In this session I will give the audience an overview of state of the art software security tools and methods, focused on cloud native software. We will cover the following topics in roughly this order:
- software composition analysis (SCA)
- static application security testing (SAST)
- Container Scanning
- integrating the above into CI/CD
- container runtime security
- Iac and cloud security
I will structure the whole talk like a journey from code to running application. Each concept mentioned above will be described briefly and a small real-world example will be provided. Also I will provide a collection of tools/projects for each topic to ensure it's not a marketing session. This approach should give the audience an overview of security best practices and tools in the sector.