Security on Autopilot: Low-Touch Automated Security for Drupal Projects
Time: Thursday 14th May 14:00-14:30
Room: Waterfront
Track: Other
Security doesn't have to mean you trade time against deliverables; and if you have an incident, automated security might just save you time, money and reputation.
This talk focuses on building automated security workflows that require an upfront investment but then run quietly in the background, alerting you only when something genuinely needs attention.
It starts by explaining the core concepts of Dynamic Application Security Testing (DAST) and Static Application Security Testing (SAST) — what they are, what problems they solve, and where they fit in a modern Drupal delivery pipeline. From there, it explores real-world tools such as OWASP ZAP, Trivy and dependency analysis, with an emphasis on how they complement rather than replace each other.
The talk is deliberately practical for Drupal developers and SysOps engineers. It walks through how these tools can be wired into GitHub Actions so they run automatically on pull requests and on a scheduled basis, without slowing developers down. You'll see how to configure Trivy to scan source code, dependencies, and container images; how to automate ZAP scans against deployed environments; and how to use Dependabot or Renovate to keep Drupal core, contrib modules, and container dependencies up to date with minimal noise.
This talk focuses on building automated security workflows that require an upfront investment but then run quietly in the background, alerting you only when something genuinely needs attention.
It starts by explaining the core concepts of Dynamic Application Security Testing (DAST) and Static Application Security Testing (SAST) — what they are, what problems they solve, and where they fit in a modern Drupal delivery pipeline. From there, it explores real-world tools such as OWASP ZAP, Trivy and dependency analysis, with an emphasis on how they complement rather than replace each other.
The talk is deliberately practical for Drupal developers and SysOps engineers. It walks through how these tools can be wired into GitHub Actions so they run automatically on pull requests and on a scheduled basis, without slowing developers down. You'll see how to configure Trivy to scan source code, dependencies, and container images; how to automate ZAP scans against deployed environments; and how to use Dependabot or Renovate to keep Drupal core, contrib modules, and container dependencies up to date with minimal noise.
Speakers
Nathan ter Bogt
Nathan ter Bogt has been working with Drupal since version 4, spanning roles across development, architecture, and operations. He’s led large-scale platform work at organisations like Flight Centre, where he helped migrate a Drupal 7 multisite into reusable, Composer-driven Drupal 8 instances powering more than 20 sites.
Nathan has also worked on major government initiatives, including OneCX for the Department of Customer Service, a program consolidating hundreds of websites into a single, consistent user experience for the public. He now works in a SysOps role at Skpr, focusing on secure, scalable Drupal hosting and the automation that keeps complex platforms running smoothly.
Nathan has also worked on major government initiatives, including OneCX for the Department of Customer Service, a program consolidating hundreds of websites into a single, consistent user experience for the public. He now works in a SysOps role at Skpr, focusing on secure, scalable Drupal hosting and the automation that keeps complex platforms running smoothly.