Building a Secure CI/CD Pipeline with Google’s Anjali Khatri and Nitin Vashishtha

Partially Redacted: Data Privacy, Security & Compliance

DevOps is a concept that has exploded in the past few years, allowing software development teams to release software and automate the process. This decreases time to market and speeds up learning cycles. Continuous Integration and Continuous Delivery (CI/CD), automates the software delivery pipeline, continuously deploying new software releases in an automated fashion.

But when we deploy code quickly, it's imperative that we don't ignore the security aspect from the beginning. Ideally, we shift security left and incorporate it into the pipeline right from the start. This reduces software vulnerabilities and makes sure our cloud resources are configured following the best practices in terms of security.

Google Cloud Principle Architect Anjali Khatri and Google Cloud Solutions Engineer Nitin Vashishtha join the show to discuss DevOps, DevSecOps, the shift left movement, and how to use Google Cloud to create a secure CI/CD pipeline.

Topics:

• How has the cloud changed the way people need to think about architecting secure systems?
• How does the scale of cloud potentially impact the scale of a security or privacy issue?
• What is DevOps?
• Why is this area so hot right now?
• What problems has the DevOps movement helped solve that were traditionally difficult or impossible to address?
• How does the Shift Left movement for security relate to what’s happening in DevOps?
• What is DevSecOps?
• How does DevSecOps fit into a company’s overall security and privacy program and strategy?
• When it comes to things like CI/CD, what are the common mistakes people can make when it comes to security, privacy, or compliance?
• Cloud Build is a serverless CI/CD platform, why do I need something beyond this to automate my pipeline?
• What other Cloud tools and components should I be using to make sure my CI/CD system is not only able to support my team’s day to day development but is actually secure?
• Can you talk about Artifact Registry and what that product means in terms of security?
• How does Cloud’s Binary Authorization system work? Why would I use it and how does that improve my security posture?
• Does the addition of security as part of say my CI/CD pipeline impact performance in a meaningful way?
• Can you walk me through what the CI/CD process looks like using the combination of Cloud tools and resources?
• How much knowledge and experience do I need to set this up?
• How does a combination of tools like this play with configuring Cloud resources directly within the Google Cloud Console?
• Are there Cloud products that help me lock down my source code?
• Are there Cloud products that automatically scan my code for security or privacy vulnerabilities?
• What are your thoughts on the future of cloud security?
• Are there technologies in this space that you are particularly excited about?
• Where should someone looking to learn more DevSecOps and cloud security?

Resources:

• Building a secure CI/CD pipeline using Google Cloud built-in services
• Introducing Google Cloud's new Assured Open Source Software Service
• Software Delivery Shield overview
• Cloud Workstations
• Identity & Security
• Google Cloud Security Best Practices