17:00 - 17:45
ABOUT THE SPEAKER
Matt Johnson (@metahertz) is a Developer Advocate for Bridgecrew.io, based in not-so-sunny Manchester, UK, he helps DevOps teams simplify, automate and improve their infrastructure security. Coming from a security and platform automation background, formerly at Cisco, he is excited by the disruptive power of Infrastructure as Code, container and serverless orchestration in bringing scalable, cost-effective IT to companies of all sizes, while also building awareness of the security challenges these new capabilities bring.Outside of work, he is learning to fly, and enjoys travel, aviation, rugby, steak and a growing whisky collection!
Talk: Static Analysis of Infrastructure Code Talk
Planning, provisioning, and changing infrastructure are becoming vital to rapid cloud application development. Incorporating infrastructure-as-code into software development promotes transparency and immutability and helps prevent bad configurations upstream. Just like application security, Infrastructure code can be continuously scanned for vulnerabilities and misconfigs. In this session, we cover a simple method to write, test, and maintain infrastructure frameworks like Cloudformation, Terraform and Kubernetes at scale using policy-as-code . We will go over open source projects that analyze those codes and will try to measure it's impact on an organizatinon using the OSS project: https://github.com/bridgecrewio/checkov/