DevSecOps - Unicom Agile and DevOps Expo (Adaptive Challenges) 2021
•
0 likes•117 views
New software development approaches continue to be promoted. You may be aware of waterfall, RUP, 4GLs, 3-tier client server – all still alive and kicking in some domains. You will be familiar with some (or all) of Agile, Kanban, DevOps, SAFe, No Code/Low Code and many others. A new kid on the block is DevSecOps. What does that mean? Where did it come from? Why is it important? If we adopted the tenets of DevSecOps without calling it DevSecOps would it “smell just as sweet”? What would it “smell” like if we spun up a DevSecOps team, without understanding the fundamental challenges that DevSecOps was intended to overcome? In this session I’ll explore the origins of DevSecOps before going on to demonstrate the distance between the label and the intent of DevSecOps. Finally I’ll try to generalise the journey from “good idea” to “empty slogan” that seems to underpin many of the hyped transformations that I’ve lived through during my 40 year career in software.
Recommended
Recommended
More Related Content
Similar to DevSecOps - Unicom Agile and DevOps Expo (Adaptive Challenges) 2021
Similar to DevSecOps - Unicom Agile and DevOps Expo (Adaptive Challenges) 2021 (20)
More from Seb Rose
More from Seb Rose (20)
Recently uploaded
Recently uploaded (20)
DevSecOps - Unicom Agile and DevOps Expo (Adaptive Challenges) 2021
- 1. DevSecOps - by any other name? Seb Rose Twitter: @sebrose Blog: https://cucumber.io/blog/ E-mail: seb.rose@smartbear.com
- 2. @sebrose seb.rose@smartbear.com Agenda Dev, Sec, Ops DevOps DevSecOps What’s in a name?
- 3. @sebrose seb.rose@smartbear.com Agenda Dev, Sec, Ops DevOps DevSecOps What’s in a name?
- 4. @sebrose seb.rose@smartbear.com Definitions Development (Dev) the process of conceiving, specifying, designing, programming, documenting, testing, and bug fixing involved in creating and maintaining applications, frameworks, or other software components Security (Sec) the protection of computer systems and networks from information disclosure, theft of or damage to their hardware, software, or electronic data, as well as from the disruption or misdirection of the services they provide Operations (Ops) the processes, activities, tools, and standards involved with operating, administering, managing and maintaining any system https://en.wikipedia.org
- 7. @sebrose seb.rose@smartbear.com Orthogonal concerns Dev practices and tools Architecture and design Build pipelines Cloud providers Source control OWASP scans Code vulnerabilities DEVELOPMENT S E C U R I T Y OPERATIONS
- 8. @sebrose seb.rose@smartbear.com Agenda Dev, Sec, Ops DevOps DevSecOps What’s in a name?
- 9. @sebrose seb.rose@smartbear.com DevOps Characterized by key principles: shared ownership, workflow automation, and rapid feedback. At its most successful, DevOps is a combination of specific practices, culture change, and tools. “A set of practices intended to reduce the time between committing a change to a system and the change being placed into normal production, while ensuring high quality” - Bass, Weber, Zhu There is no universally agreed definition of the term. https://en.wikipedia.org/wiki/DevOps
- 10. @sebrose seb.rose@smartbear.com Ideal outcomes DORA metrics - Lead/cycle time (shorter) - Deployment frequency (higher) - Mean time to restore (shorter) - Change fail percentage (lower)
- 11. @sebrose seb.rose@smartbear.com Idealised transformation With the help of a prospective board member and his mysterious philosophy of The Three Ways, Bill starts to see that IT work has more in common with manufacturing plant work than he ever imagined. With the clock ticking, Bill must organize work flow streamline interdepartmental communications, and effectively serve the other business functions at Parts Unlimited.
- 12. @sebrose seb.rose@smartbear.com Typical transformation Dev Ops Dev Dev Ops Before After Excessively cynical
- 13. @sebrose seb.rose@smartbear.com Living the dream DevOps
- 14. @sebrose seb.rose@smartbear.com Ops as platform team Platform tools Ops Dev (use platform tools) platform team
- 15. @sebrose seb.rose@smartbear.com Agenda Dev, Sec, Ops DevOps DevSecOps What’s in a name?
- 16. @sebrose seb.rose@smartbear.com Who owns security? Sec https://devops.com/whos-responsible-for-security-apparently-it-depends/ The [dev] team is trusted to do its own security research and implementation I regularly put security suggestions in the box of suggestions, only to be ignored There’s a security team, but it doesn’t involve face to face with us, the dev team. So we just run the dev process without counting on them I am the only one who actually cares about security in my organization
- 17. @sebrose seb.rose@smartbear.com Desire paths http://www.databoxdigital.com/2014/02/02/desire-paths/
- 18. @sebrose seb.rose@smartbear.com Building on DevOps Platform tools Ops Dev (use tools provided) Security tools Sec
- 19. @sebrose seb.rose@smartbear.com Platform tools Dev enablement Ops Dev (specify & use tools) Sec Security tools
- 20. @sebrose seb.rose@smartbear.com Agenda Dev, Sec, Ops DevOps DevSecOps What’s in a name?
- 21. @sebrose seb.rose@smartbear.com What’s in a name? O, be some other name! What’s in a name? That which we call a rose By any other name would smell as sweet William Shakespeare, Romeo and Juliet
- 22. @sebrose seb.rose@smartbear.com The name is not the thing
- 23. @sebrose seb.rose@smartbear.com Names are important https://www.digdeeproots.com/articles/on/naming-process/
- 26. @sebrose seb.rose@smartbear.com The name is not the thing Platform teams facilitate delivery AND support compliance Investment is required to deliver bene fi ts (time and money) Process changes aren’t side effects Takeaways