WeAreDevelopers LIVE • Oct 12, 2020

You can’t hack what you can’t see

Reto Kaeser

Traditional boundary firewalls are obsolete. Since 80% of cloud traffic is internal, perimeter breaches are devastating. Harness microsegmentation and zero trust to make workloads invisible to attackers.

Pause

Mute

Enter Fullscreen

#1 about 3 min

Evolving from siloed operations to DevOps culture

Culture plays a massive role in successful DevOps adoption beyond tooling.

#2 about 2 min

Integrating security into the DevOps lifecycle

Left-shifting security creates DevSecOps to protect modern remote workloads.

#3 about 4 min

Identifying abuse cases during requirements gathering

Addressing potential attack vectors early hardens architecture before design begins.

#4 about 2 min

Security challenges of workload abstraction in cloud environments

Containerizing and moving workloads introduces fine-grained connection risks.

#5 about 3 min

Classifying and anonymizing data during system design

Treating restricted data carefully and avoiding unnecessary context reduces exposure risk.

#6 about 4 min

Managing vulnerabilities in open-source libraries early

Catching vulnerable component versions using pre-commit hooks saves downstream remediation time.

#7 about 2 min

Leveraging continuous penetration testing via red teams

Feeding abuse cases directly to testers improves ongoing security posture.

#8 about 3 min

Protecting internal east-west traffic within networks

Shifting focus from external firewalls to safeguarding internal communications between services.

#9 about 2 min

Securing individual workloads systematically at the application layer

Moving security policies away from infrastructure to surround the data directly.

#10 about 2 min

Implementing logical firewalls to enforce microsegmentation

Defining communication restrictions workload-by-workload limits the radius of potential breaches.

#11 about 2 min

Adopting zero-trust principles and whitelisting intentions

Only allowing explicitly approved workloads to access specific services hardens environments.

#12 about 2 min

Automating firewall policies using security as code

Tagging workloads natively in code speeds up policy generation and enforcement.

#13 about 3 min

Reaping the benefits of embedded cloud workload security

Letting protection follow workloads automatically unlocks true agility and scalability.

#14 about 2 min

Staying paranoid to ensure continuous software security

Maintaining a healthy skepticism helps prioritize secure delivery in an increasingly dangerous computing landscape.

Matching moments

6:32 min

Embracing DevSecOps and automating the software development lifecycle

Mathias Tausig · LIVE

2:09 min

Shifting security left using the DevSecOps approach

Aarno Aukia · LIVE

5:25 min

Shifting left and creating internal security champion programs

Vandana Verma Sehgal · LIVE

1:53 min

Transitioning toward DevSecOps with dynamic scanning and secrets management

Christoph Ruggenthaler · LIVE

2:39 min

Shifting security testing focus toward critical application logic problems

Julian Totzek-Hallhuber

Julian Totzek-Hallhuber · World Congress 2026 Europe

2:07 min

Integrating security practices for devsecops adoption

Nevelina Aleksandrova · LIVE

More from WeAreDevelopers LIVE

Fake or News - AI Music Detectors, Translating Ancient Languages & Tiny Heads in Teslas - Eddie Jaoude thumbnail

Fake or News - AI Music Detectors, Translating Ancient Languages & Tiny Heads in Teslas - Eddie Jaoude

Chris Heilmann, Daniel Cranney

Fake or News: AI Agents Hire Each Other, Spider-Man Ads in Cars & RAM Thieves - Marc Plogas thumbnail

Fake or News: AI Agents Hire Each Other, Spider-Man Ads in Cars & RAM Thieves - Marc Plogas

Chris Heilmann, Daniel Cranney, Marc Plogas

WeAreDevelopers - Of Agents and Robots thumbnail

WeAreDevelopers - Of Agents and Robots

Chris Heilmann, Daniel Cranney, Marc Plogas

WeAreDevelopers LIVE - How DevRel Makes Tech More Human thumbnail

WeAreDevelopers LIVE - How DevRel Makes Tech More Human

Chris Heilmann, Daniel Cranney

Fake or News: Smart Glasses in Court, Medical Advice Watches & Mushroom Electonics - Jason Torres thumbnail

Fake or News: Smart Glasses in Court, Medical Advice Watches & Mushroom Electonics - Jason Torres

Chris Heilmann, Daniel Cranney

Aliens in Quarantine, Python Deprecates Loops, and AI Buys Old Books - Zbyszek Tenerowicz thumbnail

about 1 month ago

Aliens in Quarantine, Python Deprecates Loops, and AI Buys Old Books - Zbyszek Tenerowicz

Chris Heilmann, Daniel Cranney

Upcoming sessions on this topic

World Congress 2026 North America

September 25, 2026 · 15:00–17:00

Stage 12

Secure development from pull request to production with GitHub

Sam Jarvinen

Senior Solutions Engineer, GitHub

Sam Jarvinen

World Congress 2026 North America

September 24, 2026 · 16:00–18:00

Stage 11

Practical Threat Modeling for Software Developers

Mudassir Syed

Lead Security Software Engineer

Mudassir Syed

World Congress 2026 North America

September 25, 2026 · 13:30–14:00

Stage 9

On the Public Clock: Open-Source Defense When You're Not in the Club

Nicholas Muy

VP Engineering Platform and Security at Scrut.io

Nicholas Muy

World Congress 2026 North America

September 25, 2026 · 15:30–16:00

Mainstage

One Boundary for the Agentic Era

Mark Lechner

Chief Information Security Officer, Dokcer

Mark Lechner

World Congress 2026 North America

September 23, 2026 · 15:45–17:45

Stage 10

Securing the Agentic Stack: Docker Hardened Images and Supply Chain Security

Ajeet Raina

Developer Advocate, Docker

Ajeet Raina

World Congress 2026 North America

September 24, 2026 · 16:10–16:40

Stage 7

Your Threat Model Is Lying to You: Why Modeling the Design Isn’t Enough in 2026

Farshad Abasi

CEO/Founder, Eureka DevSecOps + Forward Security

Farshad Abasi

Related videos

DevSecOps culture thumbnail

World Congress 2023 • almost 3 years ago

DevSecOps culture

Ali Yazdani

Security Pitfalls for Software Engineers thumbnail

World Congress 2023 • almost 3 years ago

Security Pitfalls for Software Engineers

Jasmin Azemović

DevSecOps: Security in DevOps thumbnail

LIVE • almost 6 years ago

DevSecOps: Security in DevOps

Aarno Aukia

Securing Your Web Application Pipeline From Intruders thumbnail

LIVE • almost 6 years ago

Securing Your Web Application Pipeline From Intruders

Milecia Mcgregor

Simple Steps to Kill DevSec without Giving Up on Security thumbnail

World Congress 2025 • about 1 year ago

Simple Steps to Kill DevSec without Giving Up on Security

Isaac Evans

Why Security-First Development Helps You Ship Better Software Faster thumbnail

World Congress 2025 • about 1 year ago

Why Security-First Development Helps You Ship Better Software Faster

Michael Wildpaner

Related articles

DC

Daniel Cranney

Understanding and Mitigating Common Web Vulnerabilities

Vulnerabilities exist in many forms on the web, and attackers continue to find creative ways to exploit them. Technological advances like the proliferation of AI are of course exciting nd filled wi...

over 1 year ago

An image with neon lighting featuring a globe and a padlock

BB

Benedikt Bischof

Walking Into The Era of Supply Chain Risks

Welcome to this issue of the WeAreDevelopers Live Talk series. This article recaps an interesting talk by Vandana Verma who introduced the audience interesting topic of supply chain risks.About the...

about 4 years ago

Walking Into The Era of Supply Chain Risks

DC

Daniel Cranney

Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.

Everyone thinks CISOs make the final call on security tools. But in modern software organisations, adoption starts long before the boardroom, inside CI/CD pipelines, developer workflows, and pull r...

7 months ago

A room full of people at a tech conference

AB

Andre Braun, GitLab

Now is the time for industrialized software development

Now is the time for industrialized software development Recently, I received a letter from my car’s manufacturer alerting me to a recall. They had discovered a defective part and wanted to replace ...

about 1 year ago

A person developint HTML on a laptop with the sun shining on it.

From learning to earning

Jobs that call for the skills explored in this talk.

about 1 month ago

Staff Developer Advocate, GitHub Security Lab

Experienced $121k–323k Remote Git Github Databases

6 days ago • Verified

Senior Supply Chain Security Engineer

Expert Remote Linux Kubernetes

6 days ago • Verified

Senior Principal Software Engineer, Docker and Ecosystem

Seattle, United States

Expert Remote Cloud (AWS/Google/Azure)

about 1 month ago

Staff Hardware Security Engineer

München, Germany

€131k U-Boot Firmware System on a…

Staff Engineer, Security Engineering Partners

Expert Remote Twilio Cloud Computing Containerization

Staff Enterprise Security Engineer, AI Security

San Jose, CA, United States

Experienced $155k–194k Remote Twilio Kubernetes Google Cloud