Frequently cited as an obstacle to producing software at DevOps speed, information security is an important, yet still often neglected, element in today’s modern software delivery teams. Though the DevSecOps movement is in its infancy, there are proven patterns that work and use cases to learn from. This webinar, presented by Derek Weeks, Vice President & DevOps Advocate, Sonatype, Tim Buntel, Vice President of Products, XebiaLabs and special guest, Gene Kim will discuss them. You’ll also hear discussion around some of the more common people, process, and tool challenges enterprise DevSecOps teams are facing as well as the business value organizations are seeing from their early DevSecOps efforts.

1. Crossing the DevOps &
InfoSec Divide
Gene Kim, DevOps Researcher, Co-author of “The DevOps
Handbook” and “The Phoenix Project”
Derek Weeks, VP and DevOps Advocate, Sonatype
Tim Buntel, VP of Products, XebiaLabs

2. Housekeeping
▪ This webinar is being recorded
▪ Links to the slides and the recording will
be made available aNer the presentaOon
▪ You can post quesOons via the
GoToWebinar Control Panel

3. Meet your presenters
Gene Kim
DevOps Researcher, Co-author of
“The DevOps Handbook” and
“The Phoenix Project”
Derek Weeks
VP and DevOps Advocate
Sonatype
Tim Buntel
VP of Products
XebiaLabs

4. The Hard Truth
State of DevOps & InfoSec Today

5. 100:1
Developers Outnumber
ApplicaOon Security
Source: Sonatype DevSecOps Community Survey, 2017

6. Waterfall-naOve
teams introduce
security late,
extending
feedback loops

7. Are InfoSec teams/policies slowing IT down?
Source: Sonatype DevSecOps Community Survey, 2017

8. Keeping security in its place

9. 100:1
developers outnumber
applicaOon security
Misaligned metrics
create culture of blame

10. KPIs and Metrics in OpposiOon
• Releasing soNware
• Cycle Ome reducOon
• Story points
• PrevenOng (bad) soNware from being released
• Returning it to development stage
• ApplicaOon coverage
Development
Security

12. The Good News
PaYerns that Work

13. High performers are more agile
200x 2,555x
More Frequent
Deployments
Faster Lead Times
than their Peers
Source: Puppet/DORA: 2016 State Of DevOps Report: https://puppet.com/resources/white-paper/2016-state-of-devops-report

14. High performers are more reliable
3x 24x
Lower Change
Failure Rate
Faster Mean Time to
Recover (MTTR)
Source: Puppet/DORA: 2016 State Of DevOps Report: https://puppet.com/resources/white-paper/2016-state-of-devops-report

15. High performers are more secure and controlled
2x 29%
Less Time Spent
Remediating
Security Issues
More Time Spent
on New Work
Source: Puppet/DORA: 2016 State Of DevOps Report: https://puppet.com/resources/white-paper/2016-state-of-devops-report

16. Capital One: DevSecOps
Source: Tapabrata Pal, Capital One
DevSecOps

17. Keeping security in its place

18. Where is security being automated?
Source: Sonatype DevSecOps Community Survey, 2017

19. Saving 56,000
hours

20. Build security in
Make Security For example…
Part of the Team
(not another team)
Security Champions in Dev
Part of the Product
(not something done to the
product)
Abuser Stories Right Along with
User Stories
Part of the Mission
(not something to get past)
Career Development, Security Bug
Bounty,

21. “Ask a programmer to review ten lines of code,
they’ll find ten issues. Ask them to review five hundred
lines of code, they’ll say: ‘looks good.’ ”
– Giray Özil, on code reviews

22. DevSecOps PaYerns
Ensure Security of Our SoLware Supply Chain
Ensure Security of the Environment
Integrate InformaMon Security into ProducMon
Telemetry
CreaMng Security Telemetry in Our ApplicaMons
CreaMng Security Telemetry in Our Environment
Protect Our Deployment Pipeline
Source: DevOps Handbook
Integrate Security into Development IteraMon
DemonstraMons
Integrate Security into Defect Tracking and Post
Mortems
Integrate PrevenMve Security Controls into
Shared Source Code Repositories and Shared
Services
Integrate Security into Our Deployment
Pipeline
Ensure Security of the ApplicaMon

23. Register for Part 2 in this webinar series!
Thursday, April 27th 8am PT | 11am ET | 5pm CET
A DevSecOps Demo:
Early, Everywhere, At Scale
hYp://bit.ly/XL-Sonatype
Rob Vanstone
XebiaLabs
Ilkka Turunen
Sonatype

24. QuesOons?

25. Thank You!