App Sec village DevSecOps as a culture

•

6 likes•846 views

The document discusses shifting organizational culture to DevSecOps. It outlines challenges in integrating security practices into DevOps processes and culture shifts like encouraging a security mindset across teams through collaboration, education and common goals. The security team role evolves to creating security champions in each team. Case studies from ABN Amro and Fannie Mae demonstrate successful DevSecOps journeys. Resources are provided for establishing a DevSecOps culture.

Vandana Verma Sehgal
Shifting the DevSecOps Culture -
Taking away the sugar piece and giving the Pile to Ants

Who Am I
● Security Architect
● Application and Cloud Security
● Heading InfoSec Girls
● Women of Security India Lead (WoSec)
● Volunteer Coordinator - Asia Pacific for OWASP
● Women in AppSec (WIA) & OWASP WIA Secretary
● OWASP Chapter Leader - Bangalore

Agenda
• About DevSecOps
• Culture Challenges in the Organizations
• Culture Shift Approaches - DevSecOps
• Security Team Responsibilities
• Use Cases
• Resources

What is DevSecOps?
Integrating security practices within the
DevOps process.

Bottom Up Approach
Top Down Approach
Focus on collaboration and inclusive culture

Encourage security mindset outside sec team
● Don’t enforce anything and everything
● Making security as part of the everyday process
● Build relationships between teams, don’t isolate
● Launch Internal Bug Bounty Program

Invest in Security education and training
● Ongoing education and training for software developers
● Arm everyone with the knowledge
● Improve the Skills with Secure code training
● Establish a training program

Cultivate common goals for greater good
• Know the starting point
• Interacts with multiple departments, assets, and resources
• Empower Dev /Ops to deliver better and faster and secure,
instead of blocking.
• Embrace the automation

Security Team Role
Ref:- https://safecode.org/wp-content/uploads/2019/01/champs-pic-768x549.png
• Create more Champions
• Single Person per team
• Cross Skilling
• Respect others expertise and opinion

Case Studie – ABN Amro
https://www.slideshare.net/derweeksglobal/abn-amro-devsecops-journey

Case Studies – Fannie Mae
https://www.slideshare.net/derweeksglobal/abn-amro-devsecops-journey

References:-
● https://dzone.com/articles/shifting-left-devsecops
● https://enterprisersproject.com/article/2018/6/how-build-strong-
devsecops-culture-5-tips
● https://techbeacon.com/security/how-build-devsecops-grow-
culture-ground
● https://www.beyondtrust.com/blog/entry/devsecops-culture-
shift-expect-adapt
● https://i.blackhat.com/asia-19/Thu-March-28/bh-asia-
Shrivastava-DevSecOps.pdf
● https://businessinsights.bitdefender.com/building-devsecops-
culture

Reach Me!
Twitter: @InfosecVandana
LinkedIn: vandana-verma

DevSecOps is a new approach to software development that integrates security into every stage of the software development life cycle. This approach combines the principles of DevOps and security to ensure that software is not only delivered quickly and efficiently, but also securely. The DevSecOps process involves several stages, including the integration of security into the entire software development life cycle, automated security testing and continuous monitoring, and regular security training and awareness programs for all stakeholders. By adopting DevSecOps, organizations can improve their security posture, deliver software faster and more efficiently, and improve collaboration and communication between development and security teams. The implementation of DevSecOps can be challenging, but by adopting best practices and overcoming challenges, organizations can ensure the success of their implementation. The future of DevSecOps is bright, with advancements in automation and the integration of artificial intelligence and machine learning into the process. Overall, DevSecOps is a critical approach for organisations to adopt in the face of growing cyber threats and vulnerabilities.

DevSecOps 101

Narudom Roongsiriwong, CISSP

Security teams are often seen as roadblocks to rapid development or operations implementations, slowing down production code pushes. As a result, security organizations will likely have to change so they can fully support and facilitate cloud operations. This presentation will explain how DevOps and information security can co-exist through the application of a new approach referred to as DevSecOps.

Introduction to DevSecOps OWASP Ahmedabad

kunwaratul hax0r

Addo 2019 vandana_dev_secops_culturalchange

Vandana Verma

In the fusion between DevOps and DevSecOps, the pace and agility of the DevSecOps approach made AppSec and InfoSec were a little left behind. The DevOps squad topology does not involve any of the organization's AppSec and InfoSec Engineer. Many DevOps team are also not included them since they lack the information on how to manage and configure DevOps CI / CD pipelines and DevSecOps approaches. There's no shortage of talent — you probably don't have a mission worth getting out of bed or a culture that fosters continuous learning such DevSecOps skill and tools and growth where people feel psychologically safe. Besides, there is no shortage of skills — most have a poor understanding of what they need to be successful or the skills that need to leverage to improve their security posture.

DevSecOps Implementation Journey

DevOps Indonesia

A detailed guide about dev secops

Enov8

Dev secops indonesia-devsecops as a service-Amien Harisen

Nadira Bajrei

DevSecOps is gaining popularity to recent years, thanks to the rapid expansion and adoptions of DevOps. The traditional penetration testing is considered a blocker in a rapid CI/CD deployment. So integrating security in a seamless manner is considered an important upgrade to the DevOps environment. However, the traditional DevSecOps require huge amount of time, money and effort to implement. Traditional and DevSecOps principle is a culture that depends on teamwork between, the Dev ,Sec, and Ops team, which in real life situation its pretty difficult to realize. This talk is about how to minimize the whole effort to implement DevSecOps in the current DevOps environment.

Agile Fundamentals

Daniel Luschwitz

How DevSecOps Can Help You Deliver Software Faster and Safer.pptx

Dev Software

DevSecOps is a practice that integrates security into every stage of the software development lifecycle. It helps software teams to deliver software that is efficient, secure, and reliable. DevSecOps also brings cultural transformation that makes security a shared responsibility for everyone who is building the software. By adopting DevSecOps, software teams can enjoy faster software delivery, improved security, better collaboration, and higher quality.

The road to decision quality

societyofdecisionprofessionals

We know the impact decision making has on the success – and failure - of our organizations. As it turns out, affecting sustainable organizational change around decision quality is challenging.Drawing from project and change management fundamentals, organizational behaviour and the lessons from other disciplines and industries, we have developed a maturity model that sets long term vision, short term targets and a framework to map the journey.

Enterprise Devsecops

Enov8

DevSecOps is an increasingly popular approach to software development that emphasizes collaboration between development, security, and operations teams to ensure the security of applications throughout the entire software development lifecycle. In this post, we will explore what DevSecOps is and how it can benefit enterprises. We will also discuss the challenges of implementing DevSecOps and strategies for overcoming them. Finally, we will look at some best practices for enterprise DevSecOps and some tools to consider.

Continuous Security / DevSecOps- Why How and What

Marc Hornbeek

Leadership Walkthrough

ASK EHS Engineering & Consultants

Providing effective instructional leadership is a prerquisite for any industry. In addition to managing schedules, and driving safe behaviour onsite, leaders areexpected to possess the knowledge and skill to make a positive impact on the industrial environment. Leadership walkthrough helps establish ongoing work practices and procedures by identifying the safety gaps - a software aids in effective recordkeeping! Go through this presentation and connect with us to know more

Introduction the dev ops world

VishwasN6

The Importance of DevOps Security and the Emergence of DevSecOps

Dev Software

The DevOps methodology has been adopted by many organizations as a means of accelerating software delivery and improving collaboration between teams. However, with the increasing complexity of modern applications and the growing number of threats to cybersecurity, the need for DevOps security has become paramount. In this blog post, we will explore the importance of DevOps security and the emergence of DevSecOps, a new approach that integrates security into the DevOps pipeline.

DevSecCon Asia 2017 Shannon Lietz: Security is Shifting Left

DevSecCon

Understanding DevSecOps.pdf

Ciente

Secure DevOPS Implementation Guidance

Tej Luthra

DevSecOps What Why and How

NotSoSecure Global Services

Step Change Safety Culture Strategy.pdf

Peter Geddes

DevSecOps Best Practices-Safeguarding Your Digital Landscape

stevecooper930744

DevSecOps: The Future of Secure Software Development

Dev Software

In today's digital age, software development has become a critical component of many organizations. As businesses rely more heavily on technology, the need for secure software development practices becomes more pressing. DevSecOps is a software development approach that integrates security into the development process from the outset. In this blog post, we will explore DevSecOps and its potential as the future of secure software development.

Building security into the pipelines

Vandana Verma

Applying OWASP web security testing guide (OWSTG)

Vandana Verma

Similar to App Sec village DevSecOps as a culture

DevSecOps-OWASP Indonesia Day 2017

Suman Sourav

Why Security Engineer Need Shift-Left to DevSecOps?

Najib Radzuan

DevSecOps Implementation Journey

DevOps Indonesia

A detailed guide about dev secops

Enov8

Dev secops indonesia-devsecops as a service-Amien Harisen

Nadira Bajrei

Agile Fundamentals

Daniel Luschwitz

How DevSecOps Can Help You Deliver Software Faster and Safer.pptx

Dev Software

The road to decision quality

societyofdecisionprofessionals

Enterprise Devsecops

Enov8

Continuous Security / DevSecOps- Why How and What

Marc Hornbeek

Leadership Walkthrough

ASK EHS Engineering & Consultants

Introduction the dev ops world

VishwasN6

The Importance of DevOps Security and the Emergence of DevSecOps

Dev Software

DevSecCon Asia 2017 Shannon Lietz: Security is Shifting Left

DevSecCon

Understanding DevSecOps.pdf

Ciente

Secure DevOPS Implementation Guidance

Tej Luthra

DevSecOps What Why and How

NotSoSecure Global Services

Step Change Safety Culture Strategy.pdf

Peter Geddes

DevSecOps Best Practices-Safeguarding Your Digital Landscape

stevecooper930744

DevSecOps: The Future of Secure Software Development

Dev Software

Similar to App Sec village DevSecOps as a culture (20)

DevSecOps-OWASP Indonesia Day 2017

Why Security Engineer Need Shift-Left to DevSecOps?

DevSecOps Implementation Journey

A detailed guide about dev secops

Dev secops indonesia-devsecops as a service-Amien Harisen

Agile Fundamentals

How DevSecOps Can Help You Deliver Software Faster and Safer.pptx

The road to decision quality

Enterprise Devsecops

Continuous Security / DevSecOps- Why How and What

Leadership Walkthrough

Introduction the dev ops world

The Importance of DevOps Security and the Emergence of DevSecOps

DevSecCon Asia 2017 Shannon Lietz: Security is Shifting Left

Understanding DevSecOps.pdf

Secure DevOPS Implementation Guidance

DevSecOps What Why and How

Step Change Safety Culture Strategy.pdf

DevSecOps Best Practices-Safeguarding Your Digital Landscape

DevSecOps: The Future of Secure Software Development

Recently uploaded

Designing Great Products: The Power of Design and Leadership by Chief Designe...

Product School

Essentials of Automations: Optimizing FME Workflows with Parameters

Safe Software

Are you looking to streamline your workflows and boost your projects’ efficiency? Do you find yourself searching for ways to add flexibility and control over your FME workflows? If so, you’re in the right place. Join us for an insightful dive into the world of FME parameters, a critical element in optimizing workflow efficiency. This webinar marks the beginning of our three-part “Essentials of Automation” series. This first webinar is designed to equip you with the knowledge and skills to utilize parameters effectively: enhancing the flexibility, maintainability, and user control of your FME projects. Here’s what you’ll gain: - Essentials of FME Parameters: Understand the pivotal role of parameters, including Reader/Writer, Transformer, User, and FME Flow categories. Discover how they are the key to unlocking automation and optimization within your workflows. - Practical Applications in FME Form: Delve into key user parameter types including choice, connections, and file URLs. Allow users to control how a workflow runs, making your workflows more reusable. Learn to import values and deliver the best user experience for your workflows while enhancing accuracy. - Optimization Strategies in FME Flow: Explore the creation and strategic deployment of parameters in FME Flow, including the use of deployment and geometry parameters, to maximize workflow efficiency. - Pro Tips for Success: Gain insights on parameterizing connections and leveraging new features like Conditional Visibility for clarity and simplicity. We’ll wrap up with a glimpse into future webinars, followed by a Q&A session to address your specific questions surrounding this topic. Don’t miss this opportunity to elevate your FME expertise and drive your projects to new heights of efficiency.

UiPath Test Automation using UiPath Test Suite series, part 4

DianaGray10

Welcome to UiPath Test Automation using UiPath Test Suite series part 4. In this session, we will cover Test Manager overview along with SAP heatmap. The UiPath Test Manager overview with SAP heatmap webinar offers a concise yet comprehensive exploration of the role of a Test Manager within SAP environments, coupled with the utilization of heatmaps for effective testing strategies. Participants will gain insights into the responsibilities, challenges, and best practices associated with test management in SAP projects. Additionally, the webinar delves into the significance of heatmaps as a visual aid for identifying testing priorities, areas of risk, and resource allocation within SAP landscapes. Through this session, attendees can expect to enhance their understanding of test management principles while learning practical approaches to optimize testing processes in SAP environments using heatmap visualization techniques What will you get from this session? 1. Insights into SAP testing best practices 2. Heatmap utilization for testing 3. Optimization of testing processes 4. Demo Topics covered: Execution from the test manager Orchestrator execution result Defect reporting SAP heatmap example with demo Speaker: Deepak Rai, Automation Practice Lead, Boundaryless Group and UiPath MVP

Leading Change strategies and insights for effective change management pdf 1.pdf

OnBoard

Smart TV Buyer Insights Survey 2024 by 91mobiles.pdf

91mobiles

Accelerate your Kubernetes clusters with Varnish Caching

Thijs Feryn

Kubernetes & AI - Beauty and the Beast !?! @KCD Istanbul 2024

Tobias Schneck

As AI technology is pushing into IT I was wondering myself, as an “infrastructure container kubernetes guy”, how get this fancy AI technology get managed from an infrastructure operational view? Is it possible to apply our lovely cloud native principals as well? What benefit’s both technologies could bring to each other? Let me take this questions and provide you a short journey through existing deployment models and use cases for AI software. On practical examples, we discuss what cloud/on-premise strategy we may need for applying it to our own infrastructure to get it to work from an enterprise perspective. I want to give an overview about infrastructure requirements and technologies, what could be beneficial or limiting your AI use cases in an enterprise environment. An interactive Demo will give you some insides, what approaches I got already working for real.

FIDO Alliance Osaka Seminar: FIDO Security Aspects.pdf

FIDO Alliance

LF Energy Webinar: Electrical Grid Modelling and Simulation Through PowSyBl -...

DanBrown980551

Do you want to learn how to model and simulate an electrical network from scratch in under an hour? Then welcome to this PowSyBl workshop, hosted by Rte, the French Transmission System Operator (TSO)! During the webinar, you will discover the PowSyBl ecosystem as well as handle and study an electrical network through an interactive Python notebook. PowSyBl is an open source project hosted by LF Energy, which offers a comprehensive set of features for electrical grid modelling and simulation. Among other advanced features, PowSyBl provides: - A fully editable and extendable library for grid component modelling; - Visualization tools to display your network; - Grid simulation tools, such as power flows, security analyses (with or without remedial actions) and sensitivity analyses; The framework is mostly written in Java, with a Python binding so that Python developers can access PowSyBl functionalities as well. What you will learn during the webinar: - For beginners: discover PowSyBl's functionalities through a quick general presentation and the notebook, without needing any expert coding skills; - For advanced developers: master the skills to efficiently apply PowSyBl functionalities to your real-world scenarios.

From Daily Decisions to Bottom Line: Connecting Product Work to Revenue by VP...

Product School

Encryption in Microsoft 365 - ExpertsLive Netherlands 2024

Albert Hoitingh

Software Delivery At the Speed of AI: Inflectra Invests In AI-Powered Quality

Inflectra

In this insightful webinar, Inflectra explores how artificial intelligence (AI) is transforming software development and testing. Discover how AI-powered tools are revolutionizing every stage of the software development lifecycle (SDLC), from design and prototyping to testing, deployment, and monitoring. Learn about: • The Future of Testing: How AI is shifting testing towards verification, analysis, and higher-level skills, while reducing repetitive tasks. • Test Automation: How AI-powered test case generation, optimization, and self-healing tests are making testing more efficient and effective. • Visual Testing: Explore the emerging capabilities of AI in visual testing and how it's set to revolutionize UI verification. • Inflectra's AI Solutions: See demonstrations of Inflectra's cutting-edge AI tools like the ChatGPT plugin and Azure Open AI platform, designed to streamline your testing process. Whether you're a developer, tester, or QA professional, this webinar will give you valuable insights into how AI is shaping the future of software delivery.

FIDO Alliance Osaka Seminar: Passkeys and the Road Ahead.pdf

FIDO Alliance

Empowering NextGen Mobility via Large Action Model Infrastructure (LAMI): pav...

Thierry Lestable

GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using Deplo...

James Anderson

Effective Application Security in Software Delivery lifecycle using Deployment Firewall and DBOM The modern software delivery process (or the CI/CD process) includes many tools, distributed teams, open-source code, and cloud platforms. Constant focus on speed to release software to market, along with the traditional slow and manual security checks has caused gaps in continuous security as an important piece in the software supply chain. Today organizations feel more susceptible to external and internal cyber threats due to the vast attack surface in their applications supply chain and the lack of end-to-end governance and risk management. The software team must secure its software delivery process to avoid vulnerability and security breaches. This needs to be achieved with existing tool chains and without extensive rework of the delivery processes. This talk will present strategies and techniques for providing visibility into the true risk of the existing vulnerabilities, preventing the introduction of security issues in the software, resolving vulnerabilities in production environments quickly, and capturing the deployment bill of materials (DBOM). Speakers: Bob Boule Robert Boule is a technology enthusiast with PASSION for technology and making things work along with a knack for helping others understand how things work. He comes with around 20 years of solution engineering experience in application security, software continuous delivery, and SaaS platforms. He is known for his dynamic presentations in CI/CD and application security integrated in software delivery lifecycle. Gopinath Rebala Gopinath Rebala is the CTO of OpsMx, where he has overall responsibility for the machine learning and data processing architectures for Secure Software Delivery. Gopi also has a strong connection with our customers, leading design and architecture for strategic implementations. Gopi is a frequent speaker and well-known leader in continuous delivery and integrating security into software delivery.

UiPath Test Automation using UiPath Test Suite series, part 3

DianaGray10

Connector Corner: Automate dynamic content and events by pushing a button

DianaGray10

Here is something new! In our next Connector Corner webinar, we will demonstrate how you can use a single workflow to: Create a campaign using Mailchimp with merge tags/fields Send an interactive Slack channel message (using buttons) Have the message received by managers and peers along with a test email for review But there’s more: In a second workflow supporting the same use case, you’ll see: Your campaign sent to target colleagues for approval If the “Approve” button is clicked, a Jira/Zendesk ticket is created for the marketing design team But—if the “Reject” button is pushed, colleagues will be alerted via Slack message Join us to learn more about this new, human-in-the-loop capability, brought to you by Integration Service connectors. And... Speakers: Akshay Agnihotri, Product Manager Charlie Greenberg, Host

Dev Dives: Train smarter, not harder – active learning and UiPath LLMs for do...

UiPathCommunity

💥 Speed, accuracy, and scaling – discover the superpowers of GenAI in action with UiPath Document Understanding and Communications Mining™: See how to accelerate model training and optimize model performance with active learning Learn about the latest enhancements to out-of-the-box document processing – with little to no training required Get an exclusive demo of the new family of UiPath LLMs – GenAI models specialized for processing different types of documents and messages This is a hands-on session specifically designed for automation developers and AI enthusiasts seeking to enhance their knowledge in leveraging the latest intelligent document processing capabilities offered by UiPath. Speakers: 👨‍🏫 Andras Palfi, Senior Product Manager, UiPath 👩‍🏫 Lenka Dulovicova, Product Program Manager, UiPath

AI for Every Business: Unlocking Your Product's Universal Potential by VP of ...

Product School

DevOps and Testing slides at DASA Connect

Kari Kakkonen

Recently uploaded (20)