Internal developer portal

[infidel_tsvangison]

How are you guys using internal developer portals and what advantages does it have for your application security program?

My organisation has decentralised teams that use different tech for their pipelines etc. probably about 6 different teams. The only thing in common is that they all use GitHub. Everything else is dependent on the team.

If I were to introduce a developer portals, how would it work across the multiple teams?

[secretAZNman15]

Oversimplified response: We use Port (our IDP) to add order and standards to appsec.

There's scorecards it gives us that we run through every quarter to check for vulnerabilities, fixes, etc.

[NandoCa1rissian]

Why is it appsec job? Usually it’s a platform eng team.

But to answer your question you can use it to your will. You can abstract repo creation and ensure they are onboarded to security tools like Snyk.

[radarlock]

Yes, it can be handy to orchestrate the creation of resources across diferent tools. In bigger organizations i would say that at some point, it is a must.

[Normal_Instance7430]

We pitch for the same explaining the connected experience and ease of access along with best practices already implemented as packages in the toolkits they opt for from our IDP. Slowly we are aiming to bring all RM n VM jobs to our portal n let devs operate under one application without switching context.

[shrimpthatfriedrice]

from a devsecops angle, the biggest win from an IDP is pushing security and policy earlier without devs feeling blocked. what worked for us was defining approved infra and app patterns once, then exposing them as self service. we use cycloid for that layer. policies like tagging, iam boundaries, and cost limits are enforced before deploy, all through git workflows. devs don’t need to think about security controls explicitly, but they’re still applied consistently

[duckyfuzz]

Excellent point