Thread by @abhaybhargav

IMO #DevSecOps has a close-knit relationship with #ZeroTrust. Let's dive in with a 🧵

I've already tried to cover ZeroTrust as a summary here 👇2/

https://twitter.com/abhaybhargav/status/1500894571055792139?s=20&t=hKN88kKJ_OZ4st-0RDR2lQ

The way I see it, both the identity and policy aspects of ZeroTrust require/can do with a solid "shift left" approach of being able to incorporate identity and policy checks in the build/deployment flows. 3/

In fact with @OpenPolicyAgent and @osoHQ unit-tests, it becomes even easier and wayy more powerful to have super-granular authZ and policy testing early in the cycle, even in each build, etc.
Oso unit-test: docs.osohq.com/guides/more/te…
OPA unit tests: openpolicyagent.org/docs/latest/po…
4/

@OpenPolicyAgent @osoHQ This can be extended across the stack, think...
@kubernetesio authZ and policy testing with native tools, @kyverno, etc perhaps triggered as @argoproj workflows
Cloud IAM tests for things like SCPs, Permission boundaries ( @awscloud ) and similar for other cloud providers
5/

@OpenPolicyAgent @osoHQ @kubernetesio @kyverno @argoproj @awscloud Network security policy testing with @ciliumproject, @projectcalico, etc.
I am just spitballing here, but there's a great deal of (unexplored) areas that can bring the best of #DevSecOps and #ZeroTrust together. Any other areas that you can think of?

@OpenPolicyAgent @osoHQ @kubernetesio @kyverno @argoproj @awscloud @ciliumproject @projectcalico That's a wrap!

If you enjoyed this thread:

1. Follow me @abhaybhargav for more of these
2. RT the tweet below to share this thread with your audience

https://twitter.com/24335220/status/1505982099895066630