This document introduces DevSecOps, which aims to integrate security practices into DevOps workflows. It discusses how traditional security controls from specialists are not scalable for rapid DevOps development cycles. DevSecOps emphasizes building security into the development process from the start rather than adding it later. Engineering teams take ownership of how their applications perform securely in production. The DevSecOps manifesto focuses on principles like building security in, relying on empowered teams, implementing features securely through continuous learning and culture change rather than policy enforcement.

1. Introduction to
DevSecOps
Tushar Joshi
Senior Architect @ Persistent Systems
12 May 2019 @ OWASP Nagpur Meetup

2. Need for DevSecOps
• Full StackOverflow Development
• DevOps accelerate the speed of development
• Security controls from Security Specialists non-scalable
• Security must be primary concern of development team

3. What is DevOps
• A new role?
• Partnership/communication/empathy between Dev and Ops
• CI/CD Tools?
• Automation?
• Self Service?
• Techniques like feature flags or traffic shaping?
• Move fast and break things?
• Culture change( systems thinking, continuous improvements?)

4. DevOps IS
• Empowered engineering teams
• Taking ownership of how the product/application
• Performs in Production

5. Mature DevOps Practices
• Develop in TRUNK
• No long lived branches
• Short branches – code review, release changes, security scanning
• Dead end release branch OK
• Feature behind flags, toggles, traffic shaping
• Automated validation, automated push to prod

6. What is Dev[Sec]Ops
• Thinking of security as a primary concern
• Empowered engineering teams
• Taking ownership of how their product/application
• Performs in production [including security]

7. Dev[Sec]Ops Manifesto
• Build security in
• more than bolt it on
• Rely on empowered engineering teams
• more than security specialists
• Implement features securely
• more than security features
• Rely on continuous learning
• more than end-of-phase gates
• Build on culture change
• more than policy enforcement

8. DevSecOps Tool Landscape

9. Thank You!
There are no silly questions!

10. References
• https://www.youtube.com/watch?v=BA9DqsgfgRQ
• https://linkedIn.com/in/LarryMaccherone
• https://www.devsecopsdays.com/articles/devsecops-securing-
software-in-a-devops-world
• https://christianheilmann.com/2015/07/17/the-full-stackoverflow-
developer/
• https://snyk.io/opensourcesecurity-2019/
• https://prezi.com/view/zhn9TQFjQexTQqQk5jwT/
• https://www.devsecopsdays.com/articles/trust-algorithm-applied-to-
devsecops