.485
<00:02:57.485>and <00:02:57.660>operations, <00:02:57.835>where, <00:02:58.010>um, <00:02:58.185>the <00:02:58.360>focus <00:02:58.535>is <00:02:58.710>on <00:02:58.885>teamwork.

62
00:03:00.485 --> 00:03:02.005
<00:03:00.485>The <00:03:00.758>focus <00:03:01.032>is <00:03:01.305>on <00:03:01.579>continuous <00:03:01.853>improvement.

63
00:03:02.265 --> 00:03:03.965
<00:03:02.265>The <00:03:02.545>focus <00:03:02.825>is <00:03:03.105>on <00:03:03.385>efficiency <00:03:03.665>and,

64
00:03:03.985 --> 00:03:07.805
<00:03:03.985>and <00:03:04.140>having <00:03:04.296>something <00:03:04.451>lean <00:03:04.607>to <00:03:04.762>try <00:03:04.918>out <00:03:05.073>and <00:03:05.229>gather <00:03:05.385>experience.

65
00:03:08.225 --> 00:03:11.405
<00:03:08.225>Um, <00:03:08.364>and <00:03:08.505>of <00:03:08.644>course, <00:03:08.785>being <00:03:08.924>able <00:03:09.065>to <00:03:09.204>react <00:03:09.345>to <00:03:09.484>new <00:03:09.625>requirements,

66
00:03:11.785 --> 00:03:14.445
<00:03:11.785>um, <00:03:11.924>in <00:03:12.065>a <00:03:12.204>way <00:03:12.345>that, <00:03:12.484>um, <00:03:12.625>the <00:03:12.765>business <00:03:12.905>can <00:03:13.045>change, <00:03:13.185>can

67
00:03:14.445 --> 00:03:16.965
<00:03:14.445>and <00:03:14.584>will, <00:03:14.725>we <00:03:14.864>know <00:03:15.005>they <00:03:15.144>can <00:03:15.285>and <00:03:15.424>will <00:03:15.565>change <00:03:15.704>their <00:03:15.845>minds.

68
00:03:17.425 --> 00:03:19.525
<00:03:17.425>Um, <00:03:17.600>is, <00:03:17.775>is, <00:03:17.950>uh, <00:03:18.125>we <00:03:18.300>take <00:03:18.475>the <00:03:18.650>best <00:03:18.825>effect

69
00:03:20.285 --> 00:03:22.545
<00:03:20.285>and <00:03:20.440>we <00:03:20.596>use <00:03:20.751>as <00:03:20.907>operation <00:03:21.062>engineers, <00:03:21.218>we <00:03:21.373>use <00:03:21.529>a <00:03:21.685>lot

70
00:03:22.545 --> 00:03:25.105
<00:03:22.545>of <00:03:22.778>tooling <00:03:23.011>from <00:03:23.245>software <00:03:23.478>developers <00:03:23.711>like <00:03:23.945>continuous

71
00:03:25.105 --> 00:03:27.545
<00:03:25.105>integration <00:03:25.385>like <00:03:25.665>infrastructure <00:03:25.945>as <00:03:26.225>code, <00:03:26.505>um,

72
00:03:27.545 --> 00:03:31.185
<00:03:27.545>which <00:03:27.700>enables <00:03:27.856>us <00:03:28.011>then <00:03:28.167>to, <00:03:28.322>to <00:03:28.478>automate <00:03:28.633>ourselves <00:03:28.789>away <00:03:28.945>so

73
00:03:31.185 --> 00:03:32.665
<00:03:31.185>that <00:03:31.451>we <00:03:31.717>can <00:03:31.984>get <00:03:32.250>more <00:03:32.517>efficient.

74
00:03:32.885 --> 00:03:36.905
<00:03:32.885>And <00:03:33.024>so <00:03:33.165>we <00:03:33.304>came <00:03:33.445>up <00:03:33.584>with <00:03:33.725>this <00:03:33.864>process <00:03:34.005>of <00:03:34.144>requirements, <00:03:34.285>design,

75
00:03:36.905 --> 00:03:38.065
<00:03:36.905>implementation, <00:03:37.949>testing,

76
00:03:38.445 --> 00:03:41.865
<00:03:38.445>and <00:03:38.620>then <00:03:38.795>from <00:03:38.970>release <00:03:39.144>deployment <00:03:39.320>operation <00:03:39.495>back <00:03:39.670>to <00:03:39.845>monitor,

77
00:03:42.035 --> 00:03:44.945
<00:03:42.035>which <00:03:42.210>of <00:03:42.385>course <00:03:42.560>then <00:03:42.734>feeds <00:03:42.910>back <00:03:43.085>into <00:03:43.260>the <00:03:43.435>requirements.

78
00:03:45.085 --> 00:03:47.265
<00:03:45.085>For <00:03:45.285>example, <00:03:45.485>if <00:03:45.685>we <00:03:45.885>have <00:03:46.085>a <00:03:46.285>stability <00:03:46.485>problem

79
00:03:47.605 --> 00:03:50.145
<00:03:47.605>or <00:03:47.780>something <00:03:47.954>like <00:03:48.130>that, <00:03:48.304>that <00:03:48.480>might <00:03:48.655>be <00:03:48.829>every, <00:03:49.005>uh,

80
00:03:50.265 --> 00:03:52.985
<00:03:50.265>a <00:03:50.498>non-functional <00:03:50.731>requirement <00:03:50.964>for <00:03:51.198>the <00:03:51.431>next <00:03:51.665>situation

81
00:03:53.085 --> 00:03:54.265
<00:03:53.085>to <00:03:53.616>fixed <00:03:54.147>box

82
00:03:54.405 --> 00:03:57.545
<00:03:54.405>or <00:03:54.638>improved <00:03:54.871>stability, <00:03:55.105>whatever <00:03:55.338>that's <00:03:55.571>needed, <00:03:55.805>right?

83
00:03:58.125 --> 00:04:01.465
<00:03:58.125>But <00:03:58.300>you <00:03:58.475>might <00:03:58.650>know <00:03:58.825>we <00:03:59.000>have <00:03:59.175>not <00:03:59.350>talked <00:03:59.525>about

84
00:04:01.465 --> 00:04:02.505
<00:04:01.465>two <00:04:01.933>security, <00:04:02.401>right?

85
00:04:02.605 --> 00:04:04.905
<00:04:02.605>Um, <00:04:02.838>we <00:04:03.071>have <00:04:03.304>been <00:04:03.538>doing <00:04:03.771>software <00:04:04.005>projects

86
00:04:04.905 --> 00:04:06.585
<00:04:04.905>and <00:04:05.105>now <00:04:05.305>we <00:04:05.505>have <00:04:05.705>the <00:04:05.905>minimal <00:04:06.105>viable <00:04:06.305>product,

87
00:04:06.685 --> 00:04:09.265
<00:04:06.685>and <00:04:06.860>now <00:04:07.035>we <00:04:07.210>want <00:04:07.385>to <00:04:07.560>deploy <00:04:07.735>that <00:04:07.910>publicly, <00:04:08.085>right?

88
00:04:09.485 --> 00:04:11.665
<00:04:09.485>And <00:04:09.660>we've <00:04:09.835>been <00:04:10.010>following <00:04:10.185>this <00:04:10.360>for <00:04:10.535>a <00:04:10.710>few <00:04:10.885>duration,

89
00:04:11.665 --> 00:04:13.345
<00:04:11.665>and <00:04:11.898>then <00:04:12.131>we <00:04:12.364>say, <00:04:12.598>come <00:04:12.831>to <00:04:13.065>security

90
00:04:13.365 --> 00:04:14.785
<00:04:13.365>and <00:04:13.684>say, <00:04:14.004>Hey, <00:04:14.323>we'd <00:04:14.643>like

91
00:04:14.785 --> 00:04:16.985
<00:04:14.785>to <00:04:15.065>now <00:04:15.345>make <00:04:15.625>this <00:04:15.905>possibility <00:04:16.185>accessible.

92
00:04:17.205 --> 00:04:20.535
<00:04:17.204>And <00:04:17.438>security <00:04:17.671>comes <00:04:17.904>and <00:04:18.138>says, <00:04:18.371>no. <00:04:18.604>Why?

93
00:04:21.565 --> 00:04:25.455
<00:04:21.565>Well, <00:04:21.720>just <00:04:21.876>as <00:04:22.031>with <00:04:22.187>operations <00:04:22.342>where, <00:04:22.498>with <00:04:22.653>G <00:04:22.809>11 <00:04:22.965>software

94
00:04:25.515 --> 00:04:28.095
<00:04:25.515>and <00:04:25.715>then <00:04:25.914>it's <00:04:26.115>operations <00:04:26.315>problem, <00:04:26.515>um, <00:04:26.715>we <00:04:26.914>kind

95
00:04:28.095 --> 00:04:30.575
<00:04:28.095>of <00:04:28.328>did <00:04:28.561>the <00:04:28.795>same <00:04:29.028>mistake <00:04:29.261>again, <00:04:29.495>right?

96
00:04:31.115 --> 00:04:33.055
<00:04:31.115>We <00:04:31.465>did <00:04:31.815>all <00:04:32.165>our <00:04:32.515>work

97
00:04:33.155 --> 00:04:36.375
<00:04:33.155>and <00:04:33.282>then <00:04:33.409>at <00:04:33.536>the <00:04:33.664>very <00:04:33.791>end, <00:04:33.918>we <00:04:34.045>went <00:04:34.173>and <00:04:34.300>talked <00:04:34.427>to <00:04:34.554>security.

98
00:04:36.835 --> 00:04:38.495
<00:04:36.835>And <00:04:37.010>that <00:04:37.185>is <00:04:37.359>a <00:04:37.534>problem. <00:04:37.710>That <00:04:37.885>is <00:04:38.060>a <00:04:38.234>problem

99
00:04:38.495 --> 00:04:41.175
<00:04:38.495>because <00:04:38.728>security <00:04:38.961>will <00:04:39.195>have <00:04:39.428>to <00:04:39.661>say <00:04:39.895>no,

100
00:04:41.445 --> 00:04:45.095
<00:04:41.445>because <00:04:41.795>basically <00:04:42.145>what <00:04:42.495>security <00:04:42.844>has

101
00:04:45.235 --> 00:04:49.695
<00:04:45.235>or <00:04:45.468>security <00:04:45.701>needs <00:04:45.935>is <00:04:46.168>non-functional <00:04:46.401>requirements, <00:04:46.635>right?

102
00:04:50.125 --> 00:04:51.925
<00:04:50.125>They <00:04:51.525>sh

103
00:04:52.105 --> 00:04:54.405
<00:04:52.105>and <00:04:52.305>that's <00:04:52.505>the <00:04:52.705>whole <00:04:52.905>point <00:04:53.105>of <00:04:53.305>DevSecOps <00:04:53.505>is

104
00:04:54.405 --> 00:04:58.165
<00:04:54.405>to <00:04:54.604>have <00:04:54.804>a <00:04:55.005>to-do <00:04:55.205>list <00:04:55.405>of <00:04:55.604>non-functional <00:04:55.804>requirements

105
00:04:58.505 --> 00:05:01.005
<00:04:58.505>and <00:04:58.680>whether <00:04:58.855>that <00:04:59.030>is <00:04:59.205>what <00:04:59.380>data <00:04:59.555>will <00:04:59.730>we <00:04:59.905>process

106
00:05:01.185 --> 00:05:02.885
<00:05:01.185>and <00:05:01.418>are <00:05:01.651>there <00:05:01.885>risks <00:05:02.118>involved <00:05:02.351>with <00:05:02.585>that?

107
00:05:03.225 --> 00:05:06.405
<00:05:03.225>Um, <00:05:03.380>how <00:05:03.536>do <00:05:03.691>we <00:05:03.847>ensure <00:05:04.002>secure <00:05:04.158>practices <00:05:04.313>in <00:05:04.469>the <00:05:04.625>implementation?

108
00:05:06.865 --> 00:05:10.645
<00:05:06.865>Um, <00:05:07.040>how <00:05:07.215>we <00:05:07.390>validate, <00:05:07.565>um, <00:05:07.740>security <00:05:07.915>in <00:05:08.090>during <00:05:08.265>testing.

109
00:05:11.105 --> 00:05:13.325
<00:05:11.105>How <00:05:11.338>do <00:05:11.571>we <00:05:11.805>have <00:05:12.038>like <00:05:12.271>traceability, <00:05:12.505>auditability,

110
00:05:13.675 --> 00:05:15.245
<00:05:13.675>both <00:05:14.025>in <00:05:14.375>release <00:05:14.725>and <00:05:15.075>deploy?

111
00:05:15.705 --> 00:05:19.285
<00:05:15.705>Um, <00:05:15.880>availability <00:05:16.055>might <00:05:16.229>also <00:05:16.405>be <00:05:16.580>something <00:05:16.755>that <00:05:16.930>the <00:05:17.104>security

112
00:05:20.245 --> 00:05:22.605
<00:05:20.245>engineer <00:05:20.445>and <00:05:20.645>security <00:05:20.845>specialist <00:05:21.045>is, <00:05:21.245>um, <00:05:21.445>in <00:05:21.645>the,

113
00:05:22.605 --> 00:05:23.765
<00:05:22.605>uh, <00:05:22.953>is <00:05:23.301>concerned <00:05:23.649>with.

114
00:05:23.785 --> 00:05:27.205
<00:05:23.785>And <00:05:23.985>of <00:05:24.185>course <00:05:24.385>then <00:05:24.585>detecting <00:05:24.785>anomalies, <00:05:24.985>security <00:05:25.185>anomalies,

115
00:05:27.265 --> 00:05:30.805
<00:05:27.265>um, <00:05:27.440>during, <00:05:27.615>during <00:05:27.789>operations, <00:05:27.965>during <00:05:28.140>monitoring <00:05:28.315>to <00:05:28.490>be <00:05:28.664>able

116
00:05:30.805 --> 00:05:33.525
<00:05:30.805>to <00:05:31.038>feedback, <00:05:31.271>um, <00:05:31.505>changes <00:05:31.738>for <00:05:31.971>fraud <00:05:32.205>detection

117
00:05:33.525 --> 00:05:35.085
<00:05:33.525>or <00:05:33.758>whatever <00:05:33.991>that <00:05:34.224>might <00:05:34.458>be <00:05:34.691>the <00:05:34.924>necessary.

118
00:05:35.465 --> 00:05:38.165
<00:05:35.465>Um, <00:05:35.640>that <00:05:35.815>is <00:05:35.990>something <00:05:36.165>that <00:05:36.340>is <00:05:36.515>actually, <00:05:36.690>it's <00:05:36.865>just,

119
00:05:38.275 --> 00:05:40.565
<00:05:38.275>it's <00:05:38.625>just <00:05:38.974>a <00:05:39.325>non-functional <00:05:39.674>requirement,

120
00:05:40.985 --> 00:05:42.885
<00:05:40.985>but <00:05:41.160>it <00:05:41.335>is <00:05:41.510>a <00:05:41.685>requirement <00:05:41.860>and <00:05:42.035>there <00:05:42.210>are <00:05:42.385>specialists

121
00:05:43.065 --> 00:05:45.445
<00:05:43.065>and <00:05:43.265>there <00:05:43.465>should <00:05:43.665>be <00:05:43.865>specialists <00:05:44.065>involved <00:05:44.265>in <00:05:44.465>this,

122
00:05:45.585 --> 00:05:47.965
<00:05:45.585>in <00:05:45.712>this <00:05:45.839>whole <00:05:45.966>process, <00:05:46.094>and <00:05:46.221>it <00:05:46.348>should <00:05:46.475>not <00:05:46.603>come <00:05:46.730>at <00:05:46.857>the <00:05:46.984>end.

123
00:05:48.705 --> 00:05:53.245
<00:05:48.705>And <00:05:48.844>that <00:05:48.984>is <00:05:49.125>basically <00:05:49.265>the <00:05:49.405>whole <00:05:49.544>point <00:05:49.685>of, <00:05:49.825>um, <00:05:49.965>of <00:05:50.104>DevSecOps,

124
00:05:53.245 --> 00:05:56.205
<00:05:53.245>of <00:05:53.525>bringing <00:05:53.805>and <00:05:54.085>including <00:05:54.365>security, <00:05:54.645>um,

125
00:05:56.265 --> 00:05:57.845
<00:05:56.265>in <00:05:56.544>the <00:05:56.825>whole <00:05:57.104>DevOps, <00:05:57.385>um, <00:05:57.664>process.

126
00:05:58.465 --> 00:06:01.165
<00:05:58.465>Um, <00:05:58.640>this <00:05:58.815>is <00:05:58.990>what <00:05:59.165>I <00:05:59.340>wanna <00:05:59.515>motivate <00:05:59.690>you <00:05:59.865>today,

127
00:06:01.165 --> 00:06:03.685
<00:06:01.165>or <00:06:01.340>this <00:06:01.515>was <00:06:01.690>the <00:06:01.865>whole <00:06:02.040>why <00:06:02.215>this <00:06:02.390>is <00:06:02.565>necessary.

128
00:06:04.105 --> 00:06:07.885
<00:06:04.105>Um, <00:06:04.260>and <00:06:04.416>now <00:06:04.571>I <00:06:04.727>will, <00:06:04.882>um, <00:06:05.038>go <00:06:05.193>deeper <00:06:05.349>into <00:06:05.505>what

129
00:06:07.905 --> 00:06:09.125
<00:06:07.905>and <00:06:08.124>how <00:06:08.344>you <00:06:08.563>can <00:06:08.783>do <00:06:09.003>that.

130
00:06:10.135 --> 00:06:13.595
<00:06:10.135>So, <00:06:10.310>um, <00:06:10.485>just <00:06:10.659>for <00:06:10.835>my <00:06:11.010>personal, <00:06:11.185>there's <00:06:11.360>like <00:06:11.534>different

131
00:06:14.345 --> 00:06:17.555
<00:06:14.345>subtopics <00:06:14.500>of, <00:06:14.656>uh, <00:06:14.811>of, <00:06:14.967>of <00:06:15.122>security <00:06:15.278>of <00:06:15.433>dev <00:06:15.589>DevOps, <00:06:15.745>right?

132
00:06:17.695 --> 00:06:19.915
<00:06:17.695>So <00:06:17.895>there's <00:06:18.094>the <00:06:18.295>whole, <00:06:18.495>I <00:06:18.695>call <00:06:18.895>it <00:06:19.094>AppSec.

133
00:06:19.935 --> 00:06:23.075
<00:06:19.935>So <00:06:20.168>the <00:06:20.401>helping <00:06:20.635>software <00:06:20.868>developers <00:06:21.101>with <00:06:21.335>education,

134
00:06:23.105 --> 00:06:25.955
<00:06:23.105>with <00:06:23.305>grants <00:06:23.505>engineering, <00:06:23.705>with <00:06:23.905>design <00:06:24.105>review, <00:06:24.305>code <00:06:24.505>review,

135
00:06:26.255 --> 00:06:28.155
<00:06:26.255>um, <00:06:26.455>that <00:06:26.655>kind <00:06:26.855>of, <00:06:27.055>I <00:06:27.255>call <00:06:27.455>that <00:06:27.655>AppSec.

136
00:06:28.615 --> 00:06:30.715
<00:06:28.615>Um, <00:06:28.895>there's <00:06:29.175>the <00:06:29.455>software <00:06:29.735>build <00:06:30.015>deployment

137
00:06:30.715 --> 00:06:33.155
<00:06:30.715>of <00:06:30.890>operations <00:06:31.065>part, <00:06:31.239>more <00:06:31.414>of <00:06:31.590>the <00:06:31.765>pipeline <00:06:31.940>stuff, <00:06:32.114>right?

138
00:06:33.225 --> 00:06:35.555
<00:06:33.225>That <00:06:33.505>one <00:06:33.785>I <00:06:34.065>traditionally <00:06:34.345>called <00:06:34.625>DevSecOps.

139
00:06:35.895 --> 00:06:37.915
<00:06:35.895>And <00:06:36.128>then <00:06:36.361>there's <00:06:36.594>the <00:06:36.828>whole <00:06:37.061>incident <00:06:37.294>detection,

140
00:06:38.315 --> 00:06:40.835
<00:06:38.315>incident <00:06:38.665>management, <00:06:39.015>um, <00:06:39.365>incident <00:06:39.715>handling,

141
00:06:41.275 --> 00:06:43.875
<00:06:41.275>incident <00:06:41.508>response, <00:06:41.741>um, <00:06:41.974>which <00:06:42.208>I <00:06:42.441>call <00:06:42.674>SecOps.

142
00:06:44.015 --> 00:06:46.515
<00:06:44.015>And <00:06:44.170>as <00:06:44.326>you <00:06:44.481>can <00:06:44.637>see, <00:06:44.792>basically <00:06:44.948>they're <00:06:45.103>just, <00:06:45.259>you <00:06:45.414>know,

143
00:06:46.625 --> 00:06:49.955
<00:06:46.625>rearranging <00:06:46.825>or, <00:06:47.025>um, <00:06:47.225>subgroups <00:06:47.425>of <00:06:47.625>the <00:06:47.825>def <00:06:48.025>sec

144
00:06:50.175 --> 00:06:53.715
<00:06:50.175>and <00:06:50.330>ops, <00:06:50.486>um, <00:06:50.641>parts <00:06:50.797>where <00:06:50.952>there's <00:06:51.108>like <00:06:51.263>a <00:06:51.419>different <00:06:51.575>focus,

145
00:06:53.815 --> 00:06:55.875
<00:06:53.815>of <00:06:53.970>course, <00:06:54.126>if <00:06:54.281>you <00:06:54.437>are <00:06:54.592>more <00:06:54.748>in <00:06:54.903>the <00:06:55.059>dev <00:06:55.215>ssec

146
00:06:55.875 --> 00:06:57.115
<00:06:55.875>or <00:06:56.098>more <00:06:56.321>in <00:06:56.544>the <00:06:56.767>SEC <00:06:56.991>ops

147
00:06:57.375 --> 00:06:59.355
<00:06:57.375>or <00:06:57.530>if <00:06:57.686>you <00:06:57.841>are <00:06:57.997>in <00:06:58.152>the <00:06:58.308>middle, <00:06:58.463>in <00:06:58.619>the <00:06:58.775>pipeline.

148
00:07:00.415 --> 00:07:02.995
<00:07:00.415>So <00:07:00.615>that <00:07:00.815>brings <00:07:01.015>me <00:07:01.215>to <00:07:01.415>the <00:07:01.615>DevSecOps <00:07:01.815>principles.

149
00:07:03.215 --> 00:07:05.635
<00:07:03.215>Um, <00:07:03.370>these <00:07:03.526>will <00:07:03.681>be <00:07:03.837>in <00:07:03.992>the <00:07:04.148>test <00:07:04.303>later, <00:07:04.459>I'm <00:07:04.614>kidding.

150
00:07:05.775 --> 00:07:09.595
<00:07:05.775>But <00:07:05.891>I <00:07:06.008>mean, <00:07:06.125>this <00:07:06.241>is <00:07:06.358>the <00:07:06.474>core, <00:07:06.591>um, <00:07:06.708>the <00:07:06.825>core <00:07:06.941>basically <00:07:07.058>of <00:07:07.174>the,

151
00:07:09.695 --> 00:07:13.905
<00:07:09.695>uh, <00:07:09.850>I <00:07:10.006>think <00:07:10.161>is <00:07:10.317>of <00:07:10.472>the <00:07:10.628>dev <00:07:10.783>DevSecOps, <00:07:10.939>um, <00:07:11.094>mentality

152
00:07:14.125 --> 00:07:17.425
<00:07:14.125>or, <00:07:14.280>uh, <00:07:14.436>approach <00:07:14.591>to, <00:07:14.747>to <00:07:14.902>including <00:07:15.058>security <00:07:15.213>from <00:07:15.369>the <00:07:15.525>start.

153
00:07:17.845 --> 00:07:19.025
<00:07:17.845>Um, <00:07:18.376>increasing <00:07:18.907>trust

154
00:07:19.025 --> 00:07:21.665
<00:07:19.025>and <00:07:19.258>transparency, <00:07:19.491>just <00:07:19.724>as <00:07:19.958>with, <00:07:20.191>uh, <00:07:20.424>DevOps

155
00:07:21.665 --> 00:07:22.665
<00:07:21.665>and <00:07:22.115>with <00:07:22.565>operations

156
00:07:22.665 --> 00:07:25.265
<00:07:22.665>and <00:07:22.898>developers, <00:07:23.131>um, <00:07:23.365>you <00:07:23.598>have <00:07:23.831>to <00:07:24.065>collaborate.

157
00:07:25.285 --> 00:07:27.265
<00:07:25.285>You <00:07:25.518>have <00:07:25.751>to, <00:07:25.985>um, <00:07:26.218>trust <00:07:26.451>each <00:07:26.685>other.

158
00:07:27.405 --> 00:07:28.505
<00:07:27.405>You <00:07:27.602>have <00:07:27.801>to <00:07:27.998>help <00:07:28.197>each <00:07:28.395>other.

159
00:07:28.525 --> 00:07:29.745
<00:07:28.525>You <00:07:28.707>have <00:07:28.890>to <00:07:29.074>be <00:07:29.257>proactive <00:07:29.440>about <00:07:29.623>it.

160
00:07:30.165 --> 00:07:32.865
<00:07:30.165>Um, <00:07:30.340>that <00:07:30.515>is <00:07:30.690>one <00:07:30.865>of <00:07:31.040>the <00:07:31.215>key, <00:07:31.390>uh, <00:07:31.565>elements.

161
00:07:32.865 --> 00:07:33.985
<00:07:32.865>That's <00:07:33.066>why <00:07:33.268>it's <00:07:33.469>a <00:07:33.671>number <00:07:33.873>one.

162
00:07:34.485 --> 00:07:37.465
<00:07:34.485>Um, <00:07:34.765>of <00:07:35.045>course <00:07:35.325>the, <00:07:35.605>the <00:07:35.885>risks

163
00:07:37.605 --> 00:07:40.545
<00:07:37.605>and <00:07:37.760>the <00:07:37.916>probabilities <00:07:38.071>of <00:07:38.227>risks, <00:07:38.382>that <00:07:38.538>is <00:07:38.693>something <00:07:38.849>that <00:07:39.005>you

164
00:07:40.545 --> 00:07:42.825
<00:07:40.545>as <00:07:40.720>a <00:07:40.895>security <00:07:41.070>professional <00:07:41.245>is, <00:07:41.420>is <00:07:41.595>your <00:07:41.770>daily <00:07:41.945>job.

165
00:07:43.205 --> 00:07:47.385
<00:07:43.205>Um, <00:07:43.332>and <00:07:43.459>so <00:07:43.586>helping <00:07:43.714>a <00:07:43.841>product <00:07:43.968>owner, <00:07:44.095>uh, <00:07:44.223>with <00:07:44.350>that, <00:07:44.477>with, <00:07:44.604>uh,

166
00:07:47.635 --> 00:07:50.225
<00:07:47.635>going <00:07:47.775>through <00:07:47.914>the, <00:07:48.055>okay, <00:07:48.195>what <00:07:48.335>kind <00:07:48.474>of <00:07:48.615>data <00:07:48.755>are <00:07:48.895>you <00:07:49.034>wanting

167
00:07:50.285 --> 00:07:52.865
<00:07:50.284>to <00:07:50.424>process <00:07:50.564>and <00:07:50.705>stuff <00:07:50.844>like <00:07:50.984>that, <00:07:51.124>um, <00:07:51.265>that <00:07:51.405>is <00:07:51.544>the <00:07:51.684>job

168
00:07:52.865 --> 00:07:55.505
<00:07:52.865>of <00:07:53.065>collaboration <00:07:53.265>and <00:07:53.465>bringing <00:07:53.665>that <00:07:53.865>into <00:07:54.065>the <00:07:54.265>product.

169
00:07:56.005 --> 00:07:58.145
<00:07:56.005>Um, <00:07:56.180>well, <00:07:56.355>bringing <00:07:56.530>it <00:07:56.705>to <00:07:56.880>the <00:07:57.055>product <00:07:57.230>owner's <00:07:57.405>attention,

170
00:07:58.145 --> 00:08:01.185
<00:07:58.145>basically <00:07:58.300>to <00:07:58.456>be <00:07:58.611>able <00:07:58.767>to, <00:07:58.922>uh, <00:07:59.078>give <00:07:59.233>it <00:07:59.389>the <00:07:59.544>right,

171
00:08:01.285 --> 00:08:02.665
<00:08:01.285>um, <00:08:01.595>uh, <00:08:01.906>priority <00:08:02.216>as <00:08:02.527>well.

172
00:08:03.245 --> 00:08:06.385
<00:08:03.245>Um, <00:08:03.478>not <00:08:03.711>trying <00:08:03.945>to <00:08:04.178>do <00:08:04.411>everything <00:08:04.645>upfront

173
00:08:06.685 --> 00:08:09.145
<00:08:06.685>or <00:08:06.840>even <00:08:06.996>worse <00:08:07.151>at <00:08:07.307>the <00:08:07.462>very <00:08:07.618>end <00:08:07.773>of <00:08:07.929>the <00:08:08.085>process,

174
00:08:09.245 --> 00:08:12.745
<00:08:09.245>but <00:08:09.445>instead <00:08:09.645>having <00:08:09.845>the <00:08:10.045>non-functional <00:08:10.245>requirements, <00:08:10.445>um, <00:08:10.645>uh,

175
00:08:12.805 --> 00:08:14.345
<00:08:12.805>all <00:08:13.003>in <00:08:13.201>the <00:08:13.399>backlog <00:08:13.597>and <00:08:13.795>then <00:08:13.993>making <00:08:14.191>sure

176
00:08:14.345 --> 00:08:18.305
<00:08:14.345>that <00:08:14.485>they <00:08:14.625>are <00:08:14.765>being <00:08:14.905>worked <00:08:15.045>on <00:08:15.185>during <00:08:15.325>the, <00:08:15.465>um, <00:08:15.605>building <00:08:15.745>up

177
00:08:18.305 --> 00:08:19.945
<00:08:18.305>of <00:08:18.655>the <00:08:19.005>project, <00:08:19.355>um, <00:08:19.705>helps

178
00:08:20.205 --> 00:08:23.745
<00:08:20.205>to <00:08:20.380>have <00:08:20.555>this <00:08:20.729>gating <00:08:20.905>into <00:08:21.080>this <00:08:21.255>incremental <00:08:21.430>improvement <00:08:21.604>mode

179
00:08:23.955 --> 00:08:27.745
<00:08:23.955>where <00:08:24.094>you <00:08:24.234>know <00:08:24.375>that <00:08:24.515>for <00:08:24.655>a, <00:08:24.794>I <00:08:24.935>dunno, <00:08:25.075>internal <00:08:25.215>test <00:08:25.354>rollout,

180
00:08:27.745 --> 00:08:29.945
<00:08:27.745>you <00:08:27.920>don't <00:08:28.095>need <00:08:28.270>to <00:08:28.445>have <00:08:28.620>all <00:08:28.795>the <00:08:28.970>security, <00:08:29.145>um,

181
00:08:29.945 --> 00:08:31.945
<00:08:29.945>that <00:08:30.145>will <00:08:30.344>be <00:08:30.545>required <00:08:30.745>for <00:08:30.945>the <00:08:31.145>public <00:08:31.344>rollout,

182
00:08:32.285 --> 00:08:34.905
<00:08:32.284>but <00:08:32.440>at <00:08:32.596>least <00:08:32.751>there's, <00:08:32.907>um, <00:08:33.062>stuff <00:08:33.218>is <00:08:33.373>being <00:08:33.529>worked <00:08:33.684>on,

183
00:08:34.995 --> 00:08:36.665
<00:08:34.995>stuff <00:08:35.345>is <00:08:35.695>being <00:08:36.044>continually <00:08:36.395>improved,

184
00:08:36.965 --> 00:08:38.905
<00:08:36.965>and <00:08:37.140>you <00:08:37.315>know <00:08:37.490>that <00:08:37.665>you <00:08:37.840>already <00:08:38.015>have <00:08:38.190>some <00:08:38.365>parts

185
00:08:38.925 --> 00:08:41.425
<00:08:38.924>of <00:08:39.204>the <00:08:39.484>requirements <00:08:39.765>covered <00:08:40.044>when, <00:08:40.324>um,

186
00:08:41.425 --> 00:08:43.025
<00:08:41.424>the <00:08:41.658>product <00:08:41.891>will <00:08:42.125>go <00:08:42.358>live, <00:08:42.591>for <00:08:42.824>example.

187
00:08:44.205 --> 00:08:47.425
<00:08:44.205>Um, <00:08:44.345>then <00:08:44.485>of <00:08:44.625>course <00:08:44.765>there <00:08:44.905>is <00:08:45.045>already <00:08:45.185>tooling <00:08:45.325>in <00:08:45.465>place <00:08:45.605>from

188
00:08:47.565 --> 00:08:49.785
<00:08:47.565>DevOps, <00:08:47.845>so <00:08:48.125>to <00:08:48.405>continuous <00:08:48.685>delivery <00:08:48.965>pipeline.

189
00:08:49.785 --> 00:08:51.065
<00:08:49.785>And <00:08:50.073>of <00:08:50.361>course, <00:08:50.649>plugging <00:08:50.937>in

190
00:08:51.625 --> 00:08:53.625
<00:08:51.625>security <00:08:51.905>into <00:08:52.185>the <00:08:52.465>continuous <00:08:52.745>pipeline, <00:08:53.025>uh,

191
00:08:53.665 --> 00:08:54.865
<00:08:53.665>I <00:08:53.819>think <00:08:53.973>is <00:08:54.127>one <00:08:54.282>of <00:08:54.436>the <00:08:54.590>key <00:08:54.745>elements.

192
00:08:54.980 --> 00:08:57.605
<00:08:54.980>Automating <00:08:55.180>yourself <00:08:55.380>away, <00:08:55.580>uh, <00:08:55.780>from, <00:08:55.980>I <00:08:56.180>don't <00:08:56.380>know,

193
00:08:57.605 --> 00:08:59.165
<00:08:57.605>manual, <00:08:58.305>periodic <00:08:59.005>reviews.

194
00:08:59.625 --> 00:09:02.205
<00:08:59.625>Um, <00:08:59.780>that <00:08:59.936>doesn't <00:09:00.091>mean <00:09:00.247>that <00:09:00.402>you <00:09:00.558>can <00:09:00.713>do <00:09:00.869>manually <00:09:01.025>periodic

195
00:09:02.205 --> 00:09:04.965
<00:09:02.205>checks, <00:09:02.380>for <00:09:02.555>example, <00:09:02.730>pen <00:09:02.905>tests <00:09:03.080>on <00:09:03.255>top <00:09:03.430>of <00:09:03.605>that.

196
00:09:05.305 --> 00:09:07.165
<00:09:05.305>But, <00:09:05.655>um, <00:09:06.005>to <00:09:06.354>leverage <00:09:06.704>the,

197
00:09:07.165 --> 00:09:10.365
<00:09:07.165>the <00:09:07.320>automation <00:09:07.476>in <00:09:07.631>the <00:09:07.787>security <00:09:07.942>favor, <00:09:08.098>um, <00:09:08.253>for <00:09:08.409>code <00:09:08.564>quality

198
00:09:10.585 --> 00:09:12.045
<00:09:10.585>for, <00:09:10.847>um, <00:09:11.110>that <00:09:11.373>kind <00:09:11.636>of <00:09:11.899>stuff.

199
00:09:12.265 --> 00:09:15.565
<00:09:12.265>Um, <00:09:12.392>that <00:09:12.519>is <00:09:12.646>I <00:09:12.774>think, <00:09:12.901>one <00:09:13.028>of <00:09:13.155>the <00:09:13.283>key <00:09:13.410>elements <00:09:13.537>of <00:09:13.665>integrating

200
00:09:15.565 --> 00:09:18.085
<00:09:15.565>and <00:09:15.845>collaborating <00:09:16.125>with <00:09:16.405>dev <00:09:16.685>and <00:09:16.965>ops.

201
00:09:18.985 --> 00:09:22.565
<00:09:18.985>Um, <00:09:19.335>having, <00:09:19.685>uh, <00:09:20.035>managing <00:09:20.385>dependencies,

202
00:09:22.965 --> 00:09:24.845
<00:09:22.965>standardized <00:09:23.245>third <00:09:23.525>party <00:09:23.805>software, <00:09:24.085>keeping <00:09:24.365>current,

203
00:09:24.945 --> 00:09:27.285
<00:09:24.945>making <00:09:25.120>sure <00:09:25.295>that <00:09:25.470>you <00:09:25.645>don't <00:09:25.820>miss <00:09:25.995>any, <00:09:26.170>any <00:09:26.345>updates

204
00:09:27.285 --> 00:09:30.085
<00:09:27.285>or <00:09:27.485>currently <00:09:27.685>relevant <00:09:27.885>updates <00:09:28.084>of, <00:09:28.285>of <00:09:28.485>dependencies, <00:09:28.685>um,

205
00:09:30.085 --> 00:09:31.845
<00:09:30.085>that <00:09:30.435>might <00:09:30.785>be, <00:09:31.135>uh, <00:09:31.485>based

206
00:09:31.965 --> 00:09:34.405
<00:09:31.965>or <00:09:32.120>images <00:09:32.276>that <00:09:32.431>might <00:09:32.587>be <00:09:32.742>software <00:09:32.898>that <00:09:33.053>might <00:09:33.209>be, <00:09:33.365>um,

207
00:09:34.475 --> 00:09:35.525
<00:09:34.475>like <00:09:34.947>code <00:09:35.420>modules

208
00:09:35.525 --> 00:09:36.965
<00:09:35.525>or <00:09:35.687>that <00:09:35.848>kind <00:09:36.011>of <00:09:36.173>plugins, <00:09:36.335>that <00:09:36.497>kind <00:09:36.659>of <00:09:36.821>stuff.

209
00:09:37.345 --> 00:09:39.845
<00:09:37.345>Um, <00:09:37.500>I <00:09:37.656>think <00:09:37.811>that's <00:09:37.967>the <00:09:38.122>job <00:09:38.278>of <00:09:38.433>a <00:09:38.589>security <00:09:38.745>professional.

210
00:09:39.855 --> 00:09:42.165
<00:09:39.855>Might <00:09:40.010>of <00:09:40.166>course <00:09:40.321>also <00:09:40.477>be <00:09:40.632>included <00:09:40.788>in <00:09:40.943>the <00:09:41.099>operations <00:09:41.255>shop,

211
00:09:42.185 --> 00:09:44.045
<00:09:42.185>but, <00:09:42.418>um, <00:09:42.651>at <00:09:42.885>least <00:09:43.118>making <00:09:43.351>sure <00:09:43.584>that,

212
00:09:44.045 --> 00:09:45.245
<00:09:44.045>that <00:09:44.261>it's <00:09:44.477>being <00:09:44.693>taken <00:09:44.909>care <00:09:45.125>of.

213
00:09:46.215 --> 00:09:48.595
<00:09:46.215>And <00:09:46.448>then <00:09:46.681>govern <00:09:46.915>with <00:09:47.148>automated <00:09:47.381>audit <00:09:47.615>trails.

214
00:09:48.755 --> 00:09:51.955
<00:09:48.755>I <00:09:48.871>mean, <00:09:48.988>that's <00:09:49.105>kind <00:09:49.221>of <00:09:49.338>a, <00:09:49.455>uh, <00:09:49.571>it's <00:09:49.688>a <00:09:49.805>very <00:09:49.921>high <00:09:50.038>level <00:09:50.155>thing,

215
00:09:51.975 --> 00:09:52.995
<00:09:51.975>but, <00:09:52.204>uh, <00:09:52.434>for <00:09:52.663>me <00:09:52.893>personally,

216
00:09:52.995 --> 00:09:54.755
<00:09:52.995>that <00:09:53.275>means <00:09:53.555>a <00:09:53.835>lot <00:09:54.115>of <00:09:54.395>self-service.

217
00:09:54.975 --> 00:09:58.515
<00:09:54.975>So <00:09:55.130>being <00:09:55.286>proactive <00:09:55.441>in <00:09:55.597>the <00:09:55.752>way <00:09:55.908>of <00:09:56.063>providing <00:09:56.219>security <00:09:56.375>services

218
00:09:58.815 --> 00:10:01.195
<00:09:58.815>to <00:09:59.048>developers, <00:09:59.281>to <00:09:59.515>the <00:09:59.748>internal <00:09:59.981>users, <00:10:00.215>um,

219
00:10:01.375 --> 00:10:04.595
<00:10:01.375>and <00:10:01.575>then <00:10:01.775>letting <00:10:01.975>them <00:10:02.175>do, <00:10:02.375>letting <00:10:02.575>them <00:10:02.775>deploy,

220
00:10:04.595 --> 00:10:07.475
<00:10:04.595>letting <00:10:04.750>them <00:10:04.906>code, <00:10:05.061>letting <00:10:05.217>them, <00:10:05.372>um, <00:10:05.528>do <00:10:05.683>all <00:10:05.839>that's <00:10:05.995>required.

221
00:10:07.855 --> 00:10:11.315
<00:10:07.855>And <00:10:07.995>then, <00:10:08.135>of <00:10:08.275>course, <00:10:08.415>have <00:10:08.555>the, <00:10:08.695>the, <00:10:08.835>the <00:10:08.975>logging, <00:10:09.115>the, <00:10:09.255>the

222
00:10:11.335 --> 00:10:14.635
<00:10:11.335>who <00:10:11.475>changed <00:10:11.615>what, <00:10:11.755>when, <00:10:11.895>why <00:10:12.035>part <00:10:12.175>of <00:10:12.315>a, <00:10:12.455>I <00:10:12.595>don't <00:10:12.735>know,

223
00:10:14.895 --> 00:10:16.755
<00:10:14.895>git <00:10:15.245>ops, <00:10:15.595>uh, <00:10:15.944>version <00:10:16.295>history

224
00:10:16.755 --> 00:10:19.195
<00:10:16.755>or <00:10:16.930>something <00:10:17.105>like <00:10:17.280>that, <00:10:17.455>where <00:10:17.630>you, <00:10:17.805>if <00:10:17.980>something <00:10:18.155>happens,

225
00:10:19.295 --> 00:10:22.275
<00:10:19.295>you <00:10:19.411>can <00:10:19.528>always <00:10:19.645>go <00:10:19.761>back <00:10:19.878>and <00:10:19.995>say, <00:10:20.111>Hey, <00:10:20.228>why <00:10:20.344>did <00:10:20.461>we <00:10:20.578>change <00:10:20.694>that?

226
00:10:22.295 --> 00:10:23.875
<00:10:22.295>Why, <00:10:22.574>who <00:10:22.854>opened <00:10:23.135>this <00:10:23.415>whatever <00:10:23.694>firewall

227
00:10:23.895 --> 00:10:25.155
<00:10:23.895>or <00:10:24.121>whatever <00:10:24.348>that, <00:10:24.575>that <00:10:24.802>it <00:10:25.029>was.

228
00:10:25.615 --> 00:10:28.275
<00:10:25.615>Um, <00:10:25.848>so <00:10:26.081>that <00:10:26.315>people <00:10:26.548>can <00:10:26.781>work <00:10:27.015>independently,

229
00:10:28.775 --> 00:10:32.195
<00:10:28.775>but <00:10:28.902>there <00:10:29.029>is <00:10:29.156>always <00:10:29.284>the, <00:10:29.411>the <00:10:29.538>way <00:10:29.665>of <00:10:29.793>checking <00:10:29.920>what <00:10:30.047>and <00:10:30.175>how

230
00:10:32.195 --> 00:10:33.395
<00:10:32.195>and <00:10:32.555>why, <00:10:32.915>what's <00:10:33.275>changed.

231
00:10:34.175 --> 00:10:35.795
<00:10:34.175>And <00:10:34.525>then <00:10:34.875>of <00:10:35.224>course, <00:10:35.574>education.

232
00:10:36.015 --> 00:10:38.355
<00:10:36.015>So <00:10:36.215>for <00:10:36.415>example, <00:10:36.615>testing <00:10:36.814>preparedness <00:10:37.015>with <00:10:37.215>security <00:10:37.415>games,

233
00:10:38.425 --> 00:10:42.395
<00:10:38.425>educating <00:10:38.580>people, <00:10:38.736>um, <00:10:38.891>making <00:10:39.047>sure <00:10:39.202>all <00:10:39.358>the, <00:10:39.513>um, <00:10:39.669>you <00:10:39.824>know,

234
00:10:42.395 --> 00:10:43.715
<00:10:42.395>you <00:10:42.593>have <00:10:42.790>a <00:10:42.989>security <00:10:43.187>net <00:10:43.385>around <00:10:43.583>it,

235
00:10:43.715 --> 00:10:46.555
<00:10:43.715>but <00:10:43.870>at <00:10:44.026>some, <00:10:44.181>sometimes <00:10:44.337>also <00:10:44.492>letting <00:10:44.648>people <00:10:44.803>fall <00:10:44.959>into <00:10:45.115>the

236
00:10:46.715 --> 00:10:49.115
<00:10:46.715>security <00:10:46.870>net <00:10:47.026>for <00:10:47.181>them <00:10:47.337>to <00:10:47.492>learn <00:10:47.648>how, <00:10:47.803>how <00:10:47.959>it <00:10:48.115>works,

237
00:10:49.175 --> 00:10:50.555
<00:10:49.175>how <00:10:49.423>it <00:10:49.671>work, <00:10:49.920>uh, <00:10:50.168>testing <00:10:50.416>that.

238
00:10:50.575 --> 00:10:52.235
<00:10:50.575>And <00:10:50.730>of <00:10:50.886>course, <00:10:51.041>if <00:10:51.197>you <00:10:51.352>can <00:10:51.508>do <00:10:51.663>that <00:10:51.819>in <00:10:51.975>an,

239
00:10:52.295 --> 00:10:55.955
<00:10:52.295>in <00:10:52.422>a <00:10:52.549>safe <00:10:52.676>environment, <00:10:52.804>um, <00:10:52.931>that <00:10:53.058>is <00:10:53.185>good <00:10:53.313>for, <00:10:53.440>for <00:10:53.567>both <00:10:53.694>you

240
00:10:56.335 --> 00:10:59.555
<00:10:56.335>and <00:10:56.490>the <00:10:56.646>person <00:10:56.801>learning <00:10:56.957>something, <00:10:57.112>um, <00:10:57.268>in, <00:10:57.423>in <00:10:57.579>the <00:10:57.735>process.

241
00:11:00.415 --> 00:11:03.515
<00:11:00.415>So, <00:11:00.589>um, <00:11:00.765>I'm <00:11:00.939>now <00:11:01.115>going <00:11:01.290>to, <00:11:01.464>uh, <00:11:01.640>zoom <00:11:01.814>in

242
00:11:03.775 --> 00:11:05.195
<00:11:03.775>or <00:11:04.201>to, <00:11:04.627>to, <00:11:05.053>uh,

243
00:11:05.625 --> 00:11:08.715
<00:11:05.625>talk <00:11:05.800>about <00:11:05.975>specific <00:11:06.150>measures <00:11:06.325>in <00:11:06.500>the <00:11:06.675>DevOps, <00:11:06.850>uh, <00:11:07.025>process.

244
00:11:09.015 --> 00:11:11.115
<00:11:09.015>Um, <00:11:09.189>that <00:11:09.365>is <00:11:09.540>our <00:11:09.715>more, <00:11:09.890>more <00:11:10.064>like <00:11:10.240>an <00:11:10.415>example.

245
00:11:12.175 --> 00:11:15.555
<00:11:12.175>Um, <00:11:12.314>so <00:11:12.454>for <00:11:12.594>example, <00:11:12.734>in <00:11:12.875>the, <00:11:13.015>in <00:11:13.155>the <00:11:13.295>build <00:11:13.435>process, <00:11:13.574>um,

246
00:11:15.555 --> 00:11:17.835
<00:11:15.555>static, <00:11:15.905>uh, <00:11:16.255>code <00:11:16.604>analysis, <00:11:16.954>um,

247
00:11:18.055 --> 00:11:20.995
<00:11:18.055>or <00:11:18.229>integrating <00:11:18.405>static <00:11:18.579>code <00:11:18.755>analysis <00:11:18.930>for <00:11:19.104>each <00:11:19.280>commit, <00:11:19.454>um,

248
00:11:21.015 --> 00:11:23.195
<00:11:21.015>as <00:11:21.215>a <00:11:21.415>security <00:11:21.615>professionals <00:11:21.814>of <00:11:22.015>course, <00:11:22.215>helps <00:11:22.415>you

249
00:11:23.455 --> 00:11:26.875
<00:11:23.455>to <00:11:23.630>keep <00:11:23.805>track <00:11:23.980>code, <00:11:24.155>quality <00:11:24.330>test <00:11:24.505>coverage, <00:11:24.680>that <00:11:24.855>kind

250
00:11:26.875 --> 00:11:29.475
<00:11:26.875>of <00:11:27.030>stuff <00:11:27.186>can <00:11:27.341>even <00:11:27.497>check <00:11:27.652>for, <00:11:27.808>you <00:11:27.963>know, <00:11:28.119>known, <00:11:28.275>uh,

251
00:11:29.475 --> 00:11:31.115
<00:11:29.475>vulnerabilities, <00:11:29.825>that <00:11:30.175>kind <00:11:30.525>of <00:11:30.875>stuff.

252
00:11:31.455 --> 00:11:34.635
<00:11:31.455>Um, <00:11:31.610>and <00:11:31.766>of <00:11:31.921>course, <00:11:32.077>aids <00:11:32.232>the <00:11:32.388>DevSecOps <00:11:32.543>principle <00:11:32.699>number <00:11:32.855>four.

253
00:11:34.855 --> 00:11:38.115
<00:11:34.855>So <00:11:35.030>to <00:11:35.205>plug <00:11:35.380>in <00:11:35.555>security <00:11:35.730>into <00:11:35.905>the, <00:11:36.080>um, <00:11:36.255>the,

254
00:11:38.115 --> 00:11:41.955
<00:11:38.115>the <00:11:38.290>DevOps <00:11:38.465>pipeline, <00:11:38.640>um, <00:11:38.815>that <00:11:38.990>this <00:11:39.165>is, <00:11:39.340>for <00:11:39.515>example,

255
00:11:42.195 --> 00:11:45.115
<00:11:42.195>something <00:11:42.395>you <00:11:42.595>can <00:11:42.795>do <00:11:42.995>dependency <00:11:43.195>management, <00:11:43.395>um, <00:11:43.595>I,

256
00:11:45.175 --> 00:11:46.635
<00:11:45.175>I'm <00:11:45.339>gonna <00:11:45.503>have <00:11:45.667>an <00:11:45.832>example <00:11:45.996>for <00:11:46.160>that <00:11:46.324>as <00:11:46.489>well.

257
00:11:47.055 --> 00:11:49.315
<00:11:47.055>And <00:11:47.255>then <00:11:47.454>of <00:11:47.655>course, <00:11:47.854>um, <00:11:48.055>container <00:11:48.255>image <00:11:48.454>scanning

258
00:11:49.375 --> 00:11:51.275
<00:11:49.375>and <00:11:49.655>also <00:11:49.935>scanning <00:11:50.215>your <00:11:50.495>base <00:11:50.775>images,

259
00:11:51.325 --> 00:11:53.485
<00:11:51.325>where <00:11:51.525>you <00:11:51.725>inherit <00:11:51.925>from <00:11:52.125>or <00:11:52.325>something <00:11:52.525>like <00:11:52.725>that.

260
00:11:53.745 --> 00:11:56.805
<00:11:53.745>That's <00:11:53.885>all <00:11:54.025>ties <00:11:54.165>into, <00:11:54.305>um, <00:11:54.445>this <00:11:54.585>example <00:11:54.725>to <00:11:54.865>the, <00:11:55.005>you <00:11:55.145>know,

261
00:11:57.005 --> 00:11:58.725
<00:11:57.005>standardized <00:11:57.205>third <00:11:57.405>party <00:11:57.605>software <00:11:57.805>and <00:11:58.005>keep <00:11:58.205>them <00:11:58.405>current.

262
00:11:59.065 --> 00:12:01.325
<00:11:59.065>Um, <00:11:59.265>so <00:11:59.465>to, <00:11:59.665>to <00:11:59.865>enable <00:12:00.065>the <00:12:00.265>solve <00:12:00.465>self-service,

263
00:12:01.465 --> 00:12:04.125
<00:12:01.465>but <00:12:01.605>then <00:12:01.745>have <00:12:01.885>the <00:12:02.025>security <00:12:02.165>net <00:12:02.305>of <00:12:02.445>checking <00:12:02.585>and <00:12:02.725>of <00:12:02.865>scanning.

264
00:12:04.465 --> 00:12:07.405
<00:12:04.465>So <00:12:04.592>for <00:12:04.719>example, <00:12:04.846>um, <00:12:04.974>sonar <00:12:05.101>Cube <00:12:05.228>is <00:12:05.355>a <00:12:05.483>very <00:12:05.610>popular <00:12:05.737>tool <00:12:05.865>to,

265
00:12:07.405 --> 00:12:08.925
<00:12:07.405>um, <00:12:07.747>to <00:12:08.089>scan <00:12:08.430>source <00:12:08.772>code.

266
00:12:09.265 --> 00:12:13.005
<00:12:09.265>Um, <00:12:09.392>of <00:12:09.519>course <00:12:09.646>there's <00:12:09.774>might <00:12:09.901>be <00:12:10.028>a <00:12:10.155>lot <00:12:10.283>of, <00:12:10.410>um, <00:12:10.537>false <00:12:10.665>positives

267
00:12:13.005 --> 00:12:14.045
<00:12:13.005>and <00:12:13.192>stuff <00:12:13.379>like <00:12:13.566>that, <00:12:13.753>which <00:12:13.940>you

268
00:12:14.045 --> 00:12:16.805
<00:12:14.045>as <00:12:14.200>a <00:12:14.356>security <00:12:14.511>professional <00:12:14.667>can <00:12:14.822>help <00:12:14.978>to, <00:12:15.133>to <00:12:15.289>sort <00:12:15.444>out.

269
00:12:17.065 --> 00:12:21.845
<00:12:17.065>But <00:12:17.265>at <00:12:17.465>least, <00:12:17.665>um, <00:12:17.865>um, <00:12:18.065>the <00:12:18.265>making <00:12:18.465>errors

270
00:12:21.845 --> 00:12:25.005
<00:12:21.845>and <00:12:22.045>having <00:12:22.245>them, <00:12:22.445>um, <00:12:22.645>go <00:12:22.845>through <00:12:23.045>like <00:12:23.245>undetected,

271
00:12:25.145 --> 00:12:26.405
<00:12:25.145>that's <00:12:25.371>something <00:12:25.598>that <00:12:25.825>you <00:12:26.052>can <00:12:26.279>help,

272
00:12:26.665 --> 00:12:28.045
<00:12:26.665>for <00:12:26.872>example, <00:12:27.079>with <00:12:27.286>that <00:12:27.492>kind <00:12:27.699>of <00:12:27.906>tool.

273
00:12:28.625 --> 00:12:31.645
<00:12:28.625>Um, <00:12:28.800>me <00:12:28.975>personally, <00:12:29.150>I, <00:12:29.325>for <00:12:29.500>example, <00:12:29.675>use <00:12:29.850>Depender <00:12:30.025>Box

274
00:12:31.665 --> 00:12:33.245
<00:12:31.665>for <00:12:31.944>my <00:12:32.224>personal <00:12:32.505>projects <00:12:32.785>on <00:12:33.064>GitHub.

275
00:12:33.245 --> 00:12:34.605
<00:12:33.245>It's <00:12:33.551>free <00:12:33.857>to <00:12:34.163>use. <00:12:34.469>Um,

276
00:12:34.865 --> 00:12:37.085
<00:12:34.865>and <00:12:35.020>I <00:12:35.176>think <00:12:35.331>they <00:12:35.487>now <00:12:35.642>have <00:12:35.798>been <00:12:35.953>acquired <00:12:36.109>by <00:12:36.265>GitHub.

277
00:12:37.305 --> 00:12:39.565
<00:12:37.305>Um, <00:12:37.479>so <00:12:37.655>anyway, <00:12:37.829>um, <00:12:38.005>it's <00:12:38.180>basically <00:12:38.354>just <00:12:38.530>a <00:12:38.704>tool

278
00:12:39.565 --> 00:12:42.845
<00:12:39.565>that <00:12:39.740>opens <00:12:39.915>pool <00:12:40.090>requests <00:12:40.265>if <00:12:40.440>your <00:12:40.615>dependencies <00:12:40.790>are <00:12:40.965>outdated.

279
00:12:43.545 --> 00:12:44.965
<00:12:43.545>So <00:12:43.864>here, <00:12:44.184>for <00:12:44.503>example, <00:12:44.823>um,

280
00:12:45.045 --> 00:12:46.605
<00:12:45.045>I <00:12:45.278>have <00:12:45.511>a <00:12:45.745>Python <00:12:45.978>Hill <00:12:46.211>World <00:12:46.444>application

281
00:12:46.605 --> 00:12:49.925
<00:12:46.605>that <00:12:46.805>Python <00:12:47.005>dependencies, <00:12:47.205>it <00:12:47.405>checks <00:12:47.605>the <00:12:47.805>Python <00:12:48.005>dependencies,

282
00:12:49.925 --> 00:12:50.965
<00:12:49.925>and <00:12:50.112>it <00:12:50.299>makes <00:12:50.486>a <00:12:50.673>pull <00:12:50.861>request

283
00:12:51.405 --> 00:12:53.885
<00:12:51.405>whenever <00:12:51.605>there's <00:12:51.805>an <00:12:52.005>update <00:12:52.204>available, <00:12:52.405>and <00:12:52.605>even <00:12:52.805>some

284
00:12:53.885 --> 00:12:55.325
<00:12:53.885>of <00:12:54.070>them, <00:12:54.255>so <00:12:54.440>there <00:12:54.625>are <00:12:54.810>no <00:12:54.995>example <00:12:55.181>here.

285
00:12:55.325 --> 00:12:57.045
<00:12:55.325>If <00:12:55.500>there's, <00:12:55.675>if <00:12:55.850>they <00:12:56.025>can <00:12:56.200>label <00:12:56.375>it <00:12:56.550>like, <00:12:56.725>Hey,

286
00:12:57.115 --> 00:12:59.325
<00:12:57.115>this <00:12:57.270>is <00:12:57.426>a <00:12:57.581>security <00:12:57.737>update, <00:12:57.892>so <00:12:58.048>this <00:12:58.203>is, <00:12:58.359>for <00:12:58.515>example,

287
00:12:59.325 --> 00:13:00.765
<00:12:59.325>something <00:12:59.584>you <00:12:59.843>should <00:13:00.102>do <00:13:00.361>prior, <00:13:00.621>uh,

288
00:13:00.935 --> 00:13:02.485
<00:13:00.935>check <00:13:01.214>prioritize, <00:13:01.492>or <00:13:01.771>something <00:13:02.051>like <00:13:02.330>that.

289
00:13:03.195 --> 00:13:05.045
<00:13:03.195>Another <00:13:03.475>thing <00:13:03.755>is <00:13:04.035>like <00:13:04.315>container <00:13:04.595>scanning.

290
00:13:05.265 --> 00:13:08.925
<00:13:05.265>So, <00:13:05.420>um, <00:13:05.576>as <00:13:05.731>a, <00:13:05.887>um, <00:13:06.042>as <00:13:06.198>a <00:13:06.353>security <00:13:06.509>professional <00:13:06.665>working

291
00:13:08.945 --> 00:13:10.645
<00:13:08.945>for <00:13:09.225>multiple <00:13:09.505>projects <00:13:09.785>or <00:13:10.065>multiple <00:13:10.345>tools

292
00:13:10.645 --> 00:13:13.165
<00:13:10.645>or <00:13:10.845>multiple, <00:13:11.045>uh, <00:13:11.245>business <00:13:11.444>units, <00:13:11.645>of <00:13:11.845>course, <00:13:12.045>um,

293
00:13:13.345 --> 00:13:16.005
<00:13:13.345>you <00:13:13.500>can <00:13:13.656>integrate <00:13:13.811>this <00:13:13.967>kind <00:13:14.122>of, <00:13:14.278>uh, <00:13:14.433>container <00:13:14.589>scanning <00:13:14.745>once

294
00:13:16.065 --> 00:13:17.765
<00:13:16.065>and <00:13:16.240>then <00:13:16.415>have <00:13:16.590>it <00:13:16.765>run <00:13:16.940>over <00:13:17.115>the <00:13:17.290>whole <00:13:17.465>fleet

295
00:13:17.765 --> 00:13:19.005
<00:13:17.765>of <00:13:18.137>applications <00:13:18.509>and <00:13:18.881>services.

296
00:13:19.475 --> 00:13:21.845
<00:13:19.475>That, <00:13:19.615>of <00:13:19.755>course, <00:13:19.895>helps <00:13:20.035>you, <00:13:20.175>um, <00:13:20.315>to <00:13:20.455>have <00:13:20.595>like <00:13:20.735>some <00:13:20.875>sort

297
00:13:21.845 --> 00:13:23.565
<00:13:21.845>of <00:13:22.195>baseline, <00:13:22.545>uh, <00:13:22.895>where <00:13:23.245>you,

298
00:13:23.745 --> 00:13:26.325
<00:13:23.745>you <00:13:23.920>detect <00:13:24.095>if <00:13:24.270>there's <00:13:24.445>out <00:13:24.620>added <00:13:24.795>images <00:13:24.970>being <00:13:25.145>used,

299
00:13:26.345 --> 00:13:28.805
<00:13:26.345>if <00:13:26.545>there's <00:13:26.745>a <00:13:26.945>vulner, <00:13:27.145>new <00:13:27.345>vulnerabilities <00:13:27.545>popping <00:13:27.745>up

300
00:13:28.805 --> 00:13:31.245
<00:13:28.805>for <00:13:28.979>existing <00:13:29.155>images, <00:13:29.329>that <00:13:29.505>kind <00:13:29.680>of <00:13:29.854>stuff, <00:13:30.030>for <00:13:30.204>example,

301
00:13:31.245 --> 00:13:32.805
<00:13:31.245>with <00:13:31.711>AquaSec <00:13:32.178>or <00:13:32.645>Twistlock,

302
00:13:32.805 --> 00:13:35.005
<00:13:32.805>or, <00:13:33.005>there's <00:13:33.204>different, <00:13:33.405>like <00:13:33.604>commercial <00:13:33.805>tools <00:13:34.005>of <00:13:34.204>course,

303
00:13:35.225 --> 00:13:36.965
<00:13:35.225>and <00:13:35.425>even <00:13:35.625>some <00:13:35.825>for <00:13:36.025>open <00:13:36.225>source <00:13:36.425>of <00:13:36.625>course,

304
00:13:36.985 --> 00:13:38.245
<00:13:36.985>but <00:13:37.211>I <00:13:37.438>mean, <00:13:37.665>there's, <00:13:37.892>this <00:13:38.119>is

305
00:13:38.245 --> 00:13:39.365
<00:13:38.245>tooling <00:13:38.581>that's <00:13:38.917>already <00:13:39.253>existing.

306
00:13:39.365 --> 00:13:40.485
<00:13:39.365>You <00:13:39.509>do <00:13:39.653>not <00:13:39.797>have <00:13:39.941>to <00:13:40.085>reinvent <00:13:40.229>the <00:13:40.373>bill.

307
00:13:40.485 --> 00:13:42.325
<00:13:40.485>You <00:13:40.660>can <00:13:40.835>buy <00:13:41.010>it <00:13:41.185>or <00:13:41.360>make <00:13:41.535>it <00:13:41.710>yourself, <00:13:41.885>uh,

308
00:13:42.325 --> 00:13:44.645
<00:13:42.325>or <00:13:42.480>integrate <00:13:42.636>it <00:13:42.791>yourself, <00:13:42.947>but <00:13:43.102>the <00:13:43.258>point <00:13:43.413>is <00:13:43.569>you <00:13:43.725>have

309
00:13:44.645 --> 00:13:47.405
<00:13:44.645>to <00:13:44.785>integrate <00:13:44.925>it <00:13:45.064>once, <00:13:45.204>and <00:13:45.345>then <00:13:45.485>you <00:13:45.625>can <00:13:45.765>use <00:13:45.905>it <00:13:46.045>basically

310
00:13:47.465 --> 00:13:49.485
<00:13:47.465>for <00:13:47.698>the <00:13:47.931>whole <00:13:48.165>fleet <00:13:48.398>of <00:13:48.631>your <00:13:48.865>containerized

311
00:13:49.585 --> 00:13:50.685
<00:13:49.585>to <00:13:50.080>of <00:13:50.574>applications.

312
00:13:51.705 --> 00:13:53.525
<00:13:51.705>Um, <00:13:52.055>for <00:13:52.405>test <00:13:52.755>and <00:13:53.105>development.

313
00:13:53.685 --> 00:13:56.765
<00:13:53.685>I <00:13:53.824>mean, <00:13:53.964>having <00:13:54.104>sm <00:13:54.244>basic <00:13:54.385>smoke <00:13:54.525>tests, <00:13:54.665>like <00:13:54.805>is <00:13:54.944>the <00:13:55.084>container,

314
00:13:57.275 --> 00:14:01.205
<00:13:57.275>will <00:13:57.430>the <00:13:57.586>container <00:13:57.741>run <00:13:57.897>when <00:13:58.052>started, <00:13:58.208>um, <00:13:58.363>having, <00:13:58.519>being <00:13:58.675>able

315
00:14:01.225 --> 00:14:05.005
<00:14:01.225>to, <00:14:01.365>uh, <00:14:01.505>have <00:14:01.645>as <00:14:01.785>many <00:14:01.925>test <00:14:02.065>environ <00:14:02.205>as <00:14:02.345>necessary, <00:14:02.485>um, <00:14:02.625>having,

316
00:14:05.065 --> 00:14:06.885
<00:14:05.065>uh, <00:14:05.531>atomic <00:14:05.998>container <00:14:06.465>deployment

317
00:14:07.825 --> 00:14:10.245
<00:14:07.825>and <00:14:08.058>rollback, <00:14:08.291>so <00:14:08.525>to <00:14:08.758>treating <00:14:08.991>rollback <00:14:09.225>just

318
00:14:10.245 --> 00:14:14.245
<00:14:10.245>as <00:14:10.400>a <00:14:10.556>regular <00:14:10.711>deployment, <00:14:10.867>um, <00:14:11.022>uh, <00:14:11.178>helps <00:14:11.333>of <00:14:11.489>course, <00:14:11.645>uh,

319
00:14:14.245 --> 00:14:17.045
<00:14:14.245>getting <00:14:14.420>the, <00:14:14.595>the <00:14:14.770>automation <00:14:14.945>up <00:14:15.120>to <00:14:15.295>speed <00:14:15.470>and, <00:14:15.645>and,

320
00:14:17.045 --> 00:14:21.005
<00:14:17.045>and <00:14:17.185>giving, <00:14:17.324>um, <00:14:17.464>not <00:14:17.604>needing <00:14:17.745>people <00:14:17.885>to <00:14:18.025>have, <00:14:18.165>uh, <00:14:18.305>route <00:14:18.444>access

321
00:14:21.205 --> 00:14:24.245
<00:14:21.205>to <00:14:21.380>production <00:14:21.555>instances <00:14:21.730>because <00:14:21.905>they <00:14:22.080>can <00:14:22.255>just <00:14:22.430>deploy <00:14:22.605>the

322
00:14:24.405 --> 00:14:26.885
<00:14:24.405>previous <00:14:24.545>version <00:14:24.685>and <00:14:24.824>don't <00:14:24.964>need <00:14:25.105>to <00:14:25.245>go <00:14:25.385>on <00:14:25.525>the <00:14:25.665>server <00:14:25.805>to

323
00:14:27.485 --> 00:14:29.165
<00:14:27.485>manually <00:14:27.765>do <00:14:28.045>something <00:14:28.325>or <00:14:28.605>script <00:14:28.885>something.

324
00:14:29.465 --> 00:14:31.085
<00:14:29.465>Um, <00:14:29.745>that <00:14:30.025>of <00:14:30.305>course, <00:14:30.585>helps <00:14:30.865>again,

325
00:14:31.085 --> 00:14:33.485
<00:14:31.085>to <00:14:31.240>eliminate <00:14:31.396>like <00:14:31.551>manual <00:14:31.707>errors <00:14:31.862>and <00:14:32.018>that <00:14:32.173>kind <00:14:32.329>of <00:14:32.485>stuff.

326
00:14:36.655 --> 00:14:39.315
<00:14:36.655>And <00:14:36.935>ops, <00:14:37.214>I <00:14:37.495>mean, <00:14:37.775>yes, <00:14:38.055>collaborating

327
00:14:39.315 --> 00:14:41.315
<00:14:39.315>with <00:14:39.595>operations <00:14:39.875>is <00:14:40.155>something <00:14:40.435>that, <00:14:40.715>uh,

328
00:14:41.655 --> 00:14:45.115
<00:14:41.655>as <00:14:41.795>a <00:14:41.935>security <00:14:42.074>professional, <00:14:42.214>um, <00:14:42.355>I <00:14:42.495>think <00:14:42.635>you <00:14:42.775>should <00:14:42.915>too, <00:14:43.055>uh,

329
00:14:45.175 --> 00:14:47.395
<00:14:45.175>to, <00:14:45.408>to <00:14:45.641>help <00:14:45.875>bring <00:14:46.108>the <00:14:46.341>availability, <00:14:46.574>security,

330
00:14:47.575 --> 00:14:50.315
<00:14:47.575>the <00:14:47.775>availability <00:14:47.975>part <00:14:48.175>of <00:14:48.375>information <00:14:48.575>security, <00:14:48.775>of <00:14:48.975>course,

331
00:14:50.655 --> 00:14:52.165
<00:14:50.655>um, <00:14:51.334>into <00:14:52.014>interpretations.

332
00:14:52.625 --> 00:14:55.685
<00:14:52.625>And, <00:14:52.780>um, <00:14:52.936>so <00:14:53.091>there <00:14:53.247>is <00:14:53.402>like, <00:14:53.558>whether <00:14:53.713>it's <00:14:53.869>standardization <00:14:54.025>on,

333
00:14:55.705 --> 00:14:57.045
<00:14:55.705>on <00:14:56.006>minimal <00:14:56.308>and <00:14:56.609>hardened, <00:14:56.911>um,

334
00:14:57.065 --> 00:14:59.325
<00:14:57.065>or <00:14:57.298>some <00:14:57.531>container <00:14:57.765>orchestrator, <00:14:57.998>whether <00:14:58.231>that's, <00:14:58.465>um,

335
00:15:00.165 --> 00:15:03.725
<00:15:00.165>bringing <00:15:00.398>the <00:15:00.631>immutable <00:15:00.865>infrastructure <00:15:01.098>using <00:15:01.331>containers, <00:15:01.564>um,

336
00:15:03.945 --> 00:15:07.205
<00:15:03.945>uh, <00:15:04.120>whether <00:15:04.295>that's <00:15:04.470>like <00:15:04.645>rolling <00:15:04.820>out <00:15:04.995>separation, <00:15:05.170>uh, <00:15:05.345>overall,

337
00:15:07.225 --> 00:15:08.605
<00:15:07.225>the, <00:15:07.846>um, <00:15:08.467>stuff.

338
00:15:08.705 --> 00:15:11.045
<00:15:08.705>So <00:15:08.880>not <00:15:09.055>having <00:15:09.230>multiple <00:15:09.405>applications <00:15:09.580>running <00:15:09.755>on <00:15:09.930>one <00:15:10.105>server,

339
00:15:11.585 --> 00:15:13.965
<00:15:11.585>um, <00:15:11.935>detect, <00:15:12.285>prevent <00:15:12.635>proliferation, <00:15:12.985>drift.

340
00:15:14.285 --> 00:15:17.085
<00:15:14.285>I <00:15:14.459>mean, <00:15:14.635>these <00:15:14.810>are <00:15:14.985>all, <00:15:15.160>um, <00:15:15.334>uh, <00:15:15.510>bringing <00:15:15.685>tools,

341
00:15:17.445 --> 00:15:20.085
<00:15:17.445>bringing <00:15:17.725>processes, <00:15:18.005>um, <00:15:18.285>to, <00:15:18.565>to <00:15:18.845>development

342
00:15:20.085 --> 00:15:22.645
<00:15:20.085>and <00:15:20.318>operations <00:15:20.551>teams <00:15:20.785>that <00:15:21.018>helps <00:15:21.251>security, <00:15:21.485>right?

343
00:15:23.025 --> 00:15:27.005
<00:15:23.025>Um, <00:15:23.165>uh, <00:15:23.305>I <00:15:23.444>already <00:15:23.584>mentioned <00:15:23.725>having <00:15:23.865>like, <00:15:24.005>um, <00:15:24.145>uh, <00:15:24.285>in, <00:15:24.425>uh,

344
00:15:27.445 --> 00:15:30.365
<00:15:27.445>authorization, <00:15:27.911>authorization, <00:15:28.378>authentication, <00:15:28.845>authorization,

345
00:15:30.365 --> 00:15:31.805
<00:15:30.365>infrastructure, <00:15:31.013>uh, <00:15:31.661>key

346
00:15:31.805 --> 00:15:32.805
<00:15:31.805>and <00:15:32.255>secrets <00:15:32.704>management,

347
00:15:32.805 --> 00:15:35.445
<00:15:32.805>making <00:15:33.005>sure <00:15:33.204>all <00:15:33.405>the <00:15:33.604>applications <00:15:33.805>are <00:15:34.005>centrally <00:15:34.204>locked,

348
00:15:35.755 --> 00:15:38.405
<00:15:35.755>both <00:15:35.988>under <00:15:36.221>config, <00:15:36.455>um, <00:15:36.688>the <00:15:36.921>administration <00:15:37.155>plane,

349
00:15:38.425 --> 00:15:40.965
<00:15:38.425>but <00:15:38.625>also <00:15:38.824>the <00:15:39.025>application <00:15:39.224>that, <00:15:39.425>uh, <00:15:39.625>user <00:15:39.824>traffic.

350
00:15:41.195 --> 00:15:43.005
<00:15:41.195>This <00:15:41.370>is <00:15:41.545>something <00:15:41.720>that, <00:15:41.895>that, <00:15:42.070>that's <00:15:42.245>of <00:15:42.420>course <00:15:42.595>very,

351
00:15:43.035 --> 00:15:44.285
<00:15:43.035>very <00:15:43.316>easy <00:15:43.597>to <00:15:43.878>roll <00:15:44.160>out,

352
00:15:44.665 --> 00:15:46.325
<00:15:44.665>or <00:15:44.898>this <00:15:45.131>is <00:15:45.365>something <00:15:45.598>that's <00:15:45.831>your <00:15:46.064>interest

353
00:15:46.325 --> 00:15:47.325
<00:15:46.325>as <00:15:46.625>a <00:15:46.925>security <00:15:47.225>professional

354
00:15:47.325 --> 00:15:49.965
<00:15:47.325>to <00:15:47.500>roll <00:15:47.675>out <00:15:47.850>all <00:15:48.025>the <00:15:48.200>applications <00:15:48.375>in <00:15:48.550>an, <00:15:48.725>uh,

355
00:15:49.965 --> 00:15:51.205
<00:15:49.965>as <00:15:50.244>easy <00:15:50.523>way <00:15:50.802>as <00:15:51.081>possible.

356
00:15:52.955 --> 00:15:55.615
<00:15:52.955>And <00:15:53.235>then, <00:15:53.515>uh, <00:15:53.795>zooming <00:15:54.075>in <00:15:54.355>further

357
00:15:56.205 --> 00:15:58.295
<00:15:56.205>into <00:15:56.485>using <00:15:56.765>container <00:15:57.045>reation, <00:15:57.325>for <00:15:57.605>example.

358
00:15:58.715 --> 00:16:01.535
<00:15:58.715>Um, <00:15:58.995>so <00:15:59.275>to <00:15:59.555>separate <00:15:59.835>applications, <00:16:00.115>uh,

359
00:16:01.775 --> 00:16:05.335
<00:16:01.775>services <00:16:01.930>from <00:16:02.086>each <00:16:02.241>other <00:16:02.397>using, <00:16:02.552>uh, <00:16:02.708>kernel <00:16:02.863>aim <00:16:03.019>spacing, <00:16:03.175>um,

360
00:16:05.555 --> 00:16:08.175
<00:16:05.555>as <00:16:05.788>Linux, <00:16:06.021>uh, <00:16:06.255>prevent <00:16:06.488>running <00:16:06.721>as <00:16:06.954>root.

361
00:16:08.405 --> 00:16:09.775
<00:16:08.405>This <00:16:08.651>is <00:16:08.898>all <00:16:09.144>something <00:16:09.391>that, <00:16:09.637>uh,

362
00:16:09.835 --> 00:16:13.335
<00:16:09.835>you <00:16:10.035>can <00:16:10.235>do <00:16:10.435>using <00:16:10.635>software <00:16:10.835>containers, <00:16:11.035>um, <00:16:11.235>with

363
00:16:13.435 --> 00:16:16.815
<00:16:13.435>of <00:16:13.609>course <00:16:13.785>the, <00:16:13.959>um, <00:16:14.135>uh, <00:16:14.310>security <00:16:14.484>benefits <00:16:14.660>listed <00:16:14.834>here.

364
00:16:17.195 --> 00:16:19.775
<00:16:17.195>And <00:16:17.335>as <00:16:17.475>we <00:16:17.615>all <00:16:17.755>know, <00:16:17.895>one <00:16:18.035>of <00:16:18.175>the <00:16:18.315>best, <00:16:18.455>well <00:16:18.595>known,

365
00:16:19.775 --> 00:16:23.095
<00:16:19.775>best <00:16:19.975>known <00:16:20.175>container <00:16:20.375>technologies, <00:16:20.574>Docker, <00:16:20.775>um, <00:16:20.975>is <00:16:21.175>something

366
00:16:23.095 --> 00:16:26.015
<00:16:23.095>that <00:16:23.295>help, <00:16:23.495>help <00:16:23.695>you <00:16:23.895>to <00:16:24.095>implement <00:16:24.295>that, <00:16:24.495>right?

367
00:16:26.475 --> 00:16:28.255
<00:16:26.475>Um, <00:16:26.941>using <00:16:27.408>container <00:16:27.875>technology.

368
00:16:28.255 --> 00:16:30.335
<00:16:28.255>Like, <00:16:28.488>for <00:16:28.721>example, <00:16:28.955>Docker <00:16:29.188>also <00:16:29.421>helps <00:16:29.655>other

369
00:16:30.935 --> 00:16:33.535
<00:16:30.935>software <00:16:31.285>development <00:16:31.635>best <00:16:31.984>practice <00:16:32.334>practices.

370
00:16:33.535 --> 00:16:35.975
<00:16:33.535>For <00:16:33.735>example, <00:16:33.935>the <00:16:34.135>12 <00:16:34.334>factor <00:16:34.535>app <00:16:34.735>pattern, <00:16:34.935>um,

371
00:16:36.225 --> 00:16:38.215
<00:16:36.225>where <00:16:36.691>the <00:16:37.158>operational <00:16:37.625>security

372
00:16:38.275 --> 00:16:39.735
<00:16:38.275>or <00:16:38.537>the <00:16:38.800>traceability <00:16:39.063>of <00:16:39.326>a <00:16:39.589>release

373
00:16:39.755 --> 00:16:41.775
<00:16:39.755>and, <00:16:40.035>uh, <00:16:40.314>having <00:16:40.595>everything <00:16:40.875>packaged, <00:16:41.155>uh,

374
00:16:41.775 --> 00:16:42.855
<00:16:41.775>within <00:16:42.261>the <00:16:42.747>container.

375
00:16:43.115 --> 00:16:44.215
<00:16:43.115>Um, <00:16:43.313>it's <00:16:43.511>of <00:16:43.709>course <00:16:43.907>a <00:16:44.105>benefit

376
00:16:44.435 --> 00:16:46.495
<00:16:44.435>that's <00:16:44.785>not <00:16:45.135>directly <00:16:45.484>security <00:16:45.834>related,

377
00:16:46.715 --> 00:16:49.295
<00:16:46.715>but <00:16:46.915>it's <00:16:47.115>best <00:16:47.315>practice <00:16:47.515>anyway, <00:16:47.715>uh, <00:16:47.915>for <00:16:48.115>goodies.

378
00:16:51.215 --> 00:16:54.035
<00:16:51.215>Now, <00:16:51.390>containers <00:16:51.565>alone, <00:16:51.740>uh, <00:16:51.915>don't <00:16:52.090>solve <00:16:52.265>all <00:16:52.440>the <00:16:52.615>problems.

379
00:16:54.195 --> 00:16:56.155
<00:16:54.195>I <00:16:54.475>love <00:16:54.755>this <00:16:55.035>tweet <00:16:55.315>from <00:16:55.595>2016.

380
00:16:56.455 --> 00:16:57.995
<00:16:56.455>Uh, <00:16:56.686>it's <00:16:56.917>already <00:16:57.148>a <00:16:57.379>few <00:16:57.610>years <00:16:57.841>old,

381
00:16:57.995 --> 00:17:00.635
<00:16:57.995>but <00:16:58.170>I <00:16:58.345>think <00:16:58.520>it's <00:16:58.695>just, <00:16:58.870>it's <00:16:59.045>true, <00:16:59.220>uh, <00:16:59.395>still.

382
00:17:01.055 --> 00:17:03.435
<00:17:01.055>So, <00:17:01.288>um, <00:17:01.521>I <00:17:01.755>mean, <00:17:01.988>uh, <00:17:02.221>using <00:17:02.454>Docker,

383
00:17:03.435 --> 00:17:05.995
<00:17:03.435>using <00:17:03.609>containers <00:17:03.785>in <00:17:03.959>development, <00:17:04.135>it's <00:17:04.310>like <00:17:04.484>one <00:17:04.659>part, <00:17:04.835>right?

384
00:17:06.375 --> 00:17:08.755
<00:17:06.375>And <00:17:06.608>then <00:17:06.841>comes <00:17:07.075>to <00:17:07.308>learning <00:17:07.541>Cliff, <00:17:07.775>um,

385
00:17:08.895 --> 00:17:11.715
<00:17:08.895>and <00:17:09.069>the <00:17:09.244>learning <00:17:09.420>cliff <00:17:09.595>of, <00:17:09.770>for <00:17:09.944>example, <00:17:10.119>having <00:17:10.295>security

386
00:17:11.935 --> 00:17:14.715
<00:17:11.935>for <00:17:12.168>production, <00:17:12.401>uh, <00:17:12.635>code <00:17:12.868>quality, <00:17:13.101>uh, <00:17:13.335>period,

387
00:17:14.715 --> 00:17:16.755
<00:17:14.714>discovery <00:17:14.994>config <00:17:15.274>changes, <00:17:15.554>all <00:17:15.834>of <00:17:16.115>that,

388
00:17:16.855 --> 00:17:19.995
<00:17:16.855>that's <00:17:17.030>then <00:17:17.204>actually <00:17:17.380>needed <00:17:17.555>to <00:17:17.730>run <00:17:17.905>something <00:17:18.079>in <00:17:18.255>production.

389
00:17:20.415 --> 00:17:22.715
<00:17:20.415>That's <00:17:20.694>not <00:17:20.974>something <00:17:21.254>that, <00:17:21.534>uh, <00:17:21.815>containers

390
00:17:23.095 --> 00:17:25.875
<00:17:23.095>by <00:17:23.328>themselves <00:17:23.561>like <00:17:23.795>Docker <00:17:24.028>the <00:17:24.261>product, <00:17:24.495>um,

391
00:17:26.165 --> 00:17:27.595
<00:17:26.165>solve, <00:17:26.594>uh, <00:17:27.022>by <00:17:27.452>themselves.

392
00:17:27.615 --> 00:17:30.475
<00:17:27.615>So <00:17:27.790>that's <00:17:27.964>something <00:17:28.140>that <00:17:28.315>you <00:17:28.490>need <00:17:28.665>more <00:17:28.840>tooling <00:17:29.015>around.

393
00:17:31.015 --> 00:17:34.315
<00:17:31.015>And <00:17:31.215>so <00:17:31.415>here <00:17:31.615>comes <00:17:31.815>the <00:17:32.015>container <00:17:32.215>orchestration, <00:17:32.415>um,

394
00:17:34.615 --> 00:17:37.795
<00:17:34.615>for <00:17:34.755>example, <00:17:34.895>using, <00:17:35.035>uh, <00:17:35.175>Kubernetes <00:17:35.315>as <00:17:35.455>a <00:17:35.595>tool <00:17:35.735>for <00:17:35.875>that, <00:17:36.015>um,

395
00:17:37.795 --> 00:17:40.555
<00:17:37.795>which <00:17:37.970>can <00:17:38.145>take <00:17:38.320>care <00:17:38.495>of <00:17:38.670>scheduling <00:17:38.845>your <00:17:39.020>containers <00:17:39.195>onto

396
00:17:40.555 --> 00:17:41.875
<00:17:40.555>different <00:17:40.852>hosts <00:17:41.149>of <00:17:41.446>making <00:17:41.743>sure

397
00:17:41.875 --> 00:17:44.275
<00:17:41.875>that <00:17:42.075>the <00:17:42.275>containers <00:17:42.475>can <00:17:42.675>find <00:17:42.875>each <00:17:43.075>other, <00:17:43.275>um,

398
00:17:44.615 --> 00:17:46.315
<00:17:44.615>and, <00:17:44.895>uh, <00:17:45.175>doing <00:17:45.455>the <00:17:45.735>service <00:17:46.015>discovery,

399
00:17:46.655 --> 00:17:47.715
<00:17:46.655>um, <00:17:46.893>that <00:17:47.132>kind <00:17:47.370>of <00:17:47.609>stuff.

400
00:17:47.775 --> 00:17:50.445
<00:17:47.775>So <00:17:48.008>helping <00:17:48.241>the <00:17:48.475>availability <00:17:48.708>of, <00:17:48.941>of <00:17:49.175>applications

401
00:17:50.945 --> 00:17:53.245
<00:17:50.945>by <00:17:51.178>making <00:17:51.411>sure <00:17:51.645>the <00:17:51.878>containers <00:17:52.111>are <00:17:52.345>there

402
00:17:53.745 --> 00:17:56.205
<00:17:53.745>and <00:17:53.919>why <00:17:54.094>I'm, <00:17:54.270>I'm, <00:17:54.445>I'm <00:17:54.620>talking <00:17:54.794>about <00:17:54.969>that <00:17:55.145>is

403
00:17:56.355 --> 00:17:58.285
<00:17:56.355>that <00:17:56.705>basically <00:17:57.055>they, <00:17:57.405>they, <00:17:57.755>they,

404
00:17:58.285 --> 00:18:00.485
<00:17:58.285>they're <00:17:58.518>running <00:17:58.751>like <00:17:58.985>on <00:17:59.218>different <00:17:59.451>layers, <00:17:59.685>right?

405
00:18:00.745 --> 00:18:04.925
<00:18:00.745>So <00:18:00.919>the <00:18:01.094>Docker <00:18:01.270>is <00:18:01.445>more <00:18:01.620>packaging, <00:18:01.794>uh, <00:18:01.969>is <00:18:02.145>isolating,

406
00:18:05.415 --> 00:18:06.885
<00:18:05.415>separating <00:18:06.738>applications

407
00:18:06.905 --> 00:18:08.885
<00:18:06.905>and <00:18:07.185>application <00:18:07.465>servers <00:18:07.745>from <00:18:08.024>each <00:18:08.305>other,

408
00:18:09.115 --> 00:18:12.005
<00:18:09.115>whereas <00:18:09.290>Kubernetes <00:18:09.465>is <00:18:09.640>more <00:18:09.815>about <00:18:09.990>the <00:18:10.165>service <00:18:10.340>discovery <00:18:10.515>load

409
00:18:12.005 --> 00:18:14.125
<00:18:12.005>plans <00:18:12.355>thing, <00:18:12.705>um, <00:18:13.055>replacing <00:18:13.405>kind

410
00:18:14.125 --> 00:18:15.645
<00:18:14.125>of <00:18:14.398>like <00:18:14.672>the <00:18:14.945>operating <00:18:15.219>system, <00:18:15.493>right?

411
00:18:15.745 --> 00:18:18.405
<00:18:15.745>You <00:18:15.885>don't <00:18:16.024>have <00:18:16.165>to <00:18:16.304>care <00:18:16.445>about <00:18:16.584>the <00:18:16.725>operating <00:18:16.864>system <00:18:17.004>at <00:18:17.145>least.

412
00:18:18.825 --> 00:18:20.485
<00:18:18.825>Um, <00:18:19.058>but <00:18:19.291>then <00:18:19.525>of <00:18:19.758>course, <00:18:19.991>making <00:18:20.225>sure

413
00:18:20.485 --> 00:18:23.805
<00:18:20.485>that <00:18:20.625>they <00:18:20.764>can <00:18:20.905>find <00:18:21.044>each <00:18:21.185>other <00:18:21.324>and <00:18:21.465>dis <00:18:21.604>each <00:18:21.745>other <00:18:21.885>independent

414
00:18:23.805 --> 00:18:25.285
<00:18:23.805>of <00:18:24.071>the <00:18:24.337>hardware <00:18:24.604>that <00:18:24.870>use, <00:18:25.137>right?

415
00:18:25.585 --> 00:18:29.285
<00:18:25.585>So <00:18:25.760>this <00:18:25.935>is <00:18:26.110>cloud <00:18:26.285>native <00:18:26.460>technology, <00:18:26.635>cloud <00:18:26.810>native <00:18:26.985>computing,

416
00:18:29.425 --> 00:18:31.205
<00:18:29.425>not <00:18:29.774>cloud <00:18:30.125>only <00:18:30.475>computing, <00:18:30.825>right?

417
00:18:31.545 --> 00:18:34.445
<00:18:31.545>So <00:18:31.685>this <00:18:31.825>works <00:18:31.965>just <00:18:32.105>as <00:18:32.245>well <00:18:32.385>in <00:18:32.525>an <00:18:32.665>on-premise, <00:18:32.805>uh, <00:18:32.945>uh,

418
00:18:34.445 --> 00:18:36.085
<00:18:34.445>environment <00:18:34.678>as <00:18:34.911>it <00:18:35.145>does <00:18:35.378>in <00:18:35.611>the <00:18:35.845>cloud.

419
00:18:36.465 --> 00:18:40.485
<00:18:36.465>And <00:18:36.665>basically <00:18:36.865>this <00:18:37.064>mobility, <00:18:37.264>this, <00:18:37.465>um, <00:18:37.665>uh, <00:18:37.865>layers

420
00:18:40.545 --> 00:18:42.805
<00:18:40.545>of <00:18:40.778>abstraction, <00:18:41.011>um, <00:18:41.245>is <00:18:41.478>something <00:18:41.711>that <00:18:41.945>you,

421
00:18:42.805 --> 00:18:44.525
<00:18:42.805>you <00:18:43.085>can <00:18:43.365>use <00:18:43.645>to <00:18:43.925>your <00:18:44.205>benefit.

422
00:18:44.985 --> 00:18:46.685
<00:18:44.985>Um, <00:18:45.218>and, <00:18:45.451>and <00:18:45.685>of <00:18:45.918>course <00:18:46.151>then, <00:18:46.385>um,

423
00:18:47.055 --> 00:18:49.365
<00:18:47.055>focus <00:18:47.288>your <00:18:47.521>efforts <00:18:47.755>on <00:18:47.988>the <00:18:48.221>different <00:18:48.455>layer.

424
00:18:49.425 --> 00:18:50.805
<00:18:49.425>So <00:18:49.735>as <00:18:50.046>a <00:18:50.356>security <00:18:50.667>professional,

425
00:18:51.105 --> 00:18:53.685
<00:18:51.105>you <00:18:51.245>can <00:18:51.385>put <00:18:51.525>your <00:18:51.665>security <00:18:51.805>measures <00:18:51.945>on <00:18:52.085>the, <00:18:52.225>on <00:18:52.365>the <00:18:52.505>cloud

426
00:18:53.985 --> 00:18:55.245
<00:18:53.985>or <00:18:54.362>on-premise, <00:18:54.741>uh, <00:18:55.119>layer.

427
00:18:55.305 --> 00:18:57.045
<00:18:55.305>You <00:18:55.505>can <00:18:55.705>put <00:18:55.905>it <00:18:56.105>on <00:18:56.305>the <00:18:56.505>Kubernetes <00:18:56.705>layer

428
00:18:57.835 --> 00:18:59.405
<00:18:57.835>that <00:18:58.185>goes <00:18:58.535>overall <00:18:58.885>the <00:18:59.235>containers.

429
00:18:59.705 --> 00:19:01.565
<00:18:59.705>Um, <00:18:59.879>and <00:19:00.054>then <00:19:00.230>of <00:19:00.405>course, <00:19:00.580>on <00:19:00.754>the <00:19:00.929>container <00:19:01.105>layer

430
00:19:02.465 --> 00:19:06.365
<00:19:02.465>at <00:19:02.605>in <00:19:02.745>addition, <00:19:02.885>um, <00:19:03.024>helping <00:19:03.165>you <00:19:03.304>to <00:19:03.445>have <00:19:03.584>you <00:19:03.725>covered, <00:19:03.865>uh,

431
00:19:06.505 --> 00:19:08.685
<00:19:06.505>all <00:19:06.738>your <00:19:06.971>bases <00:19:07.205>basically, <00:19:07.438>um, <00:19:07.671>over <00:19:07.905>there

432
00:19:09.265 --> 00:19:10.365
<00:19:09.265>and <00:19:09.595>zooming <00:19:09.925>into <00:19:10.255>this.

433
00:19:10.465 --> 00:19:14.885
<00:19:10.465>Um, <00:19:10.605>so <00:19:10.745>the, <00:19:10.885>the, <00:19:11.024>also, <00:19:11.165>the, <00:19:11.304>uh, <00:19:11.445>whole <00:19:11.584>point <00:19:11.725>of, <00:19:11.865>um,

434
00:19:14.885 --> 00:19:19.325
<00:19:14.885>being <00:19:15.012>able <00:19:15.139>to <00:19:15.266>abstract <00:19:15.394>stuff <00:19:15.521>away, <00:19:15.648>um, <00:19:15.775>is <00:19:15.903>also <00:19:16.030>the, <00:19:16.157>um, <00:19:16.285>the,

435
00:19:19.385 --> 00:19:21.965
<00:19:19.385>the <00:19:19.585>whole <00:19:19.785>point <00:19:19.985>maybe <00:19:20.185>of, <00:19:20.385>of <00:19:20.585>using <00:19:20.785>containers

436
00:19:22.265 --> 00:19:23.485
<00:19:22.265>and <00:19:22.448>where <00:19:22.631>you <00:19:22.814>use <00:19:22.997>them <00:19:23.179>on <00:19:23.362>premise,

437
00:19:23.535 --> 00:19:26.605
<00:19:23.535>where <00:19:23.735>you <00:19:23.935>stay <00:19:24.135>responsible <00:19:24.335>for <00:19:24.535>the <00:19:24.735>whole <00:19:24.935>stack.

438
00:19:27.105 --> 00:19:29.245
<00:19:27.105>Um, <00:19:27.338>already <00:19:27.571>you <00:19:27.805>move <00:19:28.038>to <00:19:28.271>a <00:19:28.505>platform

439
00:19:29.245 --> 00:19:32.405
<00:19:29.245>or <00:19:29.400>container <00:19:29.556>as <00:19:29.711>a <00:19:29.867>service, <00:19:30.022>um, <00:19:30.178>environment <00:19:30.333>where <00:19:30.489>you <00:19:30.645>don't,

440
00:19:32.405 --> 00:19:33.685
<00:19:32.405>you <00:19:32.981>only <00:19:33.557>control

441
00:19:33.705 --> 00:19:36.525
<00:19:33.705>or <00:19:33.860>have <00:19:34.016>to <00:19:34.171>care <00:19:34.327>about <00:19:34.482>the, <00:19:34.638>the <00:19:34.793>top <00:19:34.949>part, <00:19:35.105>uh,

442
00:19:36.555 --> 00:19:38.325
<00:19:36.555>when <00:19:37.255>replatforming, <00:19:37.955>um,

443
00:19:38.425 --> 00:19:42.605
<00:19:38.425>and <00:19:38.541>can, <00:19:38.658>uh, <00:19:38.774>take <00:19:38.891>rest <00:19:39.008>of, <00:19:39.125>um, <00:19:39.241>of <00:19:39.358>the <00:19:39.475>services <00:19:39.591>as <00:19:39.708>a <00:19:39.825>service,

444
00:19:42.605 --> 00:19:44.765
<00:19:42.605>whether <00:19:42.780>it's <00:19:42.955>from <00:19:43.130>an <00:19:43.305>internal <00:19:43.480>or <00:19:43.655>external <00:19:43.830>service <00:19:44.005>provider.

445
00:19:45.105 --> 00:19:46.485
<00:19:45.105>Um, <00:19:45.353>that's <00:19:45.601>of <00:19:45.850>course <00:19:46.098>something <00:19:46.347>that,

446
00:19:46.675 --> 00:19:51.125
<00:19:46.675>that <00:19:46.802>helps <00:19:46.929>you <00:19:47.056>focus <00:19:47.184>your <00:19:47.311>efforts <00:19:47.438>on, <00:19:47.565>uh, <00:19:47.693>uh, <00:19:47.820>on <00:19:47.947>where <00:19:48.075>you,

447
00:19:51.265 --> 00:19:53.125
<00:19:51.265>um, <00:19:51.498>can <00:19:51.731>do <00:19:51.965>the <00:19:52.198>most, <00:19:52.431>uh, <00:19:52.665>impact.

448
00:19:54.225 --> 00:19:57.885
<00:19:54.225>Um, <00:19:54.380>what <00:19:54.536>I <00:19:54.691>mentioned <00:19:54.847>before <00:19:55.002>with <00:19:55.158>the <00:19:55.313>laser <00:19:55.469>of <00:19:55.625>abstraction

449
00:19:57.885 --> 00:19:59.165
<00:19:57.885>and, <00:19:58.269>and <00:19:58.653>using <00:19:59.037>Kubernetes

450
00:19:59.165 --> 00:20:02.365
<00:19:59.165>as <00:19:59.320>the <00:19:59.476>abstraction <00:19:59.631>layer <00:19:59.787>is <00:19:59.942>basically <00:20:00.098>the <00:20:00.253>benefit <00:20:00.409>of <00:20:00.565>using

451
00:20:02.465 --> 00:20:04.205
<00:20:02.465>or <00:20:02.814>tapping <00:20:03.165>into <00:20:03.514>that <00:20:03.865>ecosystem.

452
00:20:04.505 --> 00:20:07.005
<00:20:04.505>So, <00:20:04.971>um, <00:20:05.438>because, <00:20:05.905>uh,

453
00:20:07.065 --> 00:20:11.405
<00:20:07.065>or <00:20:07.192>if <00:20:07.319>you <00:20:07.446>use <00:20:07.574>Kubernetes, <00:20:07.701>you <00:20:07.828>can <00:20:07.955>use <00:20:08.083>all <00:20:08.210>the <00:20:08.337>tooling, <00:20:08.465>uh,

454
00:20:11.425 --> 00:20:14.445
<00:20:11.425>and <00:20:11.600>processes <00:20:11.774>that <00:20:11.950>are <00:20:12.125>there <00:20:12.300>that <00:20:12.475>are <00:20:12.649>already <00:20:12.825>integrated,

455
00:20:14.625 --> 00:20:16.285
<00:20:14.625>uh, <00:20:14.975>for <00:20:15.325>or <00:20:15.675>into <00:20:16.025>Kubernetes.

456
00:20:16.385 --> 00:20:19.685
<00:20:16.385>So <00:20:16.560>whether <00:20:16.735>that <00:20:16.910>is, <00:20:17.085>um, <00:20:17.260>having <00:20:17.435>all <00:20:17.610>the <00:20:17.785>containers

457
00:20:20.355 --> 00:20:23.365
<00:20:20.355>logs <00:20:20.588>collected <00:20:20.821>and <00:20:21.055>aggregated <00:20:21.288>centrally, <00:20:21.521>that's <00:20:21.755>something

458
00:20:23.365 --> 00:20:25.725
<00:20:23.365>that's <00:20:23.540>already <00:20:23.715>there <00:20:23.890>and <00:20:24.065>it's <00:20:24.240>already <00:20:24.415>integrated <00:20:24.590>with, <00:20:24.765>um,

459
00:20:25.755 --> 00:20:27.845
<00:20:25.755>with <00:20:25.988>Kubernetes, <00:20:26.221>that <00:20:26.455>can <00:20:26.688>then <00:20:26.921>make <00:20:27.155>sure

460
00:20:27.845 --> 00:20:31.365
<00:20:27.845>that <00:20:28.000>all <00:20:28.156>your <00:20:28.311>services, <00:20:28.467>um, <00:20:28.622>log <00:20:28.778>centrally, <00:20:28.933>whether <00:20:29.089>it's, <00:20:29.245>uh,

461
00:20:31.365 --> 00:20:33.285
<00:20:31.365>Prometheus <00:20:31.715>having <00:20:32.065>like <00:20:32.415>a <00:20:32.765>container

462
00:20:33.285 --> 00:20:35.965
<00:20:33.285>or <00:20:33.565>service <00:20:33.845>discovery <00:20:34.125>already <00:20:34.405>for <00:20:34.685>Kubernetes,

463
00:20:36.155 --> 00:20:38.485
<00:20:36.155>that <00:20:36.355>you <00:20:36.555>can <00:20:36.754>basically <00:20:36.955>tell <00:20:37.155>Prometheus <00:20:37.355>to <00:20:37.555>go

464
00:20:38.545 --> 00:20:40.085
<00:20:38.545>and <00:20:38.891>monitor <00:20:39.238>all <00:20:39.584>the <00:20:39.931>metrics

465
00:20:40.345 --> 00:20:42.485
<00:20:40.345>of <00:20:40.545>all <00:20:40.745>my <00:20:40.945>applications <00:20:41.145>running <00:20:41.345>in <00:20:41.545>this <00:20:41.745>cluster.

466
00:20:42.945 --> 00:20:45.285
<00:20:42.945>Um, <00:20:43.225>and <00:20:43.504>then <00:20:43.784>Prometheus <00:20:44.064>goes <00:20:44.345>and,

467
00:20:45.345 --> 00:20:47.165
<00:20:45.345>and <00:20:45.545>figures <00:20:45.745>out <00:20:45.945>the <00:20:46.145>metrics, <00:20:46.345>of <00:20:46.545>course, <00:20:46.745>course

468
00:20:47.525 --> 00:20:49.685
<00:20:47.525>provided <00:20:47.758>that <00:20:47.991>your <00:20:48.225>applications <00:20:48.458>have <00:20:48.691>Prometheus <00:20:48.925>co

469
00:20:49.685 --> 00:20:52.325
<00:20:49.685>comparable <00:20:49.885>metrics, <00:20:50.085>but <00:20:50.284>for <00:20:50.485>example, <00:20:50.685>Kubernetes <00:20:50.885>already <00:20:51.085>has,

470
00:20:52.505 --> 00:20:54.365
<00:20:52.505>or <00:20:52.855>Prometheus <00:20:53.205>can <00:20:53.555>collect, <00:20:53.905>um,

471
00:20:54.585 --> 00:20:56.845
<00:20:54.585>the <00:20:54.865>Kubernetes <00:20:55.145>metrics <00:20:55.425>infrastructure <00:20:55.705>metrics <00:20:55.985>already.

472
00:20:57.185 --> 00:20:59.525
<00:20:57.185>Um, <00:20:57.385>so, <00:20:57.585>so <00:20:57.784>that's <00:20:57.985>something <00:20:58.185>that's <00:20:58.385>preintegrated, <00:20:58.585>right?

473
00:20:59.945 --> 00:21:02.965
<00:20:59.945>And <00:21:00.145>then <00:21:00.345>as <00:21:00.544>cell <00:21:00.745>certificates, <00:21:00.945>preintegrated, <00:21:01.145>for <00:21:01.345>example,

474
00:21:03.135 --> 00:21:06.285
<00:21:03.135>let's <00:21:03.368>encrypted <00:21:03.601>org, <00:21:03.835>uh, <00:21:04.068>free <00:21:04.301>certificates, <00:21:04.535>um,

475
00:21:06.515 --> 00:21:08.205
<00:21:06.515>hold <00:21:06.865>a <00:21:07.215>whole <00:21:07.565>docker, <00:21:07.915>uh,

476
00:21:08.265 --> 00:21:10.605
<00:21:08.265>how <00:21:08.465>does <00:21:08.665>your <00:21:08.865>code <00:21:09.065>get <00:21:09.265>into <00:21:09.465>the <00:21:09.665>container?

477
00:21:10.605 --> 00:21:11.965
<00:21:10.605>That's <00:21:10.849>something <00:21:11.094>that's, <00:21:11.339>you <00:21:11.584>know, <00:21:11.829>already

478
00:21:12.035 --> 00:21:13.245
<00:21:12.035>preintegrated, <00:21:13.123>basically.

479
00:21:13.265 --> 00:21:16.325
<00:21:13.265>Um, <00:21:13.392>or <00:21:13.519>you <00:21:13.646>can <00:21:13.774>bring <00:21:13.901>your <00:21:14.028>own, <00:21:14.155>uh, <00:21:14.283>base <00:21:14.410>docker <00:21:14.537>image, <00:21:14.665>right?

480
00:21:17.035 --> 00:21:18.445
<00:21:17.035>Load <00:21:17.669>balancing, <00:21:18.303>uh,

481
00:21:18.685 --> 00:21:21.005
<00:21:18.685>ingress <00:21:18.885>objects <00:21:19.085>using <00:21:19.284>Engine <00:21:19.485>X <00:21:19.685>or <00:21:19.885>something <00:21:20.085>else.

482
00:21:21.545 --> 00:21:24.845
<00:21:21.545>Um, <00:21:21.745>uh, <00:21:21.945>the <00:21:22.145>whole <00:21:22.345>horizontal <00:21:22.545>scaling, <00:21:22.745>auto <00:21:22.945>scaling,

483
00:21:24.845 --> 00:21:26.845
<00:21:24.845>rolling <00:21:25.311>deployments, <00:21:25.778>deployment <00:21:26.245>automation,

484
00:21:26.855 --> 00:21:27.925
<00:21:26.855>green, <00:21:27.336>blue <00:21:27.818>deployments.

485
00:21:28.165 --> 00:21:30.565
<00:21:28.165>I <00:21:28.365>mean, <00:21:28.565>I <00:21:28.764>probably <00:21:28.965>implemented <00:21:29.165>three <00:21:29.365>different <00:21:29.565>types

486
00:21:30.565 --> 00:21:32.525
<00:21:30.565>of <00:21:30.740>green <00:21:30.915>blue <00:21:31.090>deployments <00:21:31.265>in <00:21:31.440>my, <00:21:31.615>in <00:21:31.790>my <00:21:31.965>career,

487
00:21:32.905 --> 00:21:35.565
<00:21:32.905>and <00:21:33.045>they <00:21:33.185>all <00:21:33.325>suck <00:21:33.465>because <00:21:33.605>I've, <00:21:33.745>I've <00:21:33.885>never <00:21:34.024>had <00:21:34.165>the <00:21:34.305>time

488
00:21:35.985 --> 00:21:37.205
<00:21:35.985>to <00:21:36.259>actually <00:21:36.533>do <00:21:36.808>it <00:21:37.082>properly

489
00:21:37.205 --> 00:21:38.765
<00:21:37.205>because <00:21:37.405>like <00:21:37.605>a <00:21:37.804>quick <00:21:38.004>fix <00:21:38.205>for <00:21:38.405>one <00:21:38.605>project.

490
00:21:39.225 --> 00:21:41.645
<00:21:39.225>Um, <00:21:39.399>and <00:21:39.574>Kubernetes <00:21:39.750>already <00:21:39.925>has <00:21:40.100>it, <00:21:40.274>like <00:21:40.449>built <00:21:40.625>in,

491
00:21:41.745 --> 00:21:43.685
<00:21:41.745>in <00:21:42.024>different <00:21:42.304>ways <00:21:42.584>of <00:21:42.864>rolling <00:21:43.145>deployments

492
00:21:43.685 --> 00:21:45.405
<00:21:43.685>of <00:21:44.151>replace <00:21:44.618>replacement <00:21:45.085>deployments,

493
00:21:45.435 --> 00:21:47.445
<00:21:45.435>basically <00:21:45.784>whatever <00:21:46.135>you <00:21:46.485>might <00:21:46.835>need.

494
00:21:47.785 --> 00:21:48.845
<00:21:47.785>And <00:21:48.023>that's <00:21:48.262>something <00:21:48.500>you <00:21:48.739>don't

495
00:21:48.845 --> 00:21:49.925
<00:21:48.845>have <00:21:49.039>to <00:21:49.233>reinvent <00:21:49.428>the <00:21:49.622>wheel <00:21:49.817>for.

496
00:21:50.305 --> 00:21:51.365
<00:21:50.305>And <00:21:50.782>for <00:21:51.259>example,

497
00:21:51.365 --> 00:21:54.445
<00:21:51.365>having <00:21:51.540>the <00:21:51.715>whole <00:21:51.890>image <00:21:52.065>scanning <00:21:52.240>both <00:21:52.415>in <00:21:52.590>the, <00:21:52.765>um,

498
00:21:54.555 --> 00:21:55.725
<00:21:54.555>container <00:21:55.608>repository

499
00:21:55.945 --> 00:21:58.565
<00:21:55.945>and <00:21:56.100>also <00:21:56.256>at <00:21:56.411>runtime, <00:21:56.567>uh, <00:21:56.722>is <00:21:56.878>something <00:21:57.033>that <00:21:57.189>these <00:21:57.345>tool,

500
00:21:58.755 --> 00:22:01.365
<00:21:58.755>there's <00:21:59.035>tooling <00:21:59.315>already <00:21:59.595>there <00:21:59.875>that's <00:22:00.155>preintegrated.

501
00:22:01.545 --> 00:22:04.925
<00:22:01.545>So <00:22:01.652>you <00:22:01.760>don't <00:22:01.868>have <00:22:01.975>to, <00:22:02.083>um, <00:22:02.191>think <00:22:02.298>so <00:22:02.406>much <00:22:02.514>about <00:22:02.621>how <00:22:02.729>to <00:22:02.837>do <00:22:02.945>it.

502
00:22:05.065 --> 00:22:07.605
<00:22:05.065>You <00:22:05.240>can <00:22:05.415>focus <00:22:05.590>on <00:22:05.765>what's <00:22:05.940>gonna <00:22:06.115>run <00:22:06.290>inside <00:22:06.465>it.

503
00:22:09.585 --> 00:22:12.365
<00:22:09.585>Um, <00:22:09.818>authentication, <00:22:10.051>for <00:22:10.285>example, <00:22:10.518>using <00:22:10.751>Key <00:22:10.985>Clock,

504
00:22:12.365 --> 00:22:13.645
<00:22:12.365>that's <00:22:12.653>an <00:22:12.941>open <00:22:13.229>source <00:22:13.517>software.

505
00:22:13.785 --> 00:22:17.405
<00:22:13.785>Uh, <00:22:13.940>it's <00:22:14.096>basically, <00:22:14.251>um, <00:22:14.407>signals <00:22:14.562>sign <00:22:14.718>in <00:22:14.873>out, <00:22:15.029>um, <00:22:15.185>solution

506
00:22:17.405 --> 00:22:20.885
<00:22:17.405>that's, <00:22:17.580>uh, <00:22:17.754>that <00:22:17.930>can <00:22:18.105>broker <00:22:18.280>identities <00:22:18.455>from, <00:22:18.629>from <00:22:18.805>wherever

507
00:22:20.985 --> 00:22:22.445
<00:22:20.985>to <00:22:21.313>wherever, <00:22:21.641>not <00:22:21.970>almost, <00:22:22.299>okay.

508
00:22:22.705 --> 00:22:24.925
<00:22:22.705>Um, <00:22:22.832>but <00:22:22.959>it <00:22:23.086>doesn't <00:22:23.214>really <00:22:23.341>matter <00:22:23.468>where <00:22:23.595>you <00:22:23.723>use <00:22:23.850>it <00:22:23.977>for <00:22:24.105>Open.

509
00:22:25.005 --> 00:22:27.325
<00:22:25.005>I <00:22:25.160>connect <00:22:25.316>for <00:22:25.471>some, <00:22:25.627>or <00:22:25.782>for <00:22:25.938>K <00:22:26.093>bureaus, <00:22:26.249>active <00:22:26.405>directory.

510
00:22:27.705 --> 00:22:31.165
<00:22:27.705>Um, <00:22:27.879>and <00:22:28.054>then <00:22:28.230>providing <00:22:28.405>a, <00:22:28.580>for <00:22:28.754>example, <00:22:28.929>um, <00:22:29.105>uh,

511
00:22:31.745 --> 00:22:33.245
<00:22:31.745>two <00:22:32.082>factor <00:22:32.419>authentication <00:22:32.757>on <00:22:33.094>top,

512
00:22:33.305 --> 00:22:35.605
<00:22:33.305>and <00:22:33.505>then <00:22:33.705>giving <00:22:33.905>that <00:22:34.105>as <00:22:34.305>an <00:22:34.505>internal <00:22:34.705>endpoint.

513
00:22:35.945 --> 00:22:38.165
<00:22:35.945>For <00:22:36.178>example, <00:22:36.411>for <00:22:36.645>Open <00:22:36.878>I <00:22:37.111>connect, <00:22:37.345>um,

514
00:22:38.265 --> 00:22:40.525
<00:22:38.265>or <00:22:38.615>two <00:22:38.965>compatible <00:22:39.315>authentication <00:22:39.665>interface

515
00:22:40.625 --> 00:22:42.365
<00:22:40.625>for <00:22:41.091>your <00:22:41.558>own <00:22:42.025>applications.

516
00:22:42.665 --> 00:22:46.245
<00:22:42.665>So <00:22:42.840>you <00:22:43.014>don't <00:22:43.190>have <00:22:43.365>to <00:22:43.540>manage <00:22:43.715>active <00:22:43.889>directory <00:22:44.065>credentials

517
00:22:46.265 --> 00:22:47.405
<00:22:46.265>for <00:22:46.521>each <00:22:46.778>and <00:22:47.034>every <00:22:47.291>application.

518
00:22:47.665 --> 00:22:50.925
<00:22:47.665>You <00:22:47.805>just <00:22:47.945>point <00:22:48.085>them <00:22:48.225>to <00:22:48.365>the <00:22:48.504>central, <00:22:48.645>um, <00:22:48.784>web <00:22:48.925>API <00:22:49.065>basically,

519
00:22:51.185 --> 00:22:53.565
<00:22:51.185>um, <00:22:51.340>that <00:22:51.496>they <00:22:51.651>can <00:22:51.807>then <00:22:51.962>order <00:22:52.118>authenticate <00:22:52.273>users, <00:22:52.429>give <00:22:52.585>them,

520
00:22:53.945 --> 00:22:55.685
<00:22:53.945>um, <00:22:54.411>uh, <00:22:54.878>signed <00:22:55.345>credentials,

521
00:22:55.985 --> 00:22:59.005
<00:22:55.985>and <00:22:56.159>they <00:22:56.334>can <00:22:56.510>then <00:22:56.685>basically <00:22:56.860>use <00:22:57.034>their <00:22:57.209>application, <00:22:57.385>um,

522
00:22:59.195 --> 00:23:00.485
<00:22:59.195>without <00:22:59.485>having <00:22:59.775>to <00:23:00.065>care <00:23:00.356>about

523
00:23:00.485 --> 00:23:02.565
<00:23:00.485>where <00:23:00.764>the <00:23:01.044>authentication <00:23:01.324>information <00:23:01.604>comes <00:23:01.885>from

524
00:23:02.565 --> 00:23:05.285
<00:23:02.565>and <00:23:02.720>whether <00:23:02.876>it <00:23:03.031>was <00:23:03.187>two <00:23:03.342>factor, <00:23:03.498>uh, <00:23:03.653>authenticated <00:23:03.809>or <00:23:03.965>not.

525
00:23:05.305 --> 00:23:07.085
<00:23:05.305>And <00:23:05.585>you'd <00:23:05.865>have <00:23:06.145>to <00:23:06.425>implement, <00:23:06.705>re-implement

526
00:23:07.085 --> 00:23:10.005
<00:23:07.085>and <00:23:07.285>re-implement <00:23:07.485>password <00:23:07.685>checking <00:23:07.885>over <00:23:08.085>and <00:23:08.285>over <00:23:08.485>again.

527
00:23:10.025 --> 00:23:11.565
<00:23:10.025>So <00:23:10.223>that's <00:23:10.421>something, <00:23:10.619>for <00:23:10.817>example, <00:23:11.015>that's <00:23:11.213>already <00:23:11.411>there.

528
00:23:11.965 --> 00:23:13.205
<00:23:11.965>I <00:23:12.244>already <00:23:12.523>mentioned <00:23:12.802>logging, <00:23:13.081>uh,

529
00:23:13.205 --> 00:23:15.005
<00:23:13.205>elastic <00:23:13.554>Search <00:23:13.905>Hook <00:23:14.254>slash <00:23:14.605>Kibana,

530
00:23:15.065 --> 00:23:17.965
<00:23:15.065>or <00:23:15.298>Elasticsearch, <00:23:15.531>fluent <00:23:15.765>de <00:23:15.998>Kibana <00:23:16.231>or <00:23:16.465>Greylock.

531
00:23:18.045 --> 00:23:20.205
<00:23:18.045>I <00:23:18.200>mean, <00:23:18.356>there, <00:23:18.511>there's <00:23:18.667>those <00:23:18.822>open <00:23:18.978>source <00:23:19.133>that's <00:23:19.289>already, <00:23:19.445>uh,

532
00:23:20.205 --> 00:23:21.565
<00:23:20.205>everything <00:23:20.817>is <00:23:21.429>preintegrated.

533
00:23:21.865 --> 00:23:24.245
<00:23:21.865>Um, <00:23:22.065>and <00:23:22.265>then <00:23:22.465>you <00:23:22.665>can <00:23:22.865>basically <00:23:23.065>provide <00:23:23.265>that

534
00:23:24.245 --> 00:23:25.485
<00:23:24.245>as <00:23:24.468>a <00:23:24.691>service <00:23:24.914>to <00:23:25.137>your <00:23:25.360>users.

535
00:23:26.035 --> 00:23:28.485
<00:23:26.035>Plus <00:23:26.210>you <00:23:26.385>have <00:23:26.560>the <00:23:26.735>logs, <00:23:26.910>um, <00:23:27.085>if <00:23:27.260>you <00:23:27.435>want

536
00:23:28.485 --> 00:23:30.925
<00:23:28.485>to <00:23:28.685>do <00:23:28.885>incident <00:23:29.084>management, <00:23:29.284>uh, <00:23:29.485>tracing <00:23:29.685>back, <00:23:29.885>Hey,

537
00:23:30.925 --> 00:23:32.405
<00:23:30.925>where <00:23:31.191>did <00:23:31.457>this <00:23:31.724>request <00:23:31.990>came <00:23:32.257>from?

538
00:23:32.465 --> 00:23:36.405
<00:23:32.465>Or <00:23:32.592>who, <00:23:32.719>uh, <00:23:32.846>who <00:23:32.974>made <00:23:33.101>the <00:23:33.228>request <00:23:33.355>in <00:23:33.483>the <00:23:33.610>first <00:23:33.737>place <00:23:33.865>is

539
00:23:36.405 --> 00:23:39.645
<00:23:36.405>of <00:23:36.580>course <00:23:36.754>something <00:23:36.930>that, <00:23:37.105>uh, <00:23:37.280>um, <00:23:37.455>uh, <00:23:37.629>SecOps, <00:23:37.805>uh,

540
00:23:39.845 --> 00:23:41.565
<00:23:39.845>security <00:23:40.195>operations, <00:23:40.545>uh, <00:23:40.895>might <00:23:41.245>be,

541
00:23:41.585 --> 00:23:43.445
<00:23:41.585>or <00:23:41.935>security <00:23:42.285>incident <00:23:42.635>event <00:23:42.985>management.

542
00:23:43.545 --> 00:23:45.700
<00:23:43.545>Um, <00:23:43.745>solutions <00:23:43.945>might <00:23:44.145>of <00:23:44.345>course <00:23:44.545>be <00:23:44.745>interested <00:23:44.945>in.

543
00:23:46.805 --> 00:23:49.565
<00:23:46.805>I <00:23:47.005>already <00:23:47.205>mentioned <00:23:47.405>Prometheus, <00:23:47.605>um, <00:23:47.805>time <00:23:48.005>series <00:23:48.205>database,

544
00:23:49.695 --> 00:23:51.285
<00:23:49.695>cloud <00:23:50.044>native, <00:23:50.395>uh, <00:23:50.745>CNCF <00:23:51.095>project.

545
00:23:51.745 --> 00:23:54.005
<00:23:51.745>New <00:23:51.885>Relic, <00:23:52.024>I <00:23:52.165>think <00:23:52.304>is <00:23:52.445>a <00:23:52.584>sponsor <00:23:52.725>of <00:23:52.864>the <00:23:53.004>DevOps, <00:23:53.145>uh,

546
00:23:54.305 --> 00:23:55.925
<00:23:54.305>day, <00:23:54.771>um, <00:23:55.238>on <00:23:55.705>Friday.

547
00:23:56.145 --> 00:23:58.485
<00:23:56.145>So, <00:23:56.378>I <00:23:56.611>mean, <00:23:56.845>there's <00:23:57.078>tooling, <00:23:57.311>different <00:23:57.545>tooling.

548
00:23:58.485 --> 00:24:00.485
<00:23:58.485>Oh, <00:23:58.640>it's <00:23:58.796>all <00:23:58.951>there. <00:23:59.107>Uh, <00:23:59.262>the <00:23:59.418>question <00:23:59.573>is <00:23:59.729>more <00:23:59.885>where,

549
00:24:00.715 --> 00:24:03.205
<00:24:00.715>what <00:24:00.915>do <00:24:01.115>you, <00:24:01.314>you <00:24:01.514>declare <00:24:01.715>is <00:24:01.915>the <00:24:02.115>standard

550
00:24:03.705 --> 00:24:05.845
<00:24:03.705>and <00:24:03.860>what <00:24:04.016>you <00:24:04.171>then <00:24:04.327>basically <00:24:04.482>as <00:24:04.638>a <00:24:04.793>help <00:24:04.949>to <00:24:05.105>support.

551
00:24:06.835 --> 00:24:09.295
<00:24:06.835>So <00:24:06.975>that <00:24:07.115>was <00:24:07.255>a <00:24:07.395>lot <00:24:07.535>of, <00:24:07.675>you <00:24:07.815>know, <00:24:07.955>tools <00:24:08.095>and <00:24:08.235>stuff.

552
00:24:09.795 --> 00:24:12.655
<00:24:09.795>Um, <00:24:09.995>and <00:24:10.195>let <00:24:10.395>me <00:24:10.595>make <00:24:10.795>a <00:24:10.995>concrete <00:24:11.195>example.

553
00:24:13.155 --> 00:24:15.815
<00:24:13.155>Um, <00:24:13.388>so, <00:24:13.621>um, <00:24:13.855>Enova <00:24:14.088>is <00:24:14.321>a <00:24:14.555>developer

554
00:24:15.915 --> 00:24:19.535
<00:24:15.915>and <00:24:16.115>operator <00:24:16.315>of <00:24:16.514>banking <00:24:16.715>software <00:24:16.915>used <00:24:17.115>by <00:24:17.315>100,

555
00:24:19.945 --> 00:24:21.575
<00:24:19.945>about <00:24:20.411>100 <00:24:20.878>Swiss <00:24:21.345>banks.

556
00:24:22.035 --> 00:24:23.935
<00:24:22.035>Um, <00:24:22.268>they're <00:24:22.501>based <00:24:22.735>in <00:24:22.968>Switzerland, <00:24:23.201>of <00:24:23.435>course.

557
00:24:24.355 --> 00:24:26.375
<00:24:24.355>Um, <00:24:24.555>they've <00:24:24.755>been <00:24:24.955>around <00:24:25.155>for <00:24:25.355>a <00:24:25.555>few <00:24:25.755>years.

558
00:24:26.515 --> 00:24:30.295
<00:24:26.515>And <00:24:26.715>also, <00:24:26.915>um, <00:24:27.115>they <00:24:27.315>are <00:24:27.515>about <00:24:27.715>400 <00:24:27.915>employees.

559
00:24:31.195 --> 00:24:33.615
<00:24:31.195>Um, <00:24:31.661>they <00:24:32.128>have <00:24:32.595>this,

560
00:24:33.835 --> 00:24:36.335
<00:24:33.835>and <00:24:33.990>I <00:24:34.146>love <00:24:34.301>the, <00:24:34.457>the <00:24:34.612>demographic <00:24:34.768>from <00:24:34.923>this <00:24:35.079>geographic, <00:24:35.235>I,

561
00:24:36.495 --> 00:24:37.855
<00:24:36.495>I <00:24:36.739>use <00:24:36.984>it, <00:24:37.229>uh, <00:24:37.474>with <00:24:37.719>permission.

562
00:24:37.965 --> 00:24:41.535
<00:24:37.965>They <00:24:38.165>have <00:24:38.365>this <00:24:38.564>layered <00:24:38.764>approach, <00:24:38.965>um, <00:24:39.165>to, <00:24:39.365>um,

563
00:24:41.755 --> 00:24:46.015
<00:24:41.755>how <00:24:41.895>they <00:24:42.035>set <00:24:42.175>up <00:24:42.315>their, <00:24:42.455>um, <00:24:42.595>their, <00:24:42.735>uh, <00:24:42.875>layers <00:24:43.015>of <00:24:43.155>abstraction.

564
00:24:46.355 --> 00:24:50.815
<00:24:46.355>Uh, <00:24:46.482>and <00:24:46.609>so, <00:24:46.736>um, <00:24:46.864>they <00:24:46.991>have <00:24:47.118>hardware <00:24:47.245>which <00:24:47.373>they, <00:24:47.500>um, <00:24:47.627>uh, <00:24:47.755>have

565
00:24:51.535 --> 00:24:53.775
<00:24:51.535>abstracted <00:24:51.885>from, <00:24:52.235>by <00:24:52.585>using, <00:24:52.935>uh,

566
00:24:53.795 --> 00:24:55.135
<00:24:53.795>the <00:24:54.197>OpenShift <00:24:54.599>Kubernetes <00:24:55.001>distribution.

567
00:24:56.105 --> 00:24:59.395
<00:24:56.105>Umif <00:24:56.305>already <00:24:56.505>provides <00:24:56.705>s <00:24:56.905>logging, <00:24:57.105>um, <00:24:57.305>with <00:24:57.505>EFK,

568
00:24:59.415 --> 00:25:03.155
<00:24:59.415>and, <00:24:59.570>uh, <00:24:59.726>monitoring <00:24:59.881>as <00:25:00.037>in <00:25:00.192>metrics, <00:25:00.348>uh, <00:25:00.503>using <00:25:00.659>Prometheus, <00:25:00.815>uh,

569
00:25:03.155 --> 00:25:04.235
<00:25:03.155>already <00:25:03.479>comes <00:25:03.803>with <00:25:04.127>OpenShift.

570
00:25:04.695 --> 00:25:07.715
<00:25:04.695>Um, <00:25:04.835>and <00:25:04.975>then <00:25:05.115>they <00:25:05.254>have <00:25:05.395>their <00:25:05.534>own <00:25:05.675>security <00:25:05.814>services <00:25:05.955>on <00:25:06.095>top.

571
00:25:07.775 --> 00:25:10.555
<00:25:07.775>So <00:25:08.008>for <00:25:08.241>example, <00:25:08.475>authentication, <00:25:08.708>um, <00:25:08.941>that <00:25:09.175>is

572
00:25:10.875 --> 00:25:14.115
<00:25:10.875>provided <00:25:11.108>by, <00:25:11.341>um, <00:25:11.575>uh, <00:25:11.808>by <00:25:12.041>well <00:25:12.275>is

573
00:25:14.275 --> 00:25:16.475
<00:25:14.275>provided <00:25:14.508>to <00:25:14.741>all <00:25:14.975>the <00:25:15.208>internal <00:25:15.441>users, <00:25:15.675>um,

574
00:25:16.585 --> 00:25:18.795
<00:25:16.585>that <00:25:16.865>might <00:25:17.145>need <00:25:17.425>user <00:25:17.705>authentication, <00:25:17.985>right?

575
00:25:19.615 --> 00:25:23.275
<00:25:19.615>Um, <00:25:19.770>there <00:25:19.926>is <00:25:20.081>then, <00:25:20.237>um, <00:25:20.392>uh, <00:25:20.548>there <00:25:20.703>is <00:25:20.859>the, <00:25:21.015>the,

576
00:25:23.275 --> 00:25:26.635
<00:25:23.275>like <00:25:23.430>the <00:25:23.586>backend, <00:25:23.741>well <00:25:23.897>backend <00:25:24.052>services, <00:25:24.208>uh, <00:25:24.363>um, <00:25:24.519>that, <00:25:24.675>uh,

577
00:25:26.635 --> 00:25:28.075
<00:25:26.635>that <00:25:26.851>they're, <00:25:27.067>that <00:25:27.283>they <00:25:27.499>develop <00:25:27.715>and <00:25:27.931>run.

578
00:25:28.075 --> 00:25:30.715
<00:25:28.075>And <00:25:28.250>then <00:25:28.425>the <00:25:28.600>frontend <00:25:28.775>applications, <00:25:28.950>it's <00:25:29.125>basically <00:25:29.300>the, <00:25:29.475>um,

579
00:25:31.155 --> 00:25:35.955
<00:25:31.155>whatever <00:25:31.330>online <00:25:31.504>banking, <00:25:31.680>uh, <00:25:31.855>account, <00:25:32.030>uh, <00:25:32.205>on <00:25:32.379>web <00:25:32.555>application

580
00:25:36.465 --> 00:25:39.155
<00:25:36.465>that <00:25:36.620>they, <00:25:36.776>um, <00:25:36.931>that <00:25:37.087>they <00:25:37.242>develop <00:25:37.398>and, <00:25:37.553>and <00:25:37.709>deploy <00:25:37.865>there.

581
00:25:39.295 --> 00:25:40.315
<00:25:39.295>And <00:25:39.524>of <00:25:39.754>course, <00:25:39.983>they're <00:25:40.213>also,

582
00:25:40.325 --> 00:25:41.715
<00:25:40.325>since <00:25:40.637>they're <00:25:40.950>running <00:25:41.263>on <00:25:41.576>containers,

583
00:25:41.715 --> 00:25:43.795
<00:25:41.715>they <00:25:41.915>can <00:25:42.115>also <00:25:42.314>do <00:25:42.514>like <00:25:42.715>third <00:25:42.915>party <00:25:43.115>software,

584
00:25:43.815 --> 00:25:46.595
<00:25:43.815>run <00:25:43.931>it <00:25:44.048>on <00:25:44.165>the <00:25:44.281>same <00:25:44.398>cluster <00:25:44.515>that <00:25:44.631>can <00:25:44.748>then <00:25:44.865>talk <00:25:44.981>to, <00:25:45.098>you <00:25:45.215>know,

585
00:25:46.755 --> 00:25:49.195
<00:25:46.755>internal <00:25:47.035>APIs <00:25:47.315>and <00:25:47.595>extend <00:25:47.875>their <00:25:48.155>functionality.

586
00:25:49.455 --> 00:25:51.835
<00:25:49.455>But <00:25:49.595>as <00:25:49.735>you <00:25:49.875>can <00:25:50.014>see, <00:25:50.155>it's, <00:25:50.294>it's <00:25:50.435>the <00:25:50.574>same <00:25:50.715>concept, <00:25:50.855>right?

587
00:25:51.835 --> 00:25:54.675
<00:25:51.835>Having <00:25:52.035>the <00:25:52.235>layers <00:25:52.435>of <00:25:52.635>abstraction <00:25:52.835>as <00:25:53.035>developer <00:25:53.235>of,

588
00:25:54.735 --> 00:25:56.435
<00:25:54.735>of <00:25:54.968>this <00:25:55.201>layer <00:25:55.435>or <00:25:55.668>the <00:25:55.901>layer <00:25:56.135>above.

589
00:25:56.655 --> 00:25:58.395
<00:25:56.655>You <00:25:56.888>don't <00:25:57.121>have <00:25:57.355>to <00:25:57.588>care <00:25:57.821>about <00:25:58.055>authentication.

590
00:25:58.395 --> 00:25:59.835
<00:25:58.395>You <00:25:58.539>don't <00:25:58.683>have <00:25:58.827>to <00:25:58.971>care <00:25:59.115>about <00:25:59.259>logging, <00:25:59.403>you <00:25:59.547>don't <00:25:59.691>have

591
00:25:59.835 --> 00:26:01.515
<00:25:59.835>to <00:26:00.068>care <00:26:00.301>about, <00:26:00.535>uh, <00:26:00.768>metrics <00:26:01.001>and <00:26:01.235>monitoring.

592
00:26:01.775 --> 00:26:04.955
<00:26:01.775>Um, <00:26:01.915>that's <00:26:02.055>kind <00:26:02.195>of <00:26:02.335>provided. <00:26:02.475>You <00:26:02.615>can <00:26:02.755>just <00:26:02.895>use <00:26:03.035>the <00:26:03.175>services.

593
00:26:05.455 --> 00:26:07.715
<00:26:05.455>Um, <00:26:05.595>and <00:26:05.735>as <00:26:05.875>a <00:26:06.014>security <00:26:06.155>professional, <00:26:06.294>you <00:26:06.435>can <00:26:06.574>make <00:26:06.715>sure <00:26:06.855>that,

594
00:26:07.775 --> 00:26:11.635
<00:26:07.775>you <00:26:07.930>know, <00:26:08.086>no <00:26:08.241>developer <00:26:08.397>is <00:26:08.552>reinventing <00:26:08.708>the <00:26:08.863>SMS <00:26:09.019>token <00:26:09.175>wheel

595
00:26:11.695 --> 00:26:14.675
<00:26:11.695>or <00:26:11.928>the <00:26:12.161>user <00:26:12.395>password <00:26:12.628>hashing <00:26:12.861>wheel, <00:26:13.095>uh,

596
00:26:14.675 --> 00:26:15.995
<00:26:14.675>because <00:26:14.873>there's <00:26:15.071>already <00:26:15.269>a <00:26:15.466>service <00:26:15.665>for <00:26:15.862>that,

597
00:26:16.015 --> 00:26:18.675
<00:26:16.015>and <00:26:16.155>it's <00:26:16.295>probably <00:26:16.435>much <00:26:16.575>easier <00:26:16.715>to <00:26:16.855>use <00:26:16.995>the <00:26:17.135>service <00:26:17.275>than <00:26:17.415>to

598
00:26:19.355 --> 00:26:21.115
<00:26:19.355>reinvent <00:26:19.705>that <00:26:20.055>wheel, <00:26:20.405>uh, <00:26:20.755>themselves.

599
00:26:22.705 --> 00:26:26.325
<00:26:22.705>Um, <00:26:22.905>now, <00:26:23.105>uh, <00:26:23.304>in <00:26:23.504>their <00:26:23.705>software, <00:26:23.905>uh, <00:26:24.105>development

600
00:26:26.385 --> 00:26:29.165
<00:26:26.385>and <00:26:26.618>deployment <00:26:26.851>processes, <00:26:27.085>they <00:26:27.318>have, <00:26:27.551>um, <00:26:27.785>the,

601
00:26:29.185 --> 00:26:30.485
<00:26:29.185>the <00:26:29.574>following <00:26:29.965>like <00:26:30.355>tools

602
00:26:30.585 --> 00:26:33.085
<00:26:30.585>and <00:26:30.712>steps <00:26:30.839>that <00:26:30.966>they <00:26:31.094>do, <00:26:31.221>they <00:26:31.348>have, <00:26:31.475>like <00:26:31.603>on <00:26:31.730>the <00:26:31.857>code <00:26:31.985>level,

603
00:26:33.195 --> 00:26:36.165
<00:26:33.195>both <00:26:33.370>code <00:26:33.544>security, <00:26:33.720>their <00:26:33.895>access <00:26:34.070>to <00:26:34.245>code <00:26:34.419>and <00:26:34.595>security,

604
00:26:36.165 --> 00:26:38.165
<00:26:36.165>and <00:26:36.320>auditing <00:26:36.476>off <00:26:36.631>the <00:26:36.787>code <00:26:36.942>and <00:26:37.098>changes <00:26:37.253>to <00:26:37.409>the <00:26:37.565>code.

605
00:26:38.165 --> 00:26:40.685
<00:26:38.165>It's <00:26:38.320>of <00:26:38.476>course <00:26:38.631>something <00:26:38.787>that <00:26:38.942>more <00:26:39.098>the <00:26:39.253>software <00:26:39.409>people <00:26:39.565>do,

606
00:26:41.465 --> 00:26:45.845
<00:26:41.465>uh, <00:26:41.620>in <00:26:41.776>Git, <00:26:41.931>then <00:26:42.087>using <00:26:42.242>the, <00:26:42.398>uh, <00:26:42.553>container, <00:26:42.709>um, <00:26:42.865>uh,

607
00:26:46.165 --> 00:26:48.005
<00:26:46.165>repository, <00:26:46.631>um, <00:26:47.098>to <00:26:47.565>collaborate.

608
00:26:48.005 --> 00:26:49.885
<00:26:48.005>They <00:26:48.285>have, <00:26:48.565>um, <00:26:48.845>their <00:26:49.125>own <00:26:49.405>software,

609
00:26:49.945 --> 00:26:51.965
<00:26:49.945>the <00:26:50.225>base <00:26:50.504>images <00:26:50.784>plus <00:26:51.064>reported <00:26:51.345>software.

610
00:26:51.965 --> 00:26:53.485
<00:26:51.965>They <00:26:52.307>do, <00:26:52.649>uh, <00:26:52.991>image <00:26:53.332>scan.

611
00:26:53.515 --> 00:26:57.365
<00:26:53.515>They <00:26:53.655>do <00:26:53.795>the <00:26:53.935>hardening <00:26:54.075>of <00:26:54.215>their <00:26:54.355>own <00:26:54.495>base <00:26:54.635>images, <00:26:54.775>um, <00:26:54.915>so

612
00:26:57.385 --> 00:26:59.965
<00:26:57.385>to <00:26:57.512>make <00:26:57.639>sure <00:26:57.766>that <00:26:57.894>they <00:26:58.021>have <00:26:58.148>all <00:26:58.275>a <00:26:58.403>certain <00:26:58.530>quality <00:26:58.657>of <00:26:58.785>course.

613
00:27:00.345 --> 00:27:02.645
<00:27:00.345>Um, <00:27:00.485>and <00:27:00.625>of <00:27:00.765>course, <00:27:00.905>the <00:27:01.045>central <00:27:01.185>team <00:27:01.325>can <00:27:01.465>that <00:27:01.605>provide <00:27:01.745>that

614
00:27:02.645 --> 00:27:04.925
<00:27:02.645>to, <00:27:02.820>to <00:27:02.995>multiple <00:27:03.170>software <00:27:03.345>development <00:27:03.520>teams <00:27:03.695>that <00:27:03.870>don't <00:27:04.045>have

615
00:27:04.925 --> 00:27:07.085
<00:27:04.925>to <00:27:05.205>do <00:27:05.485>that <00:27:05.764>themselves, <00:27:06.044>themselves <00:27:06.325>necessary.

616
00:27:07.885 --> 00:27:09.465
<00:27:07.885>Uh, <00:27:08.165>they <00:27:08.445>didn't <00:27:08.725>have, <00:27:09.004>of <00:27:09.285>course,

617
00:27:09.525 --> 00:27:12.945
<00:27:09.525>the <00:27:09.700>container <00:27:09.875>platform <00:27:10.050>running <00:27:10.225>the, <00:27:10.400>the, <00:27:10.575>the <00:27:10.750>Kubernetes, <00:27:10.925>um,

618
00:27:13.625 --> 00:27:14.905
<00:27:13.625>distribution <00:27:14.009>of, <00:27:14.393>of <00:27:14.777>OpenShift.

619
00:27:15.205 --> 00:27:17.985
<00:27:15.205>And <00:27:15.379>then <00:27:15.554>for <00:27:15.730>the <00:27:15.905>whole <00:27:16.080>application <00:27:16.254>management <00:27:16.429>at <00:27:16.605>all

620
00:27:17.985 --> 00:27:19.665
<00:27:17.985>operations, <00:27:18.334>part <00:27:18.685>of <00:27:19.034>their <00:27:19.385>software,

621
00:27:20.135 --> 00:27:22.585
<00:27:20.135>they <00:27:20.310>then <00:27:20.485>have <00:27:20.660>all <00:27:20.835>the <00:27:21.010>network <00:27:21.185>security <00:27:21.360>monitoring, <00:27:21.535>logging,

622
00:27:22.585 --> 00:27:26.065
<00:27:22.585>and <00:27:22.725>reporting <00:27:22.865>that <00:27:23.005>ties <00:27:23.145>all <00:27:23.285>of <00:27:23.425>these, <00:27:23.565>um, <00:27:23.705>the, <00:27:23.845>the <00:27:23.985>projects.

623
00:27:26.065 --> 00:27:29.025
<00:27:26.065>And <00:27:26.240>basically <00:27:26.415>together, <00:27:26.590>and <00:27:26.765>this <00:27:26.940>looks <00:27:27.115>like <00:27:27.290>this, <00:27:27.465>um,

624
00:27:29.285 --> 00:27:31.385
<00:27:29.285>in <00:27:29.565>the, <00:27:29.845>in <00:27:30.125>their <00:27:30.405>dev <00:27:30.685>development

625
00:27:31.385 --> 00:27:33.225
<00:27:31.385>and <00:27:31.851>operations <00:27:32.318>collaboration, <00:27:32.785>um,

626
00:27:33.225 --> 00:27:35.665
<00:27:33.225>they <00:27:33.458>use <00:27:33.691>a <00:27:33.925>business <00:27:34.158>process, <00:27:34.391>um, <00:27:34.625>uh,

627
00:27:35.775 --> 00:27:39.345
<00:27:35.775>framework <00:27:35.950>based <00:27:36.125>on <00:27:36.300>Apache <00:27:36.475>Kaunda, <00:27:36.650>um, <00:27:36.825>which <00:27:37.000>they <00:27:37.175>used

628
00:27:39.345 --> 00:27:43.505
<00:27:39.345>to <00:27:39.545>basically, <00:27:39.745>well <00:27:39.945>even <00:27:40.145>graphically <00:27:40.345>show, <00:27:40.545>uh, <00:27:40.745>who's,

629
00:27:43.595 --> 00:27:45.945
<00:27:43.595>who's <00:27:43.795>doing <00:27:43.995>what <00:27:44.195>and, <00:27:44.395>and <00:27:44.595>in <00:27:44.795>what <00:27:44.995>order.

630
00:27:46.325 --> 00:27:48.985
<00:27:46.325>Um, <00:27:46.480>and <00:27:46.636>so <00:27:46.791>basically <00:27:46.947>to <00:27:47.102>roll <00:27:47.258>out <00:27:47.413>a <00:27:47.569>new <00:27:47.725>deployment,

631
00:27:48.985 --> 00:27:52.505
<00:27:48.985>they <00:27:49.140>have <00:27:49.296>like <00:27:49.451>this, <00:27:49.607>this <00:27:49.762>business <00:27:49.918>rules <00:27:50.073>that <00:27:50.229>say, <00:27:50.385>okay,

632
00:27:52.525 --> 00:27:54.225
<00:27:52.525>we <00:27:52.700>need, <00:27:52.875>first <00:27:53.050>we <00:27:53.225>have <00:27:53.400>to <00:27:53.575>deploy <00:27:53.750>to <00:27:53.925>testing,

633
00:27:54.365 --> 00:27:55.625
<00:27:54.365>and <00:27:54.591>then <00:27:54.818>we <00:27:55.045>have <00:27:55.272>this <00:27:55.499>person

634
00:27:55.885 --> 00:27:58.625
<00:27:55.885>or <00:27:56.118>this <00:27:56.351>role <00:27:56.585>that <00:27:56.818>accepts <00:27:57.051>the <00:27:57.285>change.

635
00:27:58.725 --> 00:28:01.305
<00:27:58.725>And <00:27:58.899>then <00:27:59.074>by <00:27:59.250>pushing <00:27:59.425>the <00:27:59.600>button <00:27:59.774>of, <00:27:59.949>I <00:28:00.125>accept,

636
00:28:01.305 --> 00:28:04.065
<00:28:01.305>then <00:28:01.505>it <00:28:01.705>gets <00:28:01.905>deployed <00:28:02.105>automatically <00:28:02.305>to <00:28:02.505>do <00:28:02.705>pre-production.

637
00:28:04.245 --> 00:28:06.665
<00:28:04.245>And <00:28:04.400>this <00:28:04.556>way <00:28:04.711>it's <00:28:04.867>kind <00:28:05.022>of, <00:28:05.178>everybody <00:28:05.333>sees <00:28:05.489>what's <00:28:05.645>happening

638
00:28:06.665 --> 00:28:09.145
<00:28:06.665>and <00:28:06.805>what's <00:28:06.945>the <00:28:07.085>next <00:28:07.225>step, <00:28:07.365>and <00:28:07.504>who <00:28:07.645>has <00:28:07.784>to <00:28:07.925>know <00:28:08.065>approve

639
00:28:09.245 --> 00:28:10.905
<00:28:09.245>or <00:28:09.524>audit <00:28:09.804>or <00:28:10.084>whatever <00:28:10.364>that's <00:28:10.645>necessary,

640
00:28:11.365 --> 00:28:12.865
<00:28:11.365>but <00:28:11.635>it's <00:28:11.905>still <00:28:12.175>all <00:28:12.445>automated, <00:28:12.715>right?

641
00:28:12.965 --> 00:28:14.985
<00:28:12.965>All <00:28:13.314>every <00:28:13.665>deployment <00:28:14.014>is <00:28:14.365>automated,

642
00:28:15.285 --> 00:28:18.345
<00:28:15.285>but <00:28:15.425>it <00:28:15.565>just <00:28:15.705>needs <00:28:15.845>a, <00:28:15.985>a <00:28:16.125>click <00:28:16.265>of <00:28:16.405>a <00:28:16.545>special <00:28:16.685>person

643
00:28:18.365 --> 00:28:20.705
<00:28:18.365>or <00:28:18.540>a <00:28:18.715>person <00:28:18.890>that <00:28:19.065>has <00:28:19.240>access <00:28:19.415>rights, <00:28:19.590>um, <00:28:19.765>to,

644
00:28:20.765 --> 00:28:22.025
<00:28:20.765>to <00:28:21.143>approve <00:28:21.521>it, <00:28:21.899>right?

645
00:28:22.405 --> 00:28:24.865
<00:28:22.405>And <00:28:22.545>this <00:28:22.685>way <00:28:22.825>you <00:28:22.965>have <00:28:23.105>like <00:28:23.245>the, <00:28:23.385>the, <00:28:23.524>the, <00:28:23.665>the, <00:28:23.805>the,

646
00:28:24.865 --> 00:28:27.065
<00:28:24.865>the <00:28:25.040>benefits <00:28:25.215>of <00:28:25.390>not <00:28:25.565>having <00:28:25.740>manual <00:28:25.915>errors <00:28:26.090>and <00:28:26.265>stuff,

647
00:28:27.405 --> 00:28:29.825
<00:28:27.405>but <00:28:27.638>still, <00:28:27.871>um, <00:28:28.105>the, <00:28:28.338>the, <00:28:28.571>the <00:28:28.805>security

648
00:28:29.885 --> 00:28:33.705
<00:28:29.885>as <00:28:30.025>required <00:28:30.165>in <00:28:30.305>this <00:28:30.445>case <00:28:30.585>by <00:28:30.725>the <00:28:30.865>Swiss <00:28:31.004>financial <00:28:31.145>market, <00:28:31.285>um,

649
00:28:33.705 --> 00:28:35.505
<00:28:33.705>authority <00:28:34.171>that <00:28:34.638>says, <00:28:35.105>Hey,

650
00:28:35.825 --> 00:28:38.305
<00:28:35.825>whenever <00:28:35.965>you <00:28:36.105>do <00:28:36.245>changes <00:28:36.385>in <00:28:36.525>production, <00:28:36.665>you <00:28:36.805>need <00:28:36.945>to <00:28:37.085>have <00:28:37.225>this

651
00:28:38.305 --> 00:28:41.025
<00:28:38.305>and <00:28:38.460>this <00:28:38.616>and <00:28:38.771>this <00:28:38.927>person <00:28:39.082>like <00:28:39.238>sign <00:28:39.393>or <00:28:39.549>approve <00:28:39.705>it.

652
00:28:41.245 --> 00:28:45.665
<00:28:41.245>Um, <00:28:41.400>and <00:28:41.556>whether <00:28:41.711>that's <00:28:41.867>in <00:28:42.022>legal <00:28:42.178>or, <00:28:42.333>uh, <00:28:42.489>risk, <00:28:42.645>uh,

653
00:28:45.685 --> 00:28:48.625
<00:28:45.685>or <00:28:45.840>management <00:28:45.996>or, <00:28:46.151>or <00:28:46.307>whatever <00:28:46.462>their <00:28:46.618>function <00:28:46.773>might <00:28:46.929>be, <00:28:47.085>um,

654
00:28:48.775 --> 00:28:52.105
<00:28:48.775>they, <00:28:48.930>they <00:28:49.086>have <00:28:49.241>an <00:28:49.397>actual <00:28:49.552>an <00:28:49.708>an <00:28:49.863>auditable <00:28:50.019>trace <00:28:50.175>of

655
00:28:52.285 --> 00:28:53.825
<00:28:52.285>who <00:28:52.631>approved <00:28:52.978>it <00:28:53.324>and <00:28:53.671>when.

656
00:28:54.085 --> 00:28:56.665
<00:28:54.085>Um, <00:28:54.240>and <00:28:54.396>so <00:28:54.551>they <00:28:54.707>can, <00:28:54.862>you <00:28:55.018>know, <00:28:55.173>push <00:28:55.329>releases, <00:28:55.485>um,

657
00:28:56.805 --> 00:28:59.905
<00:28:56.805>and <00:28:57.005>have <00:28:57.205>the <00:28:57.405>process <00:28:57.605>triggered, <00:28:57.805>but <00:28:58.005>both <00:28:58.205>development

658
00:28:59.905 --> 00:29:01.585
<00:28:59.905>and <00:29:00.185>operations <00:29:00.465>can <00:29:00.745>see <00:29:01.024>the <00:29:01.305>process

659
00:29:01.765 --> 00:29:03.825
<00:29:01.765>and <00:29:01.998>can <00:29:02.231>see <00:29:02.465>where, <00:29:02.698>where <00:29:02.931>it's <00:29:03.165>at.

660
00:29:04.405 --> 00:29:06.945
<00:29:04.405>And <00:29:04.580>so <00:29:04.754>this <00:29:04.930>kind <00:29:05.105>of <00:29:05.280>bringing <00:29:05.455>the, <00:29:05.629>uh, <00:29:05.805>the,

661
00:29:06.965 --> 00:29:08.185
<00:29:06.965>the <00:29:07.514>agile <00:29:08.062>deployment

662
00:29:08.185 --> 00:29:11.025
<00:29:08.185>and <00:29:08.340>then <00:29:08.496>this <00:29:08.651>speed <00:29:08.807>of <00:29:08.962>deployment <00:29:09.118>into <00:29:09.273>this <00:29:09.429>very <00:29:09.585>much

663
00:29:11.255 --> 00:29:14.665
<00:29:11.255>regulated <00:29:11.455>banking <00:29:11.655>environment, <00:29:11.855>which <00:29:12.055>might <00:29:12.255>sound <00:29:12.455>as <00:29:12.655>a,

664
00:29:14.665 --> 00:29:19.205
<00:29:14.665>as <00:29:14.898>a <00:29:15.131>conflict, <00:29:15.365>of <00:29:15.598>course, <00:29:15.831>what, <00:29:16.065>why,

665
00:29:19.505 --> 00:29:20.805
<00:29:19.505>why <00:29:19.739>do <00:29:19.973>we <00:29:20.207>do <00:29:20.441>that, <00:29:20.675>right?

666
00:29:21.225 --> 00:29:24.165
<00:29:21.225>Um, <00:29:21.458>as <00:29:21.691>a <00:29:21.925>security, <00:29:22.158>uh, <00:29:22.391>person, <00:29:22.625>um,

667
00:29:24.195 --> 00:29:26.885
<00:29:24.195>traditionally <00:29:24.370>in <00:29:24.544>traditional <00:29:24.720>ID <00:29:24.895>governance <00:29:25.070>has <00:29:25.245>been <00:29:25.419>like <00:29:25.595>the

668
00:29:26.885 --> 00:29:28.365
<00:29:26.885>full <00:29:27.329>stack <00:29:27.773>audit, <00:29:28.217>right?

669
00:29:28.365 --> 00:29:31.365
<00:29:28.365>So, <00:29:28.540>uh, <00:29:28.715>review <00:29:28.890>the <00:29:29.065>design <00:29:29.240>applicant <00:29:29.415>of <00:29:29.590>the <00:29:29.765>application

670
00:29:31.825 --> 00:29:34.565
<00:29:31.825>and <00:29:32.025>then <00:29:32.225>review <00:29:32.425>each <00:29:32.625>layer <00:29:32.825>of <00:29:33.025>the <00:29:33.225>implementation.

671
00:29:34.585 --> 00:29:36.085
<00:29:34.585>So <00:29:34.922>review <00:29:35.260>the <00:29:35.597>application <00:29:35.935>code

672
00:29:36.085 --> 00:29:38.845
<00:29:36.085>or <00:29:36.285>review <00:29:36.485>the <00:29:36.685>runtime, <00:29:36.885>the, <00:29:37.085>the, <00:29:37.285>the <00:29:37.485>machine,

673
00:29:38.865 --> 00:29:41.125
<00:29:38.865>the <00:29:39.020>the <00:29:39.176>server, <00:29:39.331>how <00:29:39.487>it's <00:29:39.642>been <00:29:39.798>implemented, <00:29:39.953>is <00:29:40.109>it <00:29:40.265>hardened?

674
00:29:41.205 --> 00:29:43.085
<00:29:41.205>Is <00:29:41.438>it <00:29:41.671>accessible? <00:29:41.905>What <00:29:42.138>parts <00:29:42.371>are <00:29:42.605>accessible?

675
00:29:43.085 --> 00:29:45.205
<00:29:43.085>That <00:29:43.260>kind <00:29:43.435>of <00:29:43.610>stuff, <00:29:43.785>right? <00:29:43.960>And <00:29:44.135>of <00:29:44.310>course, <00:29:44.485>uh,

676
00:29:45.205 --> 00:29:47.245
<00:29:45.205>how <00:29:45.360>is <00:29:45.516>the <00:29:45.671>data <00:29:45.827>center <00:29:45.982>who <00:29:46.138>has <00:29:46.293>access, <00:29:46.449>physical <00:29:46.605>access

677
00:29:47.245 --> 00:29:48.765
<00:29:47.245>to <00:29:47.440>data <00:29:47.635>center, <00:29:47.831>who <00:29:48.026>can <00:29:48.222>walk <00:29:48.417>in <00:29:48.613>around

678
00:29:48.785 --> 00:29:51.765
<00:29:48.785>and <00:29:48.912>pull <00:29:49.039>out <00:29:49.166>disks, <00:29:49.294>this <00:29:49.421>kind <00:29:49.548>of, <00:29:49.675>you <00:29:49.803>know, <00:29:49.930>full <00:29:50.057>stack <00:29:50.185>audit

679
00:29:52.105 --> 00:29:55.605
<00:29:52.105>of <00:29:52.260>each <00:29:52.416>layer, <00:29:52.571>basically <00:29:52.727>of <00:29:52.882>the, <00:29:53.038>uh, <00:29:53.193>of <00:29:53.349>the <00:29:53.505>cake.

680
00:29:55.745 --> 00:29:59.845
<00:29:55.745>And <00:29:55.900>of <00:29:56.056>course, <00:29:56.211>every <00:29:56.367>year, <00:29:56.522>whatever <00:29:56.678>your <00:29:56.833>review <00:29:56.989>cycle <00:29:57.145>is,

681
00:29:59.945 --> 00:30:02.685
<00:29:59.945>you <00:30:00.072>have <00:30:00.199>to <00:30:00.326>go <00:30:00.454>and <00:30:00.581>review <00:30:00.708>each <00:30:00.835>layer <00:30:00.963>all <00:30:01.090>over <00:30:01.217>again, <00:30:01.345>right?

682
00:30:03.025 --> 00:30:04.325
<00:30:03.025>And <00:30:03.317>so <00:30:03.610>after <00:30:03.902>the <00:30:04.195>third

683
00:30:04.325 --> 00:30:06.365
<00:30:04.325>or <00:30:04.500>first <00:30:04.675>year, <00:30:04.850>you <00:30:05.025>basically <00:30:05.200>wanted <00:30:05.375>to <00:30:05.550>switch <00:30:05.725>jobs

684
00:30:06.365 --> 00:30:08.205
<00:30:06.365>because <00:30:06.598>you've <00:30:06.831>been <00:30:07.065>reviewing <00:30:07.298>the <00:30:07.531>security <00:30:07.765>data

685
00:30:08.205 --> 00:30:09.445
<00:30:08.205>center <00:30:08.484>for <00:30:08.763>the <00:30:09.042>100th <00:30:09.321>time.

686
00:30:09.845 --> 00:30:11.325
<00:30:09.845>'cause <00:30:10.035>for <00:30:10.225>each <00:30:10.415>and <00:30:10.606>every <00:30:10.796>application <00:30:10.986>you <00:30:11.177>go

687
00:30:11.325 --> 00:30:14.565
<00:30:11.325>and <00:30:11.465>review, <00:30:11.605>um, <00:30:11.745>this <00:30:11.885>kind <00:30:12.025>of, <00:30:12.165>uh, <00:30:12.305>the <00:30:12.445>full <00:30:12.585>stack, <00:30:12.725>um,

688
00:30:14.595 --> 00:30:15.765
<00:30:14.595>ever <00:30:14.858>over <00:30:15.121>and <00:30:15.384>over <00:30:15.648>again.

689
00:30:16.065 --> 00:30:17.565
<00:30:16.065>And <00:30:16.335>so <00:30:16.605>the <00:30:16.875>benefit <00:30:17.145>of, <00:30:17.415>uh,

690
00:30:17.575 --> 00:30:19.245
<00:30:17.575>cloud <00:30:17.925>native <00:30:18.275>additive <00:30:18.625>governance <00:30:18.975>is

691
00:30:19.245 --> 00:30:23.965
<00:30:19.245>that <00:30:19.385>you <00:30:19.524>can <00:30:19.665>abstract <00:30:19.804>away <00:30:19.945>also <00:30:20.084>in, <00:30:20.225>uh, <00:30:20.364>in, <00:30:20.504>in <00:30:20.645>reviewing

692
00:30:23.965 --> 00:30:26.285
<00:30:23.965>and <00:30:24.198>also <00:30:24.431>in <00:30:24.665>governance <00:30:24.898>certain <00:30:25.131>parts <00:30:25.365>away

693
00:30:26.285 --> 00:30:29.205
<00:30:26.285>because <00:30:26.485>you <00:30:26.685>can <00:30:26.885>share <00:30:27.085>them <00:30:27.285>over <00:30:27.485>multiple <00:30:27.685>applications.

694
00:30:29.625 --> 00:30:31.605
<00:30:29.625>So <00:30:29.905>by <00:30:30.185>using <00:30:30.465>the <00:30:30.745>standardized <00:30:31.025>components

695
00:30:31.945 --> 00:30:34.445
<00:30:31.945>and <00:30:32.178>whether <00:30:32.411>they <00:30:32.645>are <00:30:32.878>already <00:30:33.111>externally <00:30:33.345>certified

696
00:30:34.545 --> 00:30:37.885
<00:30:34.545>or <00:30:34.700>use <00:30:34.856>certify <00:30:35.011>them <00:30:35.167>for <00:30:35.322>your <00:30:35.478>internal <00:30:35.633>use <00:30:35.789>once, <00:30:35.945>um,

697
00:30:38.035 --> 00:30:40.325
<00:30:38.035>that <00:30:38.190>means <00:30:38.346>still <00:30:38.501>means <00:30:38.657>that <00:30:38.812>can <00:30:38.968>be <00:30:39.123>shared <00:30:39.279>over <00:30:39.435>multiple

698
00:30:40.325 --> 00:30:41.645
<00:30:40.325>applications, <00:30:40.919>for <00:30:41.513>example.

699
00:30:41.785 --> 00:30:44.965
<00:30:41.785>So <00:30:42.065>when <00:30:42.345>your, <00:30:42.625>um, <00:30:42.905>container <00:30:43.185>platform,

700
00:30:44.965 --> 00:30:46.965
<00:30:44.965>including <00:30:45.431>whatever <00:30:45.898>infrastructure <00:30:46.365>that's

701
00:30:46.965 --> 00:30:49.525
<00:30:46.965>below <00:30:47.245>it <00:30:47.524>has <00:30:47.804>already <00:30:48.084>been <00:30:48.365>accepted

702
00:30:49.625 --> 00:30:51.925
<00:30:49.625>and <00:30:49.905>certified, <00:30:50.185>you <00:30:50.465>as <00:30:50.745>a <00:30:51.025>reviewer

703
00:30:51.925 --> 00:30:55.485
<00:30:51.925>of <00:30:52.125>the <00:30:52.325>the <00:30:52.524>second <00:30:52.725>application <00:30:52.925>basically <00:30:53.125>only <00:30:53.325>have

704
00:30:55.485 --> 00:30:57.685
<00:30:55.485>to <00:30:55.685>review <00:30:55.885>the <00:30:56.084>app <00:30:56.284>application <00:30:56.485>itself, <00:30:56.685>of <00:30:56.885>course,

705
00:30:58.225 --> 00:31:00.645
<00:30:58.225>and <00:30:58.504>the <00:30:58.784>configuration <00:30:59.064>of <00:30:59.344>the <00:30:59.625>platform

706
00:31:00.645 --> 00:31:03.245
<00:31:00.645>because <00:31:00.878>everything <00:31:01.111>the <00:31:01.345>platform <00:31:01.578>will <00:31:01.811>do <00:31:02.045>can,

707
00:31:03.305 --> 00:31:04.485
<00:31:03.305>and <00:31:03.570>that <00:31:03.836>can <00:31:04.101>be <00:31:04.367>certified,

708
00:31:04.795 --> 00:31:07.205
<00:31:04.795>it's <00:31:05.075>basically <00:31:05.355>declared <00:31:05.635>in <00:31:05.915>that <00:31:06.195>configuration.

709
00:31:07.585 --> 00:31:10.405
<00:31:07.585>And <00:31:07.725>so <00:31:07.865>the <00:31:08.005>scope <00:31:08.145>of <00:31:08.285>the <00:31:08.425>review <00:31:08.565>becomes <00:31:08.705>much, <00:31:08.845>much <00:31:08.985>smaller

710
00:31:10.435 --> 00:31:14.805
<00:31:10.435>because <00:31:10.575>you <00:31:10.715>can <00:31:10.855>reuse <00:31:10.995>all <00:31:11.135>of <00:31:11.274>that, <00:31:11.415>um, <00:31:11.554>in <00:31:11.695>application <00:31:11.835>two,

711
00:31:14.905 --> 00:31:16.245
<00:31:14.905>two, <00:31:15.508>2000, <00:31:16.110>right?

712
00:31:16.505 --> 00:31:18.605
<00:31:16.505>Um, <00:31:16.680>of <00:31:16.855>course, <00:31:17.030>for <00:31:17.205>the <00:31:17.380>first <00:31:17.555>application, <00:31:17.730>you <00:31:17.905>still

713
00:31:19.285 --> 00:31:21.725
<00:31:19.285>probably <00:31:19.460>want <00:31:19.635>to <00:31:19.810>review <00:31:19.985>unless <00:31:20.160>it's <00:31:20.335>externally <00:31:20.510>certified <00:31:20.685>in

714
00:31:21.725 --> 00:31:23.685
<00:31:21.725>a <00:31:21.899>way <00:31:22.074>that <00:31:22.250>you <00:31:22.425>accept, <00:31:22.600>um, <00:31:22.774>what <00:31:22.949>you <00:31:23.125>do

715
00:31:23.685 --> 00:31:25.325
<00:31:23.685>and <00:31:23.918>whether <00:31:24.151>that's <00:31:24.385>then <00:31:24.618>a <00:31:24.851>cloud <00:31:25.085>provider

716
00:31:25.425 --> 00:31:27.965
<00:31:25.425>or <00:31:25.625>whatever <00:31:25.825>internal <00:31:26.024>infrastructure, <00:31:26.225>whether <00:31:26.425>that's <00:31:26.625>then <00:31:26.825>a,

717
00:31:28.185 --> 00:31:29.725
<00:31:28.185>uh, <00:31:28.647>container <00:31:29.109>orchestration <00:31:29.571>platform

718
00:31:29.745 --> 00:31:31.045
<00:31:29.745>or, <00:31:29.978>or <00:31:30.213>the <00:31:30.447>combination <00:31:30.681>of <00:31:30.915>that.

719
00:31:31.425 --> 00:31:34.165
<00:31:31.425>Um, <00:31:31.565>that's <00:31:31.705>of <00:31:31.845>course <00:31:31.985>something <00:31:32.125>that, <00:31:32.264>uh, <00:31:32.405>that <00:31:32.544>you <00:31:32.685>can <00:31:32.825>then,

720
00:31:34.235 --> 00:31:36.045
<00:31:34.235>then, <00:31:34.514>uh, <00:31:34.794>help <00:31:35.074>to, <00:31:35.354>to <00:31:35.635>implement.

721
00:31:36.225 --> 00:31:39.325
<00:31:36.225>And <00:31:36.380>of <00:31:36.536>course, <00:31:36.691>this <00:31:36.847>then <00:31:37.002>brings <00:31:37.158>the <00:31:37.313>benefits <00:31:37.469>of, <00:31:37.625>um,

722
00:31:39.465 --> 00:31:41.605
<00:31:39.465>for <00:31:39.665>example, <00:31:39.865>using <00:31:40.064>a <00:31:40.264>container <00:31:40.465>platform <00:31:40.665>for <00:31:40.865>that

723
00:31:41.665 --> 00:31:43.685
<00:31:41.665>of <00:31:42.014>prevent <00:31:42.365>the <00:31:42.715>configuration <00:31:43.065>drift,

724
00:31:43.685 --> 00:31:47.285
<00:31:43.685>because <00:31:43.860>everything <00:31:44.034>you <00:31:44.210>have <00:31:44.385>running <00:31:44.560>on <00:31:44.735>the <00:31:44.909>con, <00:31:45.085>um,

725
00:31:47.625 --> 00:31:50.845
<00:31:47.625>the <00:31:47.825>container <00:31:48.025>platform <00:31:48.225>is <00:31:48.425>declared <00:31:48.625>in <00:31:48.825>the <00:31:49.025>configuration

726
00:31:50.925 --> 00:31:51.925
<00:31:50.925>that <00:31:51.225>you <00:31:51.524>can <00:31:51.825>verify

727
00:31:51.925 --> 00:31:53.805
<00:31:51.925>that <00:31:52.158>it's <00:31:52.391>automatically <00:31:52.625>applied <00:31:52.858>from <00:31:53.091>the <00:31:53.325>kit.

728
00:31:53.865 --> 00:31:56.965
<00:31:53.865>So <00:31:53.992>the <00:31:54.119>GIT <00:31:54.246>is <00:31:54.374>a <00:31:54.501>single <00:31:54.628>source <00:31:54.755>of <00:31:54.883>truth <00:31:55.010>and <00:31:55.137>nobody <00:31:55.265>can

729
00:31:57.185 --> 00:31:58.525
<00:31:57.185>or <00:31:57.426>can <00:31:57.667>go <00:31:57.908>and <00:31:58.149>change <00:31:58.391>stuff,

730
00:31:58.525 --> 00:31:59.925
<00:31:58.525>but <00:31:58.735>it <00:31:58.945>will <00:31:59.155>be <00:31:59.365>overwritten <00:31:59.575>by <00:31:59.784>the

731
00:31:59.925 --> 00:32:01.485
<00:31:59.925>periodic <00:32:00.205>recheck, <00:32:00.485>stuff <00:32:00.764>like <00:32:01.044>that, <00:32:01.325>right?

732
00:32:01.625 --> 00:32:03.925
<00:32:01.625>That's <00:32:01.825>something <00:32:02.025>you <00:32:02.225>can <00:32:02.425>go <00:32:02.625>and <00:32:02.825>actively <00:32:03.025>verify.

733
00:32:04.025 --> 00:32:06.685
<00:32:04.025>So <00:32:04.152>you <00:32:04.279>don't <00:32:04.406>have <00:32:04.534>to, <00:32:04.661>you <00:32:04.788>can, <00:32:04.915>you <00:32:05.043>can <00:32:05.170>be <00:32:05.297>sure <00:32:05.425>that

734
00:32:06.685 --> 00:32:08.445
<00:32:06.685>what <00:32:06.885>is <00:32:07.085>in <00:32:07.284>git <00:32:07.485>is <00:32:07.685>what <00:32:07.885>is, <00:32:08.085>uh,

735
00:32:08.445 --> 00:32:10.045
<00:32:08.445>gonna <00:32:08.725>be <00:32:09.004>in <00:32:09.284>production <00:32:09.564>as <00:32:09.845>well.

736
00:32:10.305 --> 00:32:13.325
<00:32:10.305>Uh, <00:32:10.538>preventing <00:32:10.771>manual <00:32:11.005>errors <00:32:11.238>through <00:32:11.471>automation, <00:32:11.705>security

737
00:32:13.425 --> 00:32:17.285
<00:32:13.425>by <00:32:13.580>default, <00:32:13.736>uh, <00:32:13.891>just <00:32:14.047>checking, <00:32:14.202>scanning <00:32:14.358>all <00:32:14.513>the <00:32:14.669>images, <00:32:14.825>um,

738
00:32:17.805 --> 00:32:20.565
<00:32:17.805>checking <00:32:18.005>this <00:32:18.205>SSL <00:32:18.405>certificates <00:32:18.605>for <00:32:18.805>all <00:32:19.005>the, <00:32:19.205>um,

739
00:32:20.625 --> 00:32:21.725
<00:32:20.625>low <00:32:20.955>plans <00:32:21.284>or <00:32:21.615>endpoints.

740
00:32:21.725 --> 00:32:23.965
<00:32:21.725>That's <00:32:21.880>something <00:32:22.036>you <00:32:22.191>can <00:32:22.347>roll <00:32:22.502>out <00:32:22.658>pretty <00:32:22.813>easily <00:32:22.969>on <00:32:23.125>a

741
00:32:23.965 --> 00:32:26.245
<00:32:23.965>container <00:32:24.165>platform <00:32:24.365>that's <00:32:24.564>now <00:32:24.764>been, <00:32:24.965>you <00:32:25.165>know, <00:32:25.365>manual

742
00:32:26.765 --> 00:32:30.365
<00:32:26.765>scanning <00:32:26.892>or <00:32:27.019>that <00:32:27.146>kind <00:32:27.274>of <00:32:27.401>stuff <00:32:27.528>on <00:32:27.655>a, <00:32:27.783>on <00:32:27.910>a <00:32:28.037>non-automated <00:32:28.165>way

743
00:32:30.365 --> 00:32:33.685
<00:32:30.365>or <00:32:30.565>non, <00:32:30.765>uh, <00:32:30.965>infrastructures <00:32:31.165>code, <00:32:31.365>uh, <00:32:31.565>platform <00:32:31.765>before.

744
00:32:35.055 --> 00:32:37.475
<00:32:35.055>And <00:32:35.288>that <00:32:35.521>was <00:32:35.755>more <00:32:35.988>like <00:32:36.221>technical <00:32:36.455>benefits.

745
00:32:37.535 --> 00:32:40.205
<00:32:37.535>And <00:32:37.690>as <00:32:37.846>a <00:32:38.001>security <00:32:38.157>person, <00:32:38.312>you <00:32:38.468>of <00:32:38.623>course <00:32:38.779>also <00:32:38.935>have

746
00:32:40.205 --> 00:32:41.605
<00:32:40.205>to <00:32:40.520>care <00:32:40.835>about <00:32:41.150>other <00:32:41.465>benefits.

747
00:32:41.665 --> 00:32:44.525
<00:32:41.665>And <00:32:41.820>for <00:32:41.976>example, <00:32:42.131>whether <00:32:42.287>that's <00:32:42.442>said <00:32:42.598>in <00:32:42.753>the, <00:32:42.909>the <00:32:43.065>financial,

748
00:32:44.825 --> 00:32:47.925
<00:32:44.825>the <00:32:45.000>compliance <00:32:45.175>controlling, <00:32:45.350>uh, <00:32:45.525>benefits <00:32:45.700>that <00:32:45.875>you <00:32:46.050>can <00:32:46.225>bring

749
00:32:47.925 --> 00:32:49.365
<00:32:47.925>to, <00:32:48.249>to <00:32:48.572>the <00:32:48.897>company, <00:32:49.221>um,

750
00:32:49.455 --> 00:32:52.465
<00:32:49.455>these <00:32:49.655>are <00:32:49.855>like <00:32:50.054>even <00:32:50.254>like <00:32:50.455>on <00:32:50.655>top, <00:32:50.855>right?

751
00:32:53.085 --> 00:32:57.035
<00:32:53.085>So <00:32:53.435>this <00:32:53.785>brings <00:32:54.135>me <00:32:54.485>back

752
00:32:57.055 --> 00:32:58.595
<00:32:57.055>to <00:32:57.517>the <00:32:57.979>DevSecOps <00:32:58.441>principles.

753
00:32:58.825 --> 00:33:01.955
<00:32:58.825>I've <00:32:58.980>showed <00:32:59.136>you <00:32:59.291>a <00:32:59.447>few <00:32:59.602>examples, <00:32:59.758>uh, <00:32:59.913>both <00:33:00.069>in <00:33:00.225>tooling

754
00:33:02.135 --> 00:33:05.955
<00:33:02.135>as <00:33:02.275>also <00:33:02.415>in <00:33:02.555>in <00:33:02.695>processes <00:33:02.835>about, <00:33:02.975>um, <00:33:03.115>how <00:33:03.254>I <00:33:03.395>think, <00:33:03.535>um,

755
00:33:06.225 --> 00:33:08.875
<00:33:06.225>help <00:33:06.365>you <00:33:06.504>can <00:33:06.645>help <00:33:06.784>a <00:33:06.925>secure <00:33:07.064>professional, <00:33:07.205>you <00:33:07.344>can <00:33:07.485>help <00:33:07.625>the,

756
00:33:09.135 --> 00:33:10.555
<00:33:09.135>um, <00:33:09.561>DevOps, <00:33:09.987>uh, <00:33:10.413>process.

757
00:33:11.255 --> 00:33:14.355
<00:33:11.255>Um, <00:33:11.488>and <00:33:11.721>now <00:33:11.955>I'm <00:33:12.188>open <00:33:12.421>for <00:33:12.655>questions.