Cloud Static Analysis Showdown

Part 3 of 3 in the Cloud Security and DevSecOps webcast series.

Scanning cloud Infrastructure as Code (IaC) using a static analysis tool as part of your DevOps workflows and CI?CD pipeline is a standard best practice. But, what tool should you use? Are there noticeable differences between the leading tools? In this talk we compare three of the most commonly used tools (Checkov, cfn_nag, and Terrascan) and share pros/cons to help you determine what should be in your toolchain.

Part 1 with Eric Johnson, Locking Down GitFlow with GitHub, GitLab, and Azure DevOps:
https://youtu.be/UXHL0f6XhBY

Part 2 with Ben Allen, Setting the Gold Standard - Using CI pipelines to create validated OS images: https://youtu.be/H5F--yJzUDc

This series supports SANS SEC540: Cloud Security and DevSecOps Automation course, https://www.sans.org/cyber-security-courses/cloud-security-devsecops-automation/

FREE Cloud Security Resources: www.sans.org/cloud-security and www.sans.org/free

Speaker Bio
Frank Kim (@fykim)
Frank is the Founder of ThinkSec, a security consulting and CISO advisory firm, as well as a SANS Fellow and lead for both the SANS Management and SANS Cloud Security curricula, overseeing two dozen SANS courses in the two fastest growing curricula. Previously, as CISO at the SANS Institute, Frank led the information risk function for the most trusted source of computer security training and certification in the world. Frank is also the author and instructor of MGT512: Security Leadership Essentials for Managers, MGT514: Security Strategic Planning, Policy, and Leadership, and co-author of SEC540: Cloud Security and DevOps Automation. Learn more about Frank here, https://www.sans.org/profiles/frank-kim/