SlideShare a Scribd company logo

Keeping The Auditor Away: DevOps Audit Compliance Case Studies

•Download as PPTX, PDF•
•
Gene Kim
Gene Kim

GenOrganizations and development teams are moving beyond waterfall models to those embracing a continuous delivery/DevOps-style set of processes. The deployment of doing tens, hundreds, or even thousands of deploys per day as 'normal' does not align to the SDLC, separation of duties, and common controls expected by auditors. In this presentation, we will describe what auditors look for in a compliance audit, how to develop alternate control procedures that fulfill those reporting requirements, how to avoid “red flags” that indicate inadequate controls, and real world case studies and reporting artifacts. Gene Kim has been studying high performing IT organizations since 1999 and helped develop the SOX scoping guidelines with the Institute of Internal Auditors in 2005. James DeLuccia IV is the leader for the Ernst & Young Americas Certification Services, James oversees all of the audits against common industry standards, and champions several global program implementation roll-outs. Developing and 'translating' the control environment behaviors of clients, such as Google, Amazon, Workday, and others is difficult. This discussion will bridge the needs of auditors with the community of developers by sharing examples, discussing the assurance expectations, and how to communicate to pass an audit.

Technology
1 of 43
@RealGeneKim @jdeluccia Session ID: Gene Kim James DeLuccia Keeping The Auditor Away: DevOps Audit Compliance Case Studies
@RealGeneKim @jdeluccia OMG. Developers Deploying Code?!?
@RealGeneKim @jdeluccia Introductions Gene Kim ▪ Co-author of "The Phoenix Project” ▪ Founder and CTO of Tripwire, Inc. for 13 years ▪ Worked with Jez Humble (co-author of “Continuous Delivery book) to benchmark 14K technology organizations ▪ Co-chaired SOX-404 Scoping Committee at the Institute of Internal Auditors (2005) James DeLuccia ▪ Author, “IT Compliance & Controls” ▪ Ernst & Young, leader for Americas Certification & Compliance Services ▪ Focus: startups, technology, governance, security ▪ Patent holder - crypto privacy comparison system
@RealGeneKim @jdeluccia Golly, Why Are You Attending This Talk? ▪ How many people have to deal with compliance? ▪ On a scale of 1-10, how painful are your interactions with auditors? (1=delightful, 10=awful beyond words?)
@RealGeneKim @jdeluccia Problem Statement Gene ● DevOps and continuous delivery introduce problems with audit, because the work patterns are so different than traditional SDLC ● Agile also had issues (e.g., testing at end of project, requirements phase at the beginning), but is not as radical as DevOps ○ tens/hundreds of deploys/day (change is risk; can’t rely on change approvals, separation of duty) ● No widespread agreement on what DevOps control requirements should look like James ● Auditors must work off a mature and testable environment ● They must stake their livelihood that what you say is correct, completely ● A partnership is needed between you and them to ensure such an environment exists (of course, it also needs to operate and be amazing .. but that is another talk)
@RealGeneKim @jdeluccia Agenda ▪ The Top-Down, Risk Based Audit Process ▪ What Goes Wrong ▪Scoping ▪Control Testing ▪ Scenarios From The DevOps Audit Defense Toolkit ▪ Ask An Auditor Anything!
@RealGeneKim @jdeluccia The DevOps Audit Defense Toolkit http://bit.ly/DevOpsAudit James DeLuccia IV Jeff Gallimore Gene Kim Byron Miller
@RealGeneKim @jdeluccia What Is Audit ▪ Management is defined as those who are there to achieve the goals of the organizations, which includes the officers of the company (e.g., CEO, CFO, etc.), executives and managers, as well as everyone who reports to them. ▪ Includes some board of directors, GRC departments ▪ Audit is defined to be the function inside the organization that resides outside of management to serve as an independent, objective source of assurance that the organization can achieve its goals. ▪ Includes internal auditors, external auditors (regulators, assessors, etc.)
@RealGeneKim @jdeluccia Internal Controls “a process, effected by an organization’s board of directors, management, and other personnel, designed to provide reasonable assurance regarding the achievement of objectives related to operations, reporting, and compliance.” - Operations (effectiveness, efficiency) - Financial Reporting (accuracy of account balances and values) - Compliance (with relevant laws and regulations, contractual obligations: PCI DSS, US Export Law, FEDRAMP, SOC-2) Source: http://coso.org (Committee of Sponsoring Organizations for the Commission on Fraudulent Financial Reporting)
@RealGeneKim @jdeluccia How Audit Plans Are Built And Run ▪ Business objectives ▪ Risks ▪ Control objectives ▪ Control procedures Unfortunately, most contact with auditors start with control procedures… It’s totally appropriate to ask to show work and start from beginning...
@RealGeneKim @jdeluccia The Audit Cycle ▪ Planning ▪ Gaining an understanding of the organization ▪ Scoping ▪ Sampling, reporting period, types of evidence needed, recipient of report ▪ Schedule ▪ Fieldwork ▪ Controls testing ▪ Substantive testing ▪ Reporting ▪ Management responses ▪ Attestation by auditor and delivered to regulator/clients
@RealGeneKim @jdeluccia When Scoping Goes Wrong
@RealGeneKim @jdeluccia When Scoping Goes Wrong ▪ 2001: Enron fails ($63B market cap), Arthur Andersen dissolution ▪ 2002: WorldCom (peak $117B market cap) ▪ Leads to Sarbanes-Oxley Act of 2002
@RealGeneKim @jdeluccia When Scoping Goes Wrong Source: KPMG
@RealGeneKim @jdeluccia Problem: Bottom Up Auditing Source: ISACA
@RealGeneKim @jdeluccia Analysis: Audit control testing work was scoped properly, linking controls to compliance objectives and risk. Control failures must result potentially undetected material financial reporting errors The Problem: Improperly Scoped Audits
@RealGeneKim @jdeluccia Financial Reporting Material Weakness What happens when an audit generates a material weakness?
@RealGeneKim @jdeluccia Under-Scoping Operating Risk
@RealGeneKim @jdeluccia ▪ When we don’t understand why we are being audited ▪ “Why are we doing this audit?” (customers, SOX, regulatory; who is it for?) ▪ When we are asked for something we don’t have (e.g., “evidence of SoD or change approvals) ▪ “What is the control objective? Can we rewrite the control procedure for this asset?” ▪ Do this before the auditor shows up When Auditors Attack Unexpectedly These are delicate conversations, with potentially large impacts on scope, cost, risk...
@RealGeneKim @jdeluccia ▪ If we are reacting to these conversations before we’ve done any of our homework, we may be trouble ▪ Extra work (average time to respond to audit is 40 hours; that’s one Dev sprint) ▪ Audit cost and schedule overages: a 3 hour audit test just turned into a 16 hour audit project ▪ Reduced confidence from auditors, increased visibility from audit and management When Auditors Attack Unexpectedly The DevOps Audit Defense Toolkit
@RealGeneKim @jdeluccia The DevOps Audit Defense Toolkit http://bit.ly/DevOpsAudit James DeLuccia IV Jeff Gallimore Gene Kim Byron Miller
@RealGeneKim @jdeluccia Practice: Enabling A Shared Understanding Source: DevOps Audit Defense Toolkit http://bit.ly/DevOpsAudit
@RealGeneKim @jdeluccia Practice: Enabling A Shared Understanding Source: DevOps Audit Defense Toolkit http://bit.ly/DevOpsAudit
@RealGeneKim @jdeluccia Practice: Enabling A Shared Understanding Source: DevOps Audit Defense Toolkit http://bit.ly/DevOpsAudit
@RealGeneKim @jdeluccia Walk Through Of DevOps Risk And Control Strategies What does an effective DevOps control environment look like?
@RealGeneKim @jdeluccia DevOps Orgs Actually Love Process “Facebook values people, tools, and way, way down the list is process.” Jay Parikh VP Infrastructure Engineering, Facebook Not true! They are conflating “process” and “approvals!”
@RealGeneKim @jdeluccia High Performing DevOps Orgs Source: 2014 Puppet Labs State Of DevOps 30xmore frequent deployments 8,000xfaster lead times than their peers
@RealGeneKim @jdeluccia High Performing DevOps Orgs Source: 2014 Puppet Labs State Of DevOps 2xhigher change success rates 12xfaster mean time to recover (MTTR)
@RealGeneKim @jdeluccia High Performing DevOps Orgs Source: 2014 Puppet Labs State Of DevOps more likely to exceed profitability, market share & productivity goals 2x higher market capitalization growth over 3 years* 50%
@RealGeneKim @jdeluccia Top Predictors Of Performance ▪ Version control of all production artifacts ▪ Continuous integration and deployment ▪ Automated acceptance testing ▪ Peer-review of production changes (vs. external change approval) ▪ High trust culture ▪ Proactive monitoring of the production environment ▪ Win-win relationship between Dev and Ops
@RealGeneKim @jdeluccia DevOps Orgs Need Hardcopy DevOps has higher automation and closer monitoring controls than traditional deployment environments and therefore reduced points for human failure The documentation of ephemeral systems, tools, and deployment processes into a hardcopy breakdown will communicate and simplify this management long term.
@RealGeneKim @jdeluccia Practice: Document Risks & Control Strategy Source: DevOps Audit Defense Toolkit http://bit.ly/DevOpsAudit
@RealGeneKim @jdeluccia Practice: Document Control Strategy Source: DevOps Audit Defense Toolkit http://bit.ly/DevOpsAudit
@RealGeneKim @jdeluccia Practice: Document Control Strategy Source: DevOps Audit Defense Toolkit http://bit.ly/DevOpsAudit
@RealGeneKim @jdeluccia Practice: Document Control Strategy Source: DevOps Audit Defense Toolkit http://bit.ly/DevOpsAudit
@RealGeneKim @jdeluccia ▪ Gained an understanding of the organization and its objectives ▪ Understood how our service fits in and where we jeopardize those objectives ▪ Designed and documented our control environment so that auditors can share our understanding ▪ Enable auditors to do their work effectively What We Have Done
@RealGeneKim @jdeluccia ▪ Save the date: October 21-23, 2014 ▪ DevOps Enterprise is a conference for horses, by horses ▪ Macy’s, Disney, GE Capital, Blackboard, Telstra, US Citizen and Immigration Services, CSG, Raytheon, Ticketmaster/LiveNation, Capital One, Nordstrom, Union Bank of California ▪ Leaders driving DevOps transformations will talk about ▪ The business problem they set out to solve ▪ The obstacles they had to overcome ▪ The business value they created ▪ Submit talks at: http://devopsenterprisesummit.com/ DevOps Enterprise Summit
@RealGeneKim @jdeluccia ▪ We don’t need to wait for auditors to learn about DevOps -- by learning about audit, we can successfully bridge the gap ▪ DevOps control environments can be even more secure than traditional control environments ▪ The DevOps Audit Defense Toolkit might be able to help you! http://bit.ly/DevOpsAudit ▪ We’d love your scrutiny and case studies! ▪ DevOps Enterprise Summit: http://devopsenterprise.io ▪ Emailing us: genek@realgenekim.me, jdeluccia@gmail.com Conclusion
@RealGeneKim @jdeluccia Ask An Auditor Anything! ▪ Ask the Auditor and the audience anything: ▪ Separation of Duties? ▪ Security beyond checkboxes and non-contextual requirements? ▪ Governance effects of DevOps and/or Agile? ▪ Integration and dialogues and timing with Management, Auditors, and the effect? ▪ Ask Gene on practical examples ▪ Questions for the audience: ▪ Are you using ISO 27034 as a reference architecture?
@RealGeneKim @jdeluccia Results Of Halving Deployment Interval
@RealGeneKim @jdeluccia Results Of Halving Deployment Interval And customers got the feature in half the time! Source: Scott Prugh, CSG
@RealGeneKim @jdeluccia Results Of Halving Deployment Interval Source: Scott Prugh, CSG
@RealGeneKim @jdeluccia Call to Action ● We're looking for case studies ○ Rough life lessons and smooth successes ○ Submit to: ■ DevOps Audit Defense Toolkit: Google+ Community: http://bit.ly/DevOpsAudit ● Look at the DevOps Audit Defense Toolkit ● DevOps Enterprise Summit ○ http://devopsenterprise.io/

Recommended

Red Team Framework
Red Team FrameworkRed Team Framework
Red Team Framework👀 Joe Gray
 
Vulnerabilities in modern web applications
Vulnerabilities in modern web applicationsVulnerabilities in modern web applications
Vulnerabilities in modern web applicationsNiyas Nazar
 
Introduction to Vault
Introduction to VaultIntroduction to Vault
Introduction to VaultKnoldus Inc.
 
Credential store using HashiCorp Vault
Credential store using HashiCorp VaultCredential store using HashiCorp Vault
Credential store using HashiCorp VaultMayank Patel
 
State of the ATTACK
State of the ATTACKState of the ATTACK
State of the ATTACKMITRE - ATT&CKcon
 
OWASP Secure Coding
OWASP Secure CodingOWASP Secure Coding
OWASP Secure Codingbilcorry
 
Secure by Design - Security Design Principles for the Rest of Us
Secure by Design - Security Design Principles for the Rest of UsSecure by Design - Security Design Principles for the Rest of Us
Secure by Design - Security Design Principles for the Rest of UsEoin Woods
 
Red Team Apocalypse
Red Team ApocalypseRed Team Apocalypse
Red Team ApocalypseBeau Bullock
 

Recommended

Red Team Framework
Red Team FrameworkRed Team Framework
Red Team Framework👀 Joe Gray
 
Vulnerabilities in modern web applications
Vulnerabilities in modern web applicationsVulnerabilities in modern web applications
Vulnerabilities in modern web applicationsNiyas Nazar
 
Introduction to Vault
Introduction to VaultIntroduction to Vault
Introduction to VaultKnoldus Inc.
 
Credential store using HashiCorp Vault
Credential store using HashiCorp VaultCredential store using HashiCorp Vault
Credential store using HashiCorp VaultMayank Patel
 
State of the ATTACK
State of the ATTACKState of the ATTACK
State of the ATTACKMITRE - ATT&CKcon
 
OWASP Secure Coding
OWASP Secure CodingOWASP Secure Coding
OWASP Secure Codingbilcorry
 
Secure by Design - Security Design Principles for the Rest of Us
Secure by Design - Security Design Principles for the Rest of UsSecure by Design - Security Design Principles for the Rest of Us
Secure by Design - Security Design Principles for the Rest of UsEoin Woods
 
Red Team Apocalypse
Red Team ApocalypseRed Team Apocalypse
Red Team ApocalypseBeau Bullock
 
Application Threat Modeling
Application Threat ModelingApplication Threat Modeling
Application Threat ModelingMarco Morana
 
SOC Certification Runbook Template
SOC Certification Runbook TemplateSOC Certification Runbook Template
SOC Certification Runbook TemplateMark S. Mahre
 
Agile & Secure SDLC
Agile & Secure SDLCAgile & Secure SDLC
Agile & Secure SDLCPaul Yang
 
Endpoint Security & Why It Matters!
Endpoint Security & Why It Matters!Endpoint Security & Why It Matters!
Endpoint Security & Why It Matters!Net at Work
 
How to Use OWASP Security Logging
How to Use OWASP Security LoggingHow to Use OWASP Security Logging
How to Use OWASP Security LoggingMilton Smith
 
Crisis Management Techniques for Cyber Attacks
Crisis Management Techniques for Cyber AttacksCrisis Management Techniques for Cyber Attacks
Crisis Management Techniques for Cyber AttacksPECB
 
No Easy Breach DerbyCon 2016
No Easy Breach DerbyCon 2016No Easy Breach DerbyCon 2016
No Easy Breach DerbyCon 2016Matthew Dunwoody
 
SAST vs. DAST: What’s the Best Method For Application Security Testing?
SAST vs. DAST: What’s the Best Method For Application Security Testing?SAST vs. DAST: What’s the Best Method For Application Security Testing?
SAST vs. DAST: What’s the Best Method For Application Security Testing?Cigital
 
Security testing
Security testingSecurity testing
Security testingTabăra de Testare
 
AppSec & DevSecOps Metrics: Key Performance Indicators (KPIs) to Measure Success
AppSec & DevSecOps Metrics: Key Performance Indicators (KPIs) to Measure SuccessAppSec & DevSecOps Metrics: Key Performance Indicators (KPIs) to Measure Success
AppSec & DevSecOps Metrics: Key Performance Indicators (KPIs) to Measure SuccessRobert Grupe, CSSLP CISSP PE PMP
 
Identity and Access Management 101
Identity and Access Management 101Identity and Access Management 101
Identity and Access Management 101Jerod Brennen
 
Gap Survey, Assessment and Analysis for DevSecOps
Gap Survey, Assessment and Analysis for DevSecOpsGap Survey, Assessment and Analysis for DevSecOps
Gap Survey, Assessment and Analysis for DevSecOpsMarc Hornbeek
 
Cyberark training ppt
Cyberark training pptCyberark training ppt
Cyberark training pptAkhil Kumar
 
DevSecOps reference architectures 2018
DevSecOps reference architectures 2018DevSecOps reference architectures 2018
DevSecOps reference architectures 2018Sonatype
 
Fantastic Red Team Attacks and How to Find Them
Fantastic Red Team Attacks and How to Find ThemFantastic Red Team Attacks and How to Find Them
Fantastic Red Team Attacks and How to Find ThemRoss Wolf
 
How MITRE ATT&CK helps security operations
How MITRE ATT&CK helps security operationsHow MITRE ATT&CK helps security operations
How MITRE ATT&CK helps security operationsSergey Soldatov
 
Penetration testing
Penetration testingPenetration testing
Penetration testingAmmar WK
 
Security Exploit of Business Logic Flaws, Business Logic Attacks
Security Exploit of Business Logic Flaws, Business Logic AttacksSecurity Exploit of Business Logic Flaws, Business Logic Attacks
Security Exploit of Business Logic Flaws, Business Logic AttacksMarco Morana
 
Security DevOps - Staying secure in agile projects // OWASP AppSecEU 2015 - A...
Security DevOps - Staying secure in agile projects // OWASP AppSecEU 2015 - A...Security DevOps - Staying secure in agile projects // OWASP AppSecEU 2015 - A...
Security DevOps - Staying secure in agile projects // OWASP AppSecEU 2015 - A...Christian Schneider
 
VAPT - Vulnerability Assessment & Penetration Testing
VAPT - Vulnerability Assessment & Penetration Testing VAPT - Vulnerability Assessment & Penetration Testing
VAPT - Vulnerability Assessment & Penetration Testing Netpluz Asia Pte Ltd
 
Leading A DevOps Transformation: Lessons Learned
Leading A DevOps Transformation: Lessons LearnedLeading A DevOps Transformation: Lessons Learned
Leading A DevOps Transformation: Lessons LearnedGene Kim
 
2014 State Of DevOps Findings! Velocity Conference
2014 State Of DevOps Findings! Velocity Conference2014 State Of DevOps Findings! Velocity Conference
2014 State Of DevOps Findings! Velocity ConferenceGene Kim
 

More Related Content

What's hot

Application Threat Modeling
Application Threat ModelingApplication Threat Modeling
Application Threat ModelingMarco Morana
 
SOC Certification Runbook Template
SOC Certification Runbook TemplateSOC Certification Runbook Template
SOC Certification Runbook TemplateMark S. Mahre
 
Agile & Secure SDLC
Agile & Secure SDLCAgile & Secure SDLC
Agile & Secure SDLCPaul Yang
 
Endpoint Security & Why It Matters!
Endpoint Security & Why It Matters!Endpoint Security & Why It Matters!
Endpoint Security & Why It Matters!Net at Work
 
How to Use OWASP Security Logging
How to Use OWASP Security LoggingHow to Use OWASP Security Logging
How to Use OWASP Security LoggingMilton Smith
 
Crisis Management Techniques for Cyber Attacks
Crisis Management Techniques for Cyber AttacksCrisis Management Techniques for Cyber Attacks
Crisis Management Techniques for Cyber AttacksPECB
 
No Easy Breach DerbyCon 2016
No Easy Breach DerbyCon 2016No Easy Breach DerbyCon 2016
No Easy Breach DerbyCon 2016Matthew Dunwoody
 
SAST vs. DAST: What’s the Best Method For Application Security Testing?
SAST vs. DAST: What’s the Best Method For Application Security Testing?SAST vs. DAST: What’s the Best Method For Application Security Testing?
SAST vs. DAST: What’s the Best Method For Application Security Testing?Cigital
 
AppSec & DevSecOps Metrics: Key Performance Indicators (KPIs) to Measure Success
AppSec & DevSecOps Metrics: Key Performance Indicators (KPIs) to Measure SuccessAppSec & DevSecOps Metrics: Key Performance Indicators (KPIs) to Measure Success
AppSec & DevSecOps Metrics: Key Performance Indicators (KPIs) to Measure SuccessRobert Grupe, CSSLP CISSP PE PMP
 
Identity and Access Management 101
Identity and Access Management 101Identity and Access Management 101
Identity and Access Management 101Jerod Brennen
 
Gap Survey, Assessment and Analysis for DevSecOps
Gap Survey, Assessment and Analysis for DevSecOpsGap Survey, Assessment and Analysis for DevSecOps
Gap Survey, Assessment and Analysis for DevSecOpsMarc Hornbeek
 
Cyberark training ppt
Cyberark training pptCyberark training ppt
Cyberark training pptAkhil Kumar
 
DevSecOps reference architectures 2018
DevSecOps reference architectures 2018DevSecOps reference architectures 2018
DevSecOps reference architectures 2018Sonatype
 
Fantastic Red Team Attacks and How to Find Them
Fantastic Red Team Attacks and How to Find ThemFantastic Red Team Attacks and How to Find Them
Fantastic Red Team Attacks and How to Find ThemRoss Wolf
 
How MITRE ATT&CK helps security operations
How MITRE ATT&CK helps security operationsHow MITRE ATT&CK helps security operations
How MITRE ATT&CK helps security operationsSergey Soldatov
 
Penetration testing
Penetration testingPenetration testing
Penetration testingAmmar WK
 
Security Exploit of Business Logic Flaws, Business Logic Attacks
Security Exploit of Business Logic Flaws, Business Logic AttacksSecurity Exploit of Business Logic Flaws, Business Logic Attacks
Security Exploit of Business Logic Flaws, Business Logic AttacksMarco Morana
 
Security DevOps - Staying secure in agile projects // OWASP AppSecEU 2015 - A...
Security DevOps - Staying secure in agile projects // OWASP AppSecEU 2015 - A...Security DevOps - Staying secure in agile projects // OWASP AppSecEU 2015 - A...
Security DevOps - Staying secure in agile projects // OWASP AppSecEU 2015 - A...Christian Schneider
 
VAPT - Vulnerability Assessment & Penetration Testing
VAPT - Vulnerability Assessment & Penetration Testing VAPT - Vulnerability Assessment & Penetration Testing
VAPT - Vulnerability Assessment & Penetration Testing Netpluz Asia Pte Ltd
 

What's hot (20)

Application Threat Modeling
Application Threat ModelingApplication Threat Modeling
Application Threat Modeling
 
SOC Certification Runbook Template
SOC Certification Runbook TemplateSOC Certification Runbook Template
SOC Certification Runbook Template
 
Agile & Secure SDLC
Agile & Secure SDLCAgile & Secure SDLC
Agile & Secure SDLC
 
Endpoint Security & Why It Matters!
Endpoint Security & Why It Matters!Endpoint Security & Why It Matters!
Endpoint Security & Why It Matters!
 
How to Use OWASP Security Logging
How to Use OWASP Security LoggingHow to Use OWASP Security Logging
How to Use OWASP Security Logging
 
Crisis Management Techniques for Cyber Attacks
Crisis Management Techniques for Cyber AttacksCrisis Management Techniques for Cyber Attacks
Crisis Management Techniques for Cyber Attacks
 
No Easy Breach DerbyCon 2016
No Easy Breach DerbyCon 2016No Easy Breach DerbyCon 2016
No Easy Breach DerbyCon 2016
 
SAST vs. DAST: What’s the Best Method For Application Security Testing?
SAST vs. DAST: What’s the Best Method For Application Security Testing?SAST vs. DAST: What’s the Best Method For Application Security Testing?
SAST vs. DAST: What’s the Best Method For Application Security Testing?
 
Security testing
Security testingSecurity testing
Security testing
 
AppSec & DevSecOps Metrics: Key Performance Indicators (KPIs) to Measure Success
AppSec & DevSecOps Metrics: Key Performance Indicators (KPIs) to Measure SuccessAppSec & DevSecOps Metrics: Key Performance Indicators (KPIs) to Measure Success
AppSec & DevSecOps Metrics: Key Performance Indicators (KPIs) to Measure Success
 
Identity and Access Management 101
Identity and Access Management 101Identity and Access Management 101
Identity and Access Management 101
 
Gap Survey, Assessment and Analysis for DevSecOps
Gap Survey, Assessment and Analysis for DevSecOpsGap Survey, Assessment and Analysis for DevSecOps
Gap Survey, Assessment and Analysis for DevSecOps
 
Cyberark training ppt
Cyberark training pptCyberark training ppt
Cyberark training ppt
 
DevSecOps reference architectures 2018
DevSecOps reference architectures 2018DevSecOps reference architectures 2018
DevSecOps reference architectures 2018
 
Fantastic Red Team Attacks and How to Find Them
Fantastic Red Team Attacks and How to Find ThemFantastic Red Team Attacks and How to Find Them
Fantastic Red Team Attacks and How to Find Them
 
How MITRE ATT&CK helps security operations
How MITRE ATT&CK helps security operationsHow MITRE ATT&CK helps security operations
How MITRE ATT&CK helps security operations
 
Penetration testing
Penetration testingPenetration testing
Penetration testing
 
Security Exploit of Business Logic Flaws, Business Logic Attacks
Security Exploit of Business Logic Flaws, Business Logic AttacksSecurity Exploit of Business Logic Flaws, Business Logic Attacks
Security Exploit of Business Logic Flaws, Business Logic Attacks
 
Security DevOps - Staying secure in agile projects // OWASP AppSecEU 2015 - A...
Security DevOps - Staying secure in agile projects // OWASP AppSecEU 2015 - A...Security DevOps - Staying secure in agile projects // OWASP AppSecEU 2015 - A...
Security DevOps - Staying secure in agile projects // OWASP AppSecEU 2015 - A...
 
VAPT - Vulnerability Assessment & Penetration Testing
VAPT - Vulnerability Assessment & Penetration Testing VAPT - Vulnerability Assessment & Penetration Testing
VAPT - Vulnerability Assessment & Penetration Testing
 

Viewers also liked

Leading A DevOps Transformation: Lessons Learned
Leading A DevOps Transformation: Lessons LearnedLeading A DevOps Transformation: Lessons Learned
Leading A DevOps Transformation: Lessons LearnedGene Kim
 
2014 State Of DevOps Findings! Velocity Conference
2014 State Of DevOps Findings! Velocity Conference2014 State Of DevOps Findings! Velocity Conference
2014 State Of DevOps Findings! Velocity ConferenceGene Kim
 
DevOps: Who Will Create $2.6 Trillion In Business Value Per Year?
DevOps: Who Will Create $2.6 Trillion In Business Value Per Year?DevOps: Who Will Create $2.6 Trillion In Business Value Per Year?
DevOps: Who Will Create $2.6 Trillion In Business Value Per Year?Gene Kim
 
2013 Velocity DevOps Metrics -- It's Not Just For WebOps Any More!
2013 Velocity DevOps Metrics -- It's Not Just For WebOps Any More!2013 Velocity DevOps Metrics -- It's Not Just For WebOps Any More!
2013 Velocity DevOps Metrics -- It's Not Just For WebOps Any More!Gene Kim
 
Why Everyone Needs DevOps Now: 15 Year Study Of High Performing Technology Orgs
Why Everyone Needs DevOps Now: 15 Year Study Of High Performing Technology OrgsWhy Everyone Needs DevOps Now: 15 Year Study Of High Performing Technology Orgs
Why Everyone Needs DevOps Now: 15 Year Study Of High Performing Technology OrgsGene Kim
 
CampDevOps keynote - DevOps: Using 'Lean' to eliminate Bottlenecks
CampDevOps keynote - DevOps: Using 'Lean' to eliminate BottlenecksCampDevOps keynote - DevOps: Using 'Lean' to eliminate Bottlenecks
CampDevOps keynote - DevOps: Using 'Lean' to eliminate BottlenecksSanjeev Sharma
 
2012 Velocity London: DevOps Patterns Distilled
2012 Velocity London: DevOps Patterns Distilled2012 Velocity London: DevOps Patterns Distilled
2012 Velocity London: DevOps Patterns DistilledGene Kim
 
Project controller performance appraisal
Project controller performance appraisalProject controller performance appraisal
Project controller performance appraisalanniejenny66
 
Don't be Afraid of Scary Code Webcast
Don't be Afraid of Scary Code WebcastDon't be Afraid of Scary Code Webcast
Don't be Afraid of Scary Code WebcastCompuware
 
Modern Interface to Mainframe - The Compuware Workbench (B. Ebner)
Modern Interface to Mainframe - The Compuware Workbench (B. Ebner)Modern Interface to Mainframe - The Compuware Workbench (B. Ebner)
Modern Interface to Mainframe - The Compuware Workbench (B. Ebner)NRB
 
Continuous delivery with Jenkins, Docker and Mesos/Marathon - jbcnconf
Continuous delivery with Jenkins, Docker and Mesos/Marathon - jbcnconfContinuous delivery with Jenkins, Docker and Mesos/Marathon - jbcnconf
Continuous delivery with Jenkins, Docker and Mesos/Marathon - jbcnconfJulia Mateo
 
A Customer's Journey to Mainstreaming the Mainframe Webcast On-demand Replay
A Customer's Journey to Mainstreaming the Mainframe Webcast On-demand ReplayA Customer's Journey to Mainstreaming the Mainframe Webcast On-demand Replay
A Customer's Journey to Mainstreaming the Mainframe Webcast On-demand ReplayCompuware
 
Leadership Styles Your Team Needs
Leadership Styles Your Team NeedsLeadership Styles Your Team Needs
Leadership Styles Your Team NeedsJoshua Howard
 
Startup Metrics for Pirates (KAUST, Nov 2013)
Startup Metrics for Pirates (KAUST, Nov 2013)Startup Metrics for Pirates (KAUST, Nov 2013)
Startup Metrics for Pirates (KAUST, Nov 2013)Dave McClure
 
Jesse Robbins Keynote - Hacking Culture @ Cloud Expo Europe 2013
Jesse Robbins Keynote - Hacking Culture @ Cloud Expo Europe 2013Jesse Robbins Keynote - Hacking Culture @ Cloud Expo Europe 2013
Jesse Robbins Keynote - Hacking Culture @ Cloud Expo Europe 2013Jesse Robbins
 
Doors, Walls and Old Trees: Prioritizing to Get Simple
Doors, Walls and Old Trees: Prioritizing to Get SimpleDoors, Walls and Old Trees: Prioritizing to Get Simple
Doors, Walls and Old Trees: Prioritizing to Get SimpleJason Ulaszek
 

Viewers also liked (20)

Leading A DevOps Transformation: Lessons Learned
Leading A DevOps Transformation: Lessons LearnedLeading A DevOps Transformation: Lessons Learned
Leading A DevOps Transformation: Lessons Learned
 
2014 State Of DevOps Findings! Velocity Conference
2014 State Of DevOps Findings! Velocity Conference2014 State Of DevOps Findings! Velocity Conference
2014 State Of DevOps Findings! Velocity Conference
 
DevOps: Who Will Create $2.6 Trillion In Business Value Per Year?
DevOps: Who Will Create $2.6 Trillion In Business Value Per Year?DevOps: Who Will Create $2.6 Trillion In Business Value Per Year?
DevOps: Who Will Create $2.6 Trillion In Business Value Per Year?
 
2013 Velocity DevOps Metrics -- It's Not Just For WebOps Any More!
2013 Velocity DevOps Metrics -- It's Not Just For WebOps Any More!2013 Velocity DevOps Metrics -- It's Not Just For WebOps Any More!
2013 Velocity DevOps Metrics -- It's Not Just For WebOps Any More!
 
Why Everyone Needs DevOps Now: 15 Year Study Of High Performing Technology Orgs
Why Everyone Needs DevOps Now: 15 Year Study Of High Performing Technology OrgsWhy Everyone Needs DevOps Now: 15 Year Study Of High Performing Technology Orgs
Why Everyone Needs DevOps Now: 15 Year Study Of High Performing Technology Orgs
 
CampDevOps keynote - DevOps: Using 'Lean' to eliminate Bottlenecks
CampDevOps keynote - DevOps: Using 'Lean' to eliminate BottlenecksCampDevOps keynote - DevOps: Using 'Lean' to eliminate Bottlenecks
CampDevOps keynote - DevOps: Using 'Lean' to eliminate Bottlenecks
 
2012 Velocity London: DevOps Patterns Distilled
2012 Velocity London: DevOps Patterns Distilled2012 Velocity London: DevOps Patterns Distilled
2012 Velocity London: DevOps Patterns Distilled
 
Project controller performance appraisal
Project controller performance appraisalProject controller performance appraisal
Project controller performance appraisal
 
Don't be Afraid of Scary Code Webcast
Don't be Afraid of Scary Code WebcastDon't be Afraid of Scary Code Webcast
Don't be Afraid of Scary Code Webcast
 
Modern Interface to Mainframe - The Compuware Workbench (B. Ebner)
Modern Interface to Mainframe - The Compuware Workbench (B. Ebner)Modern Interface to Mainframe - The Compuware Workbench (B. Ebner)
Modern Interface to Mainframe - The Compuware Workbench (B. Ebner)
 
Continuous delivery with Jenkins, Docker and Mesos/Marathon - jbcnconf
Continuous delivery with Jenkins, Docker and Mesos/Marathon - jbcnconfContinuous delivery with Jenkins, Docker and Mesos/Marathon - jbcnconf
Continuous delivery with Jenkins, Docker and Mesos/Marathon - jbcnconf
 
A Customer's Journey to Mainstreaming the Mainframe Webcast On-demand Replay
A Customer's Journey to Mainstreaming the Mainframe Webcast On-demand ReplayA Customer's Journey to Mainstreaming the Mainframe Webcast On-demand Replay
A Customer's Journey to Mainstreaming the Mainframe Webcast On-demand Replay
 
Access by Default
Access by DefaultAccess by Default
Access by Default
 
Leadership Styles Your Team Needs
Leadership Styles Your Team NeedsLeadership Styles Your Team Needs
Leadership Styles Your Team Needs
 
Business Models
Business ModelsBusiness Models
Business Models
 
Agile Experience Design Framework
Agile Experience Design FrameworkAgile Experience Design Framework
Agile Experience Design Framework
 
Startup Metrics for Pirates (KAUST, Nov 2013)
Startup Metrics for Pirates (KAUST, Nov 2013)Startup Metrics for Pirates (KAUST, Nov 2013)
Startup Metrics for Pirates (KAUST, Nov 2013)
 
Jesse Robbins Keynote - Hacking Culture @ Cloud Expo Europe 2013
Jesse Robbins Keynote - Hacking Culture @ Cloud Expo Europe 2013Jesse Robbins Keynote - Hacking Culture @ Cloud Expo Europe 2013
Jesse Robbins Keynote - Hacking Culture @ Cloud Expo Europe 2013
 
Doors, Walls and Old Trees: Prioritizing to Get Simple
Doors, Walls and Old Trees: Prioritizing to Get SimpleDoors, Walls and Old Trees: Prioritizing to Get Simple
Doors, Walls and Old Trees: Prioritizing to Get Simple
 
Operational Auditing
Operational AuditingOperational Auditing
Operational Auditing
 

Similar to Keeping The Auditor Away: DevOps Audit Compliance Case Studies

Kim itSMF New England: ITIL at Ludicrous Speeds - Rugged DevOps 6a
Kim itSMF New England: ITIL at Ludicrous Speeds - Rugged DevOps 6aKim itSMF New England: ITIL at Ludicrous Speeds - Rugged DevOps 6a
Kim itSMF New England: ITIL at Ludicrous Speeds - Rugged DevOps 6aGene Kim
 
ServiceNow ITIL at Ludicrous Speeds - Rugged DevOps
ServiceNow ITIL at Ludicrous Speeds - Rugged DevOpsServiceNow ITIL at Ludicrous Speeds - Rugged DevOps
ServiceNow ITIL at Ludicrous Speeds - Rugged DevOpsGene Kim
 
Kim IT Pro Forum Eugene: IT at Ludicrous Speeds - rugged dev ops
Kim IT Pro Forum Eugene: IT at Ludicrous Speeds - rugged dev opsKim IT Pro Forum Eugene: IT at Ludicrous Speeds - rugged dev ops
Kim IT Pro Forum Eugene: IT at Ludicrous Speeds - rugged dev opsGene Kim
 
2012 SxSW When IT Says No by Gene Kim
2012 SxSW When IT Says No by Gene Kim2012 SxSW When IT Says No by Gene Kim
2012 SxSW When IT Says No by Gene KimGene Kim
 
SecureWorld Kim - Infosec at Ludicrous Speeds - Rugged DevOps 6a
SecureWorld Kim - Infosec at Ludicrous Speeds - Rugged DevOps 6aSecureWorld Kim - Infosec at Ludicrous Speeds - Rugged DevOps 6a
SecureWorld Kim - Infosec at Ludicrous Speeds - Rugged DevOps 6aGene Kim
 
2019 12 Clojure/conj: Love Letter To Clojure, and A Datomic Experience Report
2019 12 Clojure/conj: Love Letter To Clojure, and A Datomic Experience Report2019 12 Clojure/conj: Love Letter To Clojure, and A Datomic Experience Report
2019 12 Clojure/conj: Love Letter To Clojure, and A Datomic Experience ReportGene Kim
 
DevOps Kanban Meet Up 3/22/12
DevOps Kanban Meet Up 3/22/12DevOps Kanban Meet Up 3/22/12
DevOps Kanban Meet Up 3/22/12Gene Kim
 
Fear and Loathing in Agility: Long Live the Accounting Department
Fear and Loathing in Agility: Long Live the Accounting DepartmentFear and Loathing in Agility: Long Live the Accounting Department
Fear and Loathing in Agility: Long Live the Accounting DepartmentAccenture | SolutionsIQ
 
2019 Top Lessons Learned Since the Phoenix Project Was Released
2019 Top Lessons Learned Since the Phoenix Project Was Released2019 Top Lessons Learned Since the Phoenix Project Was Released
2019 Top Lessons Learned Since the Phoenix Project Was ReleasedGene Kim
 
Proposed Title Fear and Loathing in Agility: Long Live the Accounting Departm...
Proposed Title Fear and Loathing in Agility: Long Live the Accounting Departm...Proposed Title Fear and Loathing in Agility: Long Live the Accounting Departm...
Proposed Title Fear and Loathing in Agility: Long Live the Accounting Departm...Laszlo Szalvay
 
My Top Five DevOps Learnings
My Top Five DevOps LearningsMy Top Five DevOps Learnings
My Top Five DevOps LearningsPredix
 
The Unicorn Project and The Five Ideals (Updated Dec 2019)
The Unicorn Project and The Five Ideals (Updated Dec 2019)The Unicorn Project and The Five Ideals (Updated Dec 2019)
The Unicorn Project and The Five Ideals (Updated Dec 2019)Gene Kim
 
Edit Privacy Settings Analytics FREE Collect Leads Micro Focus DevOps Drive-i...
Edit Privacy Settings Analytics FREE Collect Leads Micro Focus DevOps Drive-i...Edit Privacy Settings Analytics FREE Collect Leads Micro Focus DevOps Drive-i...
Edit Privacy Settings Analytics FREE Collect Leads Micro Focus DevOps Drive-i...Serena Software
 
Top Lessons Learned While Researching and Writing The DevOps Handbook
Top Lessons Learned While Researching and Writing The DevOps HandbookTop Lessons Learned While Researching and Writing The DevOps Handbook
Top Lessons Learned While Researching and Writing The DevOps HandbookDynatrace
 
DevOps and Digital Transformation
DevOps and Digital TransformationDevOps and Digital Transformation
DevOps and Digital TransformationOmid Shariati
 
Owasp summit debrief v1.0 (jun 2017)
Owasp summit debrief v1.0 (jun 2017)Owasp summit debrief v1.0 (jun 2017)
Owasp summit debrief v1.0 (jun 2017)owaspsummit
 
How Can We Better Sell DevOps?
How Can We Better Sell DevOps?How Can We Better Sell DevOps?
How Can We Better Sell DevOps?Gene Kim
 
How Do We Better Sell DevOps? - PuppetConf 2013
How Do We Better Sell DevOps? - PuppetConf 2013How Do We Better Sell DevOps? - PuppetConf 2013
How Do We Better Sell DevOps? - PuppetConf 2013Puppet
 
Introduction to Recipes for Agile Governance in the Enterprise (RAGE)
Introduction to Recipes for Agile Governance in the Enterprise (RAGE)Introduction to Recipes for Agile Governance in the Enterprise (RAGE)
Introduction to Recipes for Agile Governance in the Enterprise (RAGE)Cprime
 

Similar to Keeping The Auditor Away: DevOps Audit Compliance Case Studies (20)

Kim itSMF New England: ITIL at Ludicrous Speeds - Rugged DevOps 6a
Kim itSMF New England: ITIL at Ludicrous Speeds - Rugged DevOps 6aKim itSMF New England: ITIL at Ludicrous Speeds - Rugged DevOps 6a
Kim itSMF New England: ITIL at Ludicrous Speeds - Rugged DevOps 6a
 
ServiceNow ITIL at Ludicrous Speeds - Rugged DevOps
ServiceNow ITIL at Ludicrous Speeds - Rugged DevOpsServiceNow ITIL at Ludicrous Speeds - Rugged DevOps
ServiceNow ITIL at Ludicrous Speeds - Rugged DevOps
 
Kim IT Pro Forum Eugene: IT at Ludicrous Speeds - rugged dev ops
Kim IT Pro Forum Eugene: IT at Ludicrous Speeds - rugged dev opsKim IT Pro Forum Eugene: IT at Ludicrous Speeds - rugged dev ops
Kim IT Pro Forum Eugene: IT at Ludicrous Speeds - rugged dev ops
 
2012 SxSW When IT Says No by Gene Kim
2012 SxSW When IT Says No by Gene Kim2012 SxSW When IT Says No by Gene Kim
2012 SxSW When IT Says No by Gene Kim
 
SecureWorld Kim - Infosec at Ludicrous Speeds - Rugged DevOps 6a
SecureWorld Kim - Infosec at Ludicrous Speeds - Rugged DevOps 6aSecureWorld Kim - Infosec at Ludicrous Speeds - Rugged DevOps 6a
SecureWorld Kim - Infosec at Ludicrous Speeds - Rugged DevOps 6a
 
2019 12 Clojure/conj: Love Letter To Clojure, and A Datomic Experience Report
2019 12 Clojure/conj: Love Letter To Clojure, and A Datomic Experience Report2019 12 Clojure/conj: Love Letter To Clojure, and A Datomic Experience Report
2019 12 Clojure/conj: Love Letter To Clojure, and A Datomic Experience Report
 
DevOps Kanban Meet Up 3/22/12
DevOps Kanban Meet Up 3/22/12DevOps Kanban Meet Up 3/22/12
DevOps Kanban Meet Up 3/22/12
 
Fear and Loathing in Agility: Long Live the Accounting Department
Fear and Loathing in Agility: Long Live the Accounting DepartmentFear and Loathing in Agility: Long Live the Accounting Department
Fear and Loathing in Agility: Long Live the Accounting Department
 
2019 Top Lessons Learned Since the Phoenix Project Was Released
2019 Top Lessons Learned Since the Phoenix Project Was Released2019 Top Lessons Learned Since the Phoenix Project Was Released
2019 Top Lessons Learned Since the Phoenix Project Was Released
 
Proposed Title Fear and Loathing in Agility: Long Live the Accounting Departm...
Proposed Title Fear and Loathing in Agility: Long Live the Accounting Departm...Proposed Title Fear and Loathing in Agility: Long Live the Accounting Departm...
Proposed Title Fear and Loathing in Agility: Long Live the Accounting Departm...
 
My Top Five DevOps Learnings
My Top Five DevOps LearningsMy Top Five DevOps Learnings
My Top Five DevOps Learnings
 
The Unicorn Project and The Five Ideals (Updated Dec 2019)
The Unicorn Project and The Five Ideals (Updated Dec 2019)The Unicorn Project and The Five Ideals (Updated Dec 2019)
The Unicorn Project and The Five Ideals (Updated Dec 2019)
 
Edit Privacy Settings Analytics FREE Collect Leads Micro Focus DevOps Drive-i...
Edit Privacy Settings Analytics FREE Collect Leads Micro Focus DevOps Drive-i...Edit Privacy Settings Analytics FREE Collect Leads Micro Focus DevOps Drive-i...
Edit Privacy Settings Analytics FREE Collect Leads Micro Focus DevOps Drive-i...
 
Top Lessons Learned While Researching and Writing The DevOps Handbook
Top Lessons Learned While Researching and Writing The DevOps HandbookTop Lessons Learned While Researching and Writing The DevOps Handbook
Top Lessons Learned While Researching and Writing The DevOps Handbook
 
DevOps and Digital Transformation
DevOps and Digital TransformationDevOps and Digital Transformation
DevOps and Digital Transformation
 
Reclaiming Agile Development
Reclaiming Agile Development Reclaiming Agile Development
Reclaiming Agile Development
 
Owasp summit debrief v1.0 (jun 2017)
Owasp summit debrief v1.0 (jun 2017)Owasp summit debrief v1.0 (jun 2017)
Owasp summit debrief v1.0 (jun 2017)
 
How Can We Better Sell DevOps?
How Can We Better Sell DevOps?How Can We Better Sell DevOps?
How Can We Better Sell DevOps?
 
How Do We Better Sell DevOps? - PuppetConf 2013
How Do We Better Sell DevOps? - PuppetConf 2013How Do We Better Sell DevOps? - PuppetConf 2013
How Do We Better Sell DevOps? - PuppetConf 2013
 
Introduction to Recipes for Agile Governance in the Enterprise (RAGE)
Introduction to Recipes for Agile Governance in the Enterprise (RAGE)Introduction to Recipes for Agile Governance in the Enterprise (RAGE)
Introduction to Recipes for Agile Governance in the Enterprise (RAGE)
 

More from Gene Kim

Speaker Recording Tips For Virtual DevOps Enterprise (And Why We're Pre-Recor...
Speaker Recording Tips For Virtual DevOps Enterprise (And Why We're Pre-Recor...Speaker Recording Tips For Virtual DevOps Enterprise (And Why We're Pre-Recor...
Speaker Recording Tips For Virtual DevOps Enterprise (And Why We're Pre-Recor...Gene Kim
 
GitHub Universe: 2019: Exemplars, Laggards, and Hoarders A Data-driven Look a...
GitHub Universe: 2019: Exemplars, Laggards, and Hoarders A Data-driven Look a...GitHub Universe: 2019: Exemplars, Laggards, and Hoarders A Data-driven Look a...
GitHub Universe: 2019: Exemplars, Laggards, and Hoarders A Data-driven Look a...Gene Kim
 
The Unicorn Project and The Five Ideals (older: see notes for newer version)
The Unicorn Project and The Five Ideals (older: see notes for newer version)The Unicorn Project and The Five Ideals (older: see notes for newer version)
The Unicorn Project and The Five Ideals (older: see notes for newer version)Gene Kim
 
Kevin Behr: Integrating Controls and Process Improvement
Kevin Behr: Integrating Controls and Process ImprovementKevin Behr: Integrating Controls and Process Improvement
Kevin Behr: Integrating Controls and Process ImprovementGene Kim
 
SecureWorld - Communicating With Your CFO
SecureWorld - Communicating With Your CFOSecureWorld - Communicating With Your CFO
SecureWorld - Communicating With Your CFOGene Kim
 
PuppetConf2012GeneKim
PuppetConf2012GeneKimPuppetConf2012GeneKim
PuppetConf2012GeneKimGene Kim
 
United2012 Rugged DevOps Rocks
United2012 Rugged DevOps RocksUnited2012 Rugged DevOps Rocks
United2012 Rugged DevOps RocksGene Kim
 
Infosec at Ludicrous Speeds - Rugged DevOps
Infosec at Ludicrous Speeds - Rugged DevOps Infosec at Ludicrous Speeds - Rugged DevOps
Infosec at Ludicrous Speeds - Rugged DevOps Gene Kim
 
When IT Fails The Business Fails...
When IT Fails The Business Fails...When IT Fails The Business Fails...
When IT Fails The Business Fails...Gene Kim
 
2012 05 corp fin 1c
2012 05 corp fin 1c2012 05 corp fin 1c
2012 05 corp fin 1cGene Kim
 
Winnipeg ISACA Security is Dead, Rugged DevOps
Winnipeg ISACA Security is Dead, Rugged DevOpsWinnipeg ISACA Security is Dead, Rugged DevOps
Winnipeg ISACA Security is Dead, Rugged DevOpsGene Kim
 
SecureWorld: Security is Dead, Rugged DevOps 1f
SecureWorld: Security is Dead, Rugged DevOps 1fSecureWorld: Security is Dead, Rugged DevOps 1f
SecureWorld: Security is Dead, Rugged DevOps 1fGene Kim
 
Security is Dead. Long Live Rugged DevOps: IT at Ludicrous Speed
Security is Dead. Long Live Rugged DevOps: IT at Ludicrous SpeedSecurity is Dead. Long Live Rugged DevOps: IT at Ludicrous Speed
Security is Dead. Long Live Rugged DevOps: IT at Ludicrous SpeedGene Kim
 
2011 09 19 LSPE Dev Ops Cookbook 1a
2011 09 19 LSPE Dev Ops Cookbook 1a2011 09 19 LSPE Dev Ops Cookbook 1a
2011 09 19 LSPE Dev Ops Cookbook 1aGene Kim
 

More from Gene Kim (14)

Speaker Recording Tips For Virtual DevOps Enterprise (And Why We're Pre-Recor...
Speaker Recording Tips For Virtual DevOps Enterprise (And Why We're Pre-Recor...Speaker Recording Tips For Virtual DevOps Enterprise (And Why We're Pre-Recor...
Speaker Recording Tips For Virtual DevOps Enterprise (And Why We're Pre-Recor...
 
GitHub Universe: 2019: Exemplars, Laggards, and Hoarders A Data-driven Look a...
GitHub Universe: 2019: Exemplars, Laggards, and Hoarders A Data-driven Look a...GitHub Universe: 2019: Exemplars, Laggards, and Hoarders A Data-driven Look a...
GitHub Universe: 2019: Exemplars, Laggards, and Hoarders A Data-driven Look a...
 
The Unicorn Project and The Five Ideals (older: see notes for newer version)
The Unicorn Project and The Five Ideals (older: see notes for newer version)The Unicorn Project and The Five Ideals (older: see notes for newer version)
The Unicorn Project and The Five Ideals (older: see notes for newer version)
 
Kevin Behr: Integrating Controls and Process Improvement
Kevin Behr: Integrating Controls and Process ImprovementKevin Behr: Integrating Controls and Process Improvement
Kevin Behr: Integrating Controls and Process Improvement
 
SecureWorld - Communicating With Your CFO
SecureWorld - Communicating With Your CFOSecureWorld - Communicating With Your CFO
SecureWorld - Communicating With Your CFO
 
PuppetConf2012GeneKim
PuppetConf2012GeneKimPuppetConf2012GeneKim
PuppetConf2012GeneKim
 
United2012 Rugged DevOps Rocks
United2012 Rugged DevOps RocksUnited2012 Rugged DevOps Rocks
United2012 Rugged DevOps Rocks
 
Infosec at Ludicrous Speeds - Rugged DevOps
Infosec at Ludicrous Speeds - Rugged DevOps Infosec at Ludicrous Speeds - Rugged DevOps
Infosec at Ludicrous Speeds - Rugged DevOps
 
When IT Fails The Business Fails...
When IT Fails The Business Fails...When IT Fails The Business Fails...
When IT Fails The Business Fails...
 
2012 05 corp fin 1c
2012 05 corp fin 1c2012 05 corp fin 1c
2012 05 corp fin 1c
 
Winnipeg ISACA Security is Dead, Rugged DevOps
Winnipeg ISACA Security is Dead, Rugged DevOpsWinnipeg ISACA Security is Dead, Rugged DevOps
Winnipeg ISACA Security is Dead, Rugged DevOps
 
SecureWorld: Security is Dead, Rugged DevOps 1f
SecureWorld: Security is Dead, Rugged DevOps 1fSecureWorld: Security is Dead, Rugged DevOps 1f
SecureWorld: Security is Dead, Rugged DevOps 1f
 
Security is Dead. Long Live Rugged DevOps: IT at Ludicrous Speed
Security is Dead. Long Live Rugged DevOps: IT at Ludicrous SpeedSecurity is Dead. Long Live Rugged DevOps: IT at Ludicrous Speed
Security is Dead. Long Live Rugged DevOps: IT at Ludicrous Speed
 
2011 09 19 LSPE Dev Ops Cookbook 1a
2011 09 19 LSPE Dev Ops Cookbook 1a2011 09 19 LSPE Dev Ops Cookbook 1a
2011 09 19 LSPE Dev Ops Cookbook 1a
 

Recently uploaded

Take control of your SAP testing with UiPath Test Suite
Take control of your SAP testing with UiPath Test SuiteTake control of your SAP testing with UiPath Test Suite
Take control of your SAP testing with UiPath Test SuiteDianaGray10
 
Use of FIDO in the Payments and Identity Landscape: FIDO Paris Seminar.pptx
Use of FIDO in the Payments and Identity Landscape: FIDO Paris Seminar.pptxUse of FIDO in the Payments and Identity Landscape: FIDO Paris Seminar.pptx
Use of FIDO in the Payments and Identity Landscape: FIDO Paris Seminar.pptxLoriGlavin3
 
Hyperautomation and AI/ML: A Strategy for Digital Transformation Success.pdf
Hyperautomation and AI/ML: A Strategy for Digital Transformation Success.pdfHyperautomation and AI/ML: A Strategy for Digital Transformation Success.pdf
Hyperautomation and AI/ML: A Strategy for Digital Transformation Success.pdfPrecisely
 
"Subclassing and Composition – A Pythonic Tour of Trade-Offs", Hynek Schlawack
"Subclassing and Composition – A Pythonic Tour of Trade-Offs", Hynek Schlawack"Subclassing and Composition – A Pythonic Tour of Trade-Offs", Hynek Schlawack
"Subclassing and Composition – A Pythonic Tour of Trade-Offs", Hynek SchlawackFwdays
 
DevoxxFR 2024 Reproducible Builds with Apache Maven
DevoxxFR 2024 Reproducible Builds with Apache MavenDevoxxFR 2024 Reproducible Builds with Apache Maven
DevoxxFR 2024 Reproducible Builds with Apache MavenHervé Boutemy
 
From Family Reminiscence to Scholarly Archive .
From Family Reminiscence to Scholarly Archive .From Family Reminiscence to Scholarly Archive .
From Family Reminiscence to Scholarly Archive .Alan Dix
 
What's New in Teams Calling, Meetings and Devices March 2024
What's New in Teams Calling, Meetings and Devices March 2024What's New in Teams Calling, Meetings and Devices March 2024
What's New in Teams Calling, Meetings and Devices March 2024Stephanie Beckett
 
Nell’iperspazio con Rocket: il Framework Web di Rust!
Nell’iperspazio con Rocket: il Framework Web di Rust!Nell’iperspazio con Rocket: il Framework Web di Rust!
Nell’iperspazio con Rocket: il Framework Web di Rust!Commit University
 
The Fit for Passkeys for Employee and Consumer Sign-ins: FIDO Paris Seminar.pptx
The Fit for Passkeys for Employee and Consumer Sign-ins: FIDO Paris Seminar.pptxThe Fit for Passkeys for Employee and Consumer Sign-ins: FIDO Paris Seminar.pptx
The Fit for Passkeys for Employee and Consumer Sign-ins: FIDO Paris Seminar.pptxLoriGlavin3
 
Merck Moving Beyond Passwords: FIDO Paris Seminar.pptx
Merck Moving Beyond Passwords: FIDO Paris Seminar.pptxMerck Moving Beyond Passwords: FIDO Paris Seminar.pptx
Merck Moving Beyond Passwords: FIDO Paris Seminar.pptxLoriGlavin3
 
WordPress Websites for Engineers: Elevate Your Brand
WordPress Websites for Engineers: Elevate Your BrandWordPress Websites for Engineers: Elevate Your Brand
WordPress Websites for Engineers: Elevate Your Brandgvaughan
 
Scanning the Internet for External Cloud Exposures via SSL Certs
Scanning the Internet for External Cloud Exposures via SSL CertsScanning the Internet for External Cloud Exposures via SSL Certs
Scanning the Internet for External Cloud Exposures via SSL CertsRizwan Syed
 
Transcript: New from BookNet Canada for 2024: Loan Stars - Tech Forum 2024
Transcript: New from BookNet Canada for 2024: Loan Stars - Tech Forum 2024Transcript: New from BookNet Canada for 2024: Loan Stars - Tech Forum 2024
Transcript: New from BookNet Canada for 2024: Loan Stars - Tech Forum 2024BookNet Canada
 
A Deep Dive on Passkeys: FIDO Paris Seminar.pptx
A Deep Dive on Passkeys: FIDO Paris Seminar.pptxA Deep Dive on Passkeys: FIDO Paris Seminar.pptx
A Deep Dive on Passkeys: FIDO Paris Seminar.pptxLoriGlavin3
 
Gen AI in Business - Global Trends Report 2024.pdf
Gen AI in Business - Global Trends Report 2024.pdfGen AI in Business - Global Trends Report 2024.pdf
Gen AI in Business - Global Trends Report 2024.pdfAddepto
 
TeamStation AI System Report LATAM IT Salaries 2024
TeamStation AI System Report LATAM IT Salaries 2024TeamStation AI System Report LATAM IT Salaries 2024
TeamStation AI System Report LATAM IT Salaries 2024Lonnie McRorey
 
Dev Dives: Streamline document processing with UiPath Studio Web
Dev Dives: Streamline document processing with UiPath Studio WebDev Dives: Streamline document processing with UiPath Studio Web
Dev Dives: Streamline document processing with UiPath Studio WebUiPathCommunity
 
Passkey Providers and Enabling Portability: FIDO Paris Seminar.pptx
Passkey Providers and Enabling Portability: FIDO Paris Seminar.pptxPasskey Providers and Enabling Portability: FIDO Paris Seminar.pptx
Passkey Providers and Enabling Portability: FIDO Paris Seminar.pptxLoriGlavin3
 
DSPy a system for AI to Write Prompts and Do Fine Tuning
DSPy a system for AI to Write Prompts and Do Fine TuningDSPy a system for AI to Write Prompts and Do Fine Tuning
DSPy a system for AI to Write Prompts and Do Fine TuningLars Bell
 

Recently uploaded (20)

Take control of your SAP testing with UiPath Test Suite
Take control of your SAP testing with UiPath Test SuiteTake control of your SAP testing with UiPath Test Suite
Take control of your SAP testing with UiPath Test Suite
 
Use of FIDO in the Payments and Identity Landscape: FIDO Paris Seminar.pptx
Use of FIDO in the Payments and Identity Landscape: FIDO Paris Seminar.pptxUse of FIDO in the Payments and Identity Landscape: FIDO Paris Seminar.pptx
Use of FIDO in the Payments and Identity Landscape: FIDO Paris Seminar.pptx
 
Hyperautomation and AI/ML: A Strategy for Digital Transformation Success.pdf
Hyperautomation and AI/ML: A Strategy for Digital Transformation Success.pdfHyperautomation and AI/ML: A Strategy for Digital Transformation Success.pdf
Hyperautomation and AI/ML: A Strategy for Digital Transformation Success.pdf
 
"Subclassing and Composition – A Pythonic Tour of Trade-Offs", Hynek Schlawack
"Subclassing and Composition – A Pythonic Tour of Trade-Offs", Hynek Schlawack"Subclassing and Composition – A Pythonic Tour of Trade-Offs", Hynek Schlawack
"Subclassing and Composition – A Pythonic Tour of Trade-Offs", Hynek Schlawack
 
DevoxxFR 2024 Reproducible Builds with Apache Maven
DevoxxFR 2024 Reproducible Builds with Apache MavenDevoxxFR 2024 Reproducible Builds with Apache Maven
DevoxxFR 2024 Reproducible Builds with Apache Maven
 
From Family Reminiscence to Scholarly Archive .
From Family Reminiscence to Scholarly Archive .From Family Reminiscence to Scholarly Archive .
From Family Reminiscence to Scholarly Archive .
 
What's New in Teams Calling, Meetings and Devices March 2024
What's New in Teams Calling, Meetings and Devices March 2024What's New in Teams Calling, Meetings and Devices March 2024
What's New in Teams Calling, Meetings and Devices March 2024
 
Nell’iperspazio con Rocket: il Framework Web di Rust!
Nell’iperspazio con Rocket: il Framework Web di Rust!Nell’iperspazio con Rocket: il Framework Web di Rust!
Nell’iperspazio con Rocket: il Framework Web di Rust!
 
The Fit for Passkeys for Employee and Consumer Sign-ins: FIDO Paris Seminar.pptx
The Fit for Passkeys for Employee and Consumer Sign-ins: FIDO Paris Seminar.pptxThe Fit for Passkeys for Employee and Consumer Sign-ins: FIDO Paris Seminar.pptx
The Fit for Passkeys for Employee and Consumer Sign-ins: FIDO Paris Seminar.pptx
 
Merck Moving Beyond Passwords: FIDO Paris Seminar.pptx
Merck Moving Beyond Passwords: FIDO Paris Seminar.pptxMerck Moving Beyond Passwords: FIDO Paris Seminar.pptx
Merck Moving Beyond Passwords: FIDO Paris Seminar.pptx
 
WordPress Websites for Engineers: Elevate Your Brand
WordPress Websites for Engineers: Elevate Your BrandWordPress Websites for Engineers: Elevate Your Brand
WordPress Websites for Engineers: Elevate Your Brand
 
Scanning the Internet for External Cloud Exposures via SSL Certs
Scanning the Internet for External Cloud Exposures via SSL CertsScanning the Internet for External Cloud Exposures via SSL Certs
Scanning the Internet for External Cloud Exposures via SSL Certs
 
Transcript: New from BookNet Canada for 2024: Loan Stars - Tech Forum 2024
Transcript: New from BookNet Canada for 2024: Loan Stars - Tech Forum 2024Transcript: New from BookNet Canada for 2024: Loan Stars - Tech Forum 2024
Transcript: New from BookNet Canada for 2024: Loan Stars - Tech Forum 2024
 
DMCC Future of Trade Web3 - Special Edition
DMCC Future of Trade Web3 - Special EditionDMCC Future of Trade Web3 - Special Edition
DMCC Future of Trade Web3 - Special Edition
 
A Deep Dive on Passkeys: FIDO Paris Seminar.pptx
A Deep Dive on Passkeys: FIDO Paris Seminar.pptxA Deep Dive on Passkeys: FIDO Paris Seminar.pptx
A Deep Dive on Passkeys: FIDO Paris Seminar.pptx
 
Gen AI in Business - Global Trends Report 2024.pdf
Gen AI in Business - Global Trends Report 2024.pdfGen AI in Business - Global Trends Report 2024.pdf
Gen AI in Business - Global Trends Report 2024.pdf
 
TeamStation AI System Report LATAM IT Salaries 2024
TeamStation AI System Report LATAM IT Salaries 2024TeamStation AI System Report LATAM IT Salaries 2024
TeamStation AI System Report LATAM IT Salaries 2024
 
Dev Dives: Streamline document processing with UiPath Studio Web
Dev Dives: Streamline document processing with UiPath Studio WebDev Dives: Streamline document processing with UiPath Studio Web
Dev Dives: Streamline document processing with UiPath Studio Web
 
Passkey Providers and Enabling Portability: FIDO Paris Seminar.pptx
Passkey Providers and Enabling Portability: FIDO Paris Seminar.pptxPasskey Providers and Enabling Portability: FIDO Paris Seminar.pptx
Passkey Providers and Enabling Portability: FIDO Paris Seminar.pptx
 
DSPy a system for AI to Write Prompts and Do Fine Tuning
DSPy a system for AI to Write Prompts and Do Fine TuningDSPy a system for AI to Write Prompts and Do Fine Tuning
DSPy a system for AI to Write Prompts and Do Fine Tuning
 

Keeping The Auditor Away: DevOps Audit Compliance Case Studies

  • 1. @RealGeneKim @jdeluccia Session ID: Gene Kim James DeLuccia Keeping The Auditor Away: DevOps Audit Compliance Case Studies
  • 3. @RealGeneKim @jdeluccia Introductions Gene Kim ▪ Co-author of "The Phoenix Project” ▪ Founder and CTO of Tripwire, Inc. for 13 years ▪ Worked with Jez Humble (co-author of “Continuous Delivery book) to benchmark 14K technology organizations ▪ Co-chaired SOX-404 Scoping Committee at the Institute of Internal Auditors (2005) James DeLuccia ▪ Author, “IT Compliance & Controls” ▪ Ernst & Young, leader for Americas Certification & Compliance Services ▪ Focus: startups, technology, governance, security ▪ Patent holder - crypto privacy comparison system
  • 4. @RealGeneKim @jdeluccia Golly, Why Are You Attending This Talk? ▪ How many people have to deal with compliance? ▪ On a scale of 1-10, how painful are your interactions with auditors? (1=delightful, 10=awful beyond words?)
  • 5. @RealGeneKim @jdeluccia Problem Statement Gene ● DevOps and continuous delivery introduce problems with audit, because the work patterns are so different than traditional SDLC ● Agile also had issues (e.g., testing at end of project, requirements phase at the beginning), but is not as radical as DevOps ○ tens/hundreds of deploys/day (change is risk; can’t rely on change approvals, separation of duty) ● No widespread agreement on what DevOps control requirements should look like James ● Auditors must work off a mature and testable environment ● They must stake their livelihood that what you say is correct, completely ● A partnership is needed between you and them to ensure such an environment exists (of course, it also needs to operate and be amazing .. but that is another talk)
  • 6. @RealGeneKim @jdeluccia Agenda ▪ The Top-Down, Risk Based Audit Process ▪ What Goes Wrong ▪Scoping ▪Control Testing ▪ Scenarios From The DevOps Audit Defense Toolkit ▪ Ask An Auditor Anything!
  • 7. @RealGeneKim @jdeluccia The DevOps Audit Defense Toolkit http://bit.ly/DevOpsAudit James DeLuccia IV Jeff Gallimore Gene Kim Byron Miller
  • 8. @RealGeneKim @jdeluccia What Is Audit ▪ Management is defined as those who are there to achieve the goals of the organizations, which includes the officers of the company (e.g., CEO, CFO, etc.), executives and managers, as well as everyone who reports to them. ▪ Includes some board of directors, GRC departments ▪ Audit is defined to be the function inside the organization that resides outside of management to serve as an independent, objective source of assurance that the organization can achieve its goals. ▪ Includes internal auditors, external auditors (regulators, assessors, etc.)
  • 9. @RealGeneKim @jdeluccia Internal Controls “a process, effected by an organization’s board of directors, management, and other personnel, designed to provide reasonable assurance regarding the achievement of objectives related to operations, reporting, and compliance.” - Operations (effectiveness, efficiency) - Financial Reporting (accuracy of account balances and values) - Compliance (with relevant laws and regulations, contractual obligations: PCI DSS, US Export Law, FEDRAMP, SOC-2) Source: http://coso.org (Committee of Sponsoring Organizations for the Commission on Fraudulent Financial Reporting)
  • 10. @RealGeneKim @jdeluccia How Audit Plans Are Built And Run ▪ Business objectives ▪ Risks ▪ Control objectives ▪ Control procedures Unfortunately, most contact with auditors start with control procedures… It’s totally appropriate to ask to show work and start from beginning...
  • 11. @RealGeneKim @jdeluccia The Audit Cycle ▪ Planning ▪ Gaining an understanding of the organization ▪ Scoping ▪ Sampling, reporting period, types of evidence needed, recipient of report ▪ Schedule ▪ Fieldwork ▪ Controls testing ▪ Substantive testing ▪ Reporting ▪ Management responses ▪ Attestation by auditor and delivered to regulator/clients
  • 13. @RealGeneKim @jdeluccia When Scoping Goes Wrong ▪ 2001: Enron fails ($63B market cap), Arthur Andersen dissolution ▪ 2002: WorldCom (peak $117B market cap) ▪ Leads to Sarbanes-Oxley Act of 2002
  • 16. @RealGeneKim @jdeluccia Analysis: Audit control testing work was scoped properly, linking controls to compliance objectives and risk. Control failures must result potentially undetected material financial reporting errors The Problem: Improperly Scoped Audits
  • 17. @RealGeneKim @jdeluccia Financial Reporting Material Weakness What happens when an audit generates a material weakness?
  • 19. @RealGeneKim @jdeluccia ▪ When we don’t understand why we are being audited ▪ “Why are we doing this audit?” (customers, SOX, regulatory; who is it for?) ▪ When we are asked for something we don’t have (e.g., “evidence of SoD or change approvals) ▪ “What is the control objective? Can we rewrite the control procedure for this asset?” ▪ Do this before the auditor shows up When Auditors Attack Unexpectedly These are delicate conversations, with potentially large impacts on scope, cost, risk...
  • 20. @RealGeneKim @jdeluccia ▪ If we are reacting to these conversations before we’ve done any of our homework, we may be trouble ▪ Extra work (average time to respond to audit is 40 hours; that’s one Dev sprint) ▪ Audit cost and schedule overages: a 3 hour audit test just turned into a 16 hour audit project ▪ Reduced confidence from auditors, increased visibility from audit and management When Auditors Attack Unexpectedly The DevOps Audit Defense Toolkit
  • 21. @RealGeneKim @jdeluccia The DevOps Audit Defense Toolkit http://bit.ly/DevOpsAudit James DeLuccia IV Jeff Gallimore Gene Kim Byron Miller
  • 22. @RealGeneKim @jdeluccia Practice: Enabling A Shared Understanding Source: DevOps Audit Defense Toolkit http://bit.ly/DevOpsAudit
  • 23. @RealGeneKim @jdeluccia Practice: Enabling A Shared Understanding Source: DevOps Audit Defense Toolkit http://bit.ly/DevOpsAudit
  • 24. @RealGeneKim @jdeluccia Practice: Enabling A Shared Understanding Source: DevOps Audit Defense Toolkit http://bit.ly/DevOpsAudit
  • 25. @RealGeneKim @jdeluccia Walk Through Of DevOps Risk And Control Strategies What does an effective DevOps control environment look like?
  • 26. @RealGeneKim @jdeluccia DevOps Orgs Actually Love Process “Facebook values people, tools, and way, way down the list is process.” Jay Parikh VP Infrastructure Engineering, Facebook Not true! They are conflating “process” and “approvals!”
  • 27. @RealGeneKim @jdeluccia High Performing DevOps Orgs Source: 2014 Puppet Labs State Of DevOps 30xmore frequent deployments 8,000xfaster lead times than their peers
  • 28. @RealGeneKim @jdeluccia High Performing DevOps Orgs Source: 2014 Puppet Labs State Of DevOps 2xhigher change success rates 12xfaster mean time to recover (MTTR)
  • 29. @RealGeneKim @jdeluccia High Performing DevOps Orgs Source: 2014 Puppet Labs State Of DevOps more likely to exceed profitability, market share & productivity goals 2x higher market capitalization growth over 3 years* 50%
  • 30. @RealGeneKim @jdeluccia Top Predictors Of Performance ▪ Version control of all production artifacts ▪ Continuous integration and deployment ▪ Automated acceptance testing ▪ Peer-review of production changes (vs. external change approval) ▪ High trust culture ▪ Proactive monitoring of the production environment ▪ Win-win relationship between Dev and Ops
  • 31. @RealGeneKim @jdeluccia DevOps Orgs Need Hardcopy DevOps has higher automation and closer monitoring controls than traditional deployment environments and therefore reduced points for human failure The documentation of ephemeral systems, tools, and deployment processes into a hardcopy breakdown will communicate and simplify this management long term.
  • 32. @RealGeneKim @jdeluccia Practice: Document Risks & Control Strategy Source: DevOps Audit Defense Toolkit http://bit.ly/DevOpsAudit
  • 33. @RealGeneKim @jdeluccia Practice: Document Control Strategy Source: DevOps Audit Defense Toolkit http://bit.ly/DevOpsAudit
  • 34. @RealGeneKim @jdeluccia Practice: Document Control Strategy Source: DevOps Audit Defense Toolkit http://bit.ly/DevOpsAudit
  • 35. @RealGeneKim @jdeluccia Practice: Document Control Strategy Source: DevOps Audit Defense Toolkit http://bit.ly/DevOpsAudit
  • 36. @RealGeneKim @jdeluccia ▪ Gained an understanding of the organization and its objectives ▪ Understood how our service fits in and where we jeopardize those objectives ▪ Designed and documented our control environment so that auditors can share our understanding ▪ Enable auditors to do their work effectively What We Have Done
  • 37. @RealGeneKim @jdeluccia ▪ Save the date: October 21-23, 2014 ▪ DevOps Enterprise is a conference for horses, by horses ▪ Macy’s, Disney, GE Capital, Blackboard, Telstra, US Citizen and Immigration Services, CSG, Raytheon, Ticketmaster/LiveNation, Capital One, Nordstrom, Union Bank of California ▪ Leaders driving DevOps transformations will talk about ▪ The business problem they set out to solve ▪ The obstacles they had to overcome ▪ The business value they created ▪ Submit talks at: http://devopsenterprisesummit.com/ DevOps Enterprise Summit
  • 38. @RealGeneKim @jdeluccia ▪ We don’t need to wait for auditors to learn about DevOps -- by learning about audit, we can successfully bridge the gap ▪ DevOps control environments can be even more secure than traditional control environments ▪ The DevOps Audit Defense Toolkit might be able to help you! http://bit.ly/DevOpsAudit ▪ We’d love your scrutiny and case studies! ▪ DevOps Enterprise Summit: http://devopsenterprise.io ▪ Emailing us: genek@realgenekim.me, jdeluccia@gmail.com Conclusion
  • 39. @RealGeneKim @jdeluccia Ask An Auditor Anything! ▪ Ask the Auditor and the audience anything: ▪ Separation of Duties? ▪ Security beyond checkboxes and non-contextual requirements? ▪ Governance effects of DevOps and/or Agile? ▪ Integration and dialogues and timing with Management, Auditors, and the effect? ▪ Ask Gene on practical examples ▪ Questions for the audience: ▪ Are you using ISO 27034 as a reference architecture?
  • 41. @RealGeneKim @jdeluccia Results Of Halving Deployment Interval And customers got the feature in half the time! Source: Scott Prugh, CSG
  • 42. @RealGeneKim @jdeluccia Results Of Halving Deployment Interval Source: Scott Prugh, CSG
  • 43. @RealGeneKim @jdeluccia Call to Action ● We're looking for case studies ○ Rough life lessons and smooth successes ○ Submit to: ■ DevOps Audit Defense Toolkit: Google+ Community: http://bit.ly/DevOpsAudit ● Look at the DevOps Audit Defense Toolkit ● DevOps Enterprise Summit ○ http://devopsenterprise.io/