Downloaded 18 times
Uploaded byAndrew Shafer
DevSecOps: The End of the Beginning - Austin
Andrew Clay Shafer expresses his disdain for the term 'devsecops,' reflecting on the evolution of DevOps and the necessity for collaboration among developers, operations, and security. He suggests that successful DevSecOps requires cultural shifts and continuous improvement, emphasizing that security should be integrated from the start rather than treated as an afterthought. The document concludes with a caution about the challenges of adopting new practices and the resistance to change that can occur.
More Related Content
Similar to DevSecOps: The End of the Beginning - Austin
DevSecOps: The End of the Beginning - Austin
- 1. devsecops Andrew Clay Shafer @littleidea theend of the beginning
- 2.
- 3.
- 4.
- 5.
- 6. I hate theword ‘DevSecOps’ I also hated the word ‘DevOps’ Before that I hated the word ‘Cloud’ But here we are Get off my lawn
- 7.
- 9.
- 10. I didn’t inventdevops. I stole it.
- 11.
- 14. 2009 Gent, BelgiumPatrick DeBois
- 16. Spectrum of Criticality CatPictures Finance Life & Death
- 17. devops - calms •culture • automation • (lean) • metrics • sharing Damon Edwards and John Willis (plus Jez Humble)
- 18. what does thatmean? what am I supposed to do now?
- 19. tried to makethese actionable
- 20.
- 21.
- 22. Manual Scripted Platform toileffort directed catastrophic failure disaster recovery self healing incidents MTTR continuous partial failure Automation (And Architecture)
- 23. unmonitored measured insightful noinfo data SLI ssh aggregation dashboards never gets done secondary observability built in Metrics
- 24. hidden available ambient can’tfind searchable cultivated strong silos publish info share personally everything is secret secret to company global community Sharing
- 25. Lean Subsumes ALLthe Things ignore what a terrible metaphor manufacturing is for software
- 26.
- 27.
- 28. CALMS sounds betterthan CAMS ¯_(ツ)_/¯
- 29.
- 30.
- 31. lol try do security?after the fact first principles theatrics tools built in hide blame own Security
- 32. devops • developers andoperations can and should work together • system administration evolving to look more like software development • evolving together as global community sharing solutions Legacy me - in 2010
- 33. devsecops • developers ANDoperations AND security can and should work together • security is evolving to incorporate more software development • evolving together as global community sharing solutions me - in 2019
- 34. super computers everywhere connectingall human knowledge with high speed networks …to adversaries
- 35. every aspect ofhuman performance and experience that can be optimized will be… including owning you
- 36. optimizing human performanceand experience operating software… and humans with software… @littleidea’s definition of devops™:
- 37. optimizing human performanceand experience securing software… and humans with software… @littleidea’s definition of devsecops™:
- 38.
- 40.
- 41. implementing devops is nota thing
- 42. implementing devsecops is nota thing either
- 43. devops is neverdone
- 44. security is neverdone either
- 45. everyone wants thedevops Well actually…
- 46. what they reallywant • scalability • availability • reliability • operability • usability • observability • all for free • without changing anything
- 47.
- 48.
- 49.
- 50. everyone wants thedevsecops Well actually…
- 51.
- 52. don’t want toforget ‘how we do things here’
- 55.
- 56. security: the unfunded mandate incentivesdrive behaviors so weird…
- 57. people attach their identityto their tasks changing what they do is an attack on their identity
- 58. we have tomake them heroes in the new version of the story
- 59. developers are undera lot of pressure to do things… right now
- 60. we have tomake doing the ‘right thing’ the ‘easy thing’
- 62. your platform hasto audit and enforce your policy* *risk profile
- 63.
- 64. when devsecops issuccessful people will abuse the term and it will splinter into subcommunities
- 65. because infosec is notone thing either
- 66. what are theinfosec analogs for ‘observability’, ‘reliability’, ‘resiliance’ & ‘chaos’?
- 67. It ought tobe remembered that there is nothing more difficult to take in hand, more perilous to conduct, or more uncertain in its success, than to take the lead in the introduction of a new order of things. Because the innovator has for enemies all those who have done well under the old conditions, and lukewarm defenders in those who may do well under the new. Niccolò Machiavelli, The Prince
- 68.
- 69. I’m not hereto answer questions. I’m here to have conversations. Thank You