Talk in Italian at Incontro DevOps Italia 2024
Track Name:
Sala 2
View Slides: https://github.com/PaoloL/public-speaking/blob/main/2024/IDI2024%20-%20Compliance%20as%20Code.pdf
Short URL: https://joind.in/talk/7d9ea
(QR-Code (opens in new window))
Maintaining compliance in a Cloud world requires a new approach that maximizes the balance between agility and safety. Just like we use infrastructure-as-code in infrastructure automation and approach of CI/CD in application lifecycle management, at the same time our DevSecOps teams should adopt compliance-as-code, especially in a cloud world. We can introduce compliance-as-code on the left side of the DevOps lifecycle and/or on the right side. Working on the left side we can detect issues very early in the process, but our tests are limited in scope, more related to a specific workload. On the right side, we can detect and remediate issues that would be difficult to anticipate during the building phase, we can assess the resources against requirements defined at a more high level, but the improvement requires more effort. On the left side, we can leverage general-purpose tools such as OPA - Open Policy Agent - an open-source engine incubated in the CNCF. On the right side, it's better to leverage services provided by the Cloud provider as AWS config
Comments
Please login to leave a comment
Interesting approach. I would love to see a NIS2/ DORA/ PCI/... Preset of available rule sets
Illuminante
Bravissimo speaker, contenuti molto interessanti, ottima esposizione
Bella presentazione, forse un po’ troppo calata in uno specifico contesto di piattaforma AWS
Ho trovato il Talk davvero interessante, l'argomento mi è piaciuto tantissimo. Nel periodo in cui siamo, con l'avvento di gpt le scadenze vanno via via diminuendo e se l'AI lavorasse a braccetto con questa tecnologia si potrebbe di nuovo raggiungere una nuova era dell'IT 🚀🚀
Io ho faticato molto a seguire il "senso" di questa talk, secondo me molto interessante. Avrei forse capito meglio (ma sono fatto male io, me ne rendo conto) se ci fosse stato un caso d'uso concreto (healthcare, finanza, retail) dove i requisiti di policy guidavano e facevano spiegare scelte e strumenti.
Ottimo talk, Paolo ha trattato un argomento di cui pochi parlano (la compliance nel mondo cloud) con chiarezza e semplicità, propria di uno speaker preparato e competente sulla materia. Bravo!
A brilliant presentation about a must have in management of complex Cloud environments: compliance + the right tooling to manage its lifecycle!
Really interesting and well explained!
great insights