Zero to Ninety in Securing DevOps
1 like•2,568 views
The document outlines strategies for integrating DevSecOps effectively within organizations, emphasizing the importance of relationships, maturity assessment, and a culture of security. It highlights the need for defined processes, checklists, and metrics to measure success while navigating the transition from DevOps to DevSecOps. The author, J. Wolfgang Goerlich, stresses the significance of collaboration and communication to achieve security as a product throughout the development lifecycle.
Zero to Ninety in Securing DevOps
- 1. Zero to Ninety in Securing DevOps J Wolfgang Goerlich VP Strategic Programs, CBI
- 3. Developers Security It takes two years for technology to go from builders to breakers.
- 9. Are we really doing DevOps? Really?
- 10. Ad Hoc Defined Optimized Ad Hoc Defined Optimized DevOps What are our levels of maturity?
- 11. What is the CI/CD pipeline? Wait … pipelines?
- 13. Wins • Directory of people • Inventory of DevOps’d apps • Inventory of CI/CD pipelines • Stay alive (task and stress management)
- 15. Code Review SCA
- 17. Assess. Don’t audit. (No one likes auditors)
- 19. Hug a Checklist • NIST SP 800-64 Development Lifecycle • NIST SP 800-190 Container Security • ISO 27002 (Yeah, I know) • ISO 27034 Application Security • CSA Guidance 4.0 Application Security • BSIMM, SAMM Maturity
- 20. And the most important checklist of them all … the one from the Customers.
- 23. Wins • Find a champion Advisory council • Find a pilot pipeline Business case • Define a maturity model Security backlog • Still alive (task and stress management)
- 27. Create a culture of quality and security one line of code at a time
- 28. 30 90 60
- 30. Security as a Product
- 31. Security as a Product • Features: Security Requirements • Process: Borrow from DevOps • Experience: Borrow from UXD Apply industrial design principles and DevOps methods to build our product
- 32. Wins • Innovators and adopters Advisory council • Pipeline security feature Business case • Communicate roadmap Security backlog • Alive! So alive. And kicking!
- 34. DevSecOps Learn Assess Plan Follow the Money Build a Backlog Define Success Implement, Iterate
- 35. J Wolfgang Goerlich VP Strategic Programs, CBI @jwgoerlich https://jwgoerlich.com Thank you.