This document discusses plans for a DevSecOps meetup event in London in May 2019. It provides information on organizing the event including finding venues, speakers, and sponsors. It also lists related DevSecOps groups and conferences. At the end, it announces an anniversary event in September 2019 and provides initial details on speakers and topics.

1. DevSecOps – London Gathering
May 2019

2. THE JOURNEY …
• Venue (s)
• Do you need support from vendors
• Speakers
• What content
• Defining a theme
• Recordings; Streaming
• Give-aways (not prizes)
• Format of meetup
• How long
• Networking
• Collaboration

3. WAYS TO STAY IN TOUCH
https://www.meetup.com/DevSecOps-London-Gathering
https://twitter.com/DevSecOps_LG
https://www.linkedin.com/company/devsecops-london-gathering
https://github.com/DevSecOps-LondonGathering
https://www.youtube.com/channel/UCR4oVMkRjNN2OQaWMiBcfJA

4. SLIDES & REFERENCES
https://www.vr-security.com/references
https://www.vr-security.com/presentations

5. SHOUT OUT
*** Meetups ***
OWASP London Chapter
www.meetup.com/OWASP-London/
OWASP WIA
www.meetup.com/womeninappsec/
DevSecOps Manchester
www.meetup.com/DevSecOps-Manchester/
DevSecOps – Netherlands
www.meetup.com/DevSecOps-Netherlands/
LLHS
www.meetup.com/LLHS-Ladies-of-London-Hacking-Society/
*** Technology Specific ***
Istio London
www.meetup.com/Istio-London/
Kubernetes London
www.meetup.com/Kubernetes-London/
Threat Modeling
www.meetup.com/The-Threat-Modeling-Meetup/
Docker London
www.meetup.com/Docker-London/

6. SHOUT OUT
*** Conferences ***
DevSecCon London
https://www.devseccon.com/london-2019/
Open Security Summit
https://open-security-summit.org/
Bsides London
https://www.securitybsides.org.uk/

7. DEVSECOPS – LONDON GATHERING
ANNIVERSARY EVENT 2019
Date: Wednesday 11th September
Venue: Near St Paul’s
Speakers so far:
• Dr. Helen Thackray
Topics:
• Rounding up a few vendors to show us
how they conduct secure development.
• Playing back what hiring has been like the
last year.
Sponsorship/Support so far:

8. DevSecOps – People & Culture
• Break down the silo; no change here, just like the original DevOps movement
• Not aware of what is going on – likely you are not part of the “DevSecOps” team; leave your
ivory tower and build relationships
• Conduct a Value Stream Mapping exercise to optimize your delivery (rinse and repeat)
• Drill down and sketch out the details of each workflow before solutionising
• Try new checks/controls as part of the pipeline

9. IDE Static Code
Analysis
SCM
Dynamic
Analysis
Open Source
Software Security
Security Testing
Framework
Binary
Repository
Define
Security Test
CasesThreat
Modeling
Security
Standards
Automation
Tools: Passing
Criteria
Risk
Management
Out of Band
Security
Testing
Security
Champions
DevSecOps
Engineer
Security Audit
Artifacts
CI Build Server
DevSecOps – Tooling & Assurance Examples (May 2019)
curl
nmap
sslyze
sqlmap
Interactive
Testing
Infrastructure
Assurance
Threat
Modeling Container
Security

10. Dev Workstation Build Server
Centralize Report (Vulnerability Management) Server
SCM
Static Code Analysis
(SAST)
Dynamic Testing
(DAST)
Interactive Testing
(IAST)
Open Source Component Security
Manual Penetration Testing – Out of Band
Scope: Application and Network layer – White/Black box
Defect
Management
AUTOMATION
INTEGRATION POINTS
SECURITYASSURANCEMODEL
Updated: May 2019
Container Security
Infrastructure Scanning