Let's build with DevSecOps This document discusses DevSecOps and provides guidance on building a DevSecOps program and architecture. It outlines a general 3-line DevSecOps architecture model and discusses key DevSecOps principles like minimal viable security, continuous verification, and zero trust architecture. The document advocates adopting modern DevSecOps solutions and standards from organizations like NIST, SPIFEE, and ISO to establish automated governance, distributed trust, and high assurance auditing.

1. Let's build with DevSecOps
Culture
By : Vishwas Narayan
DevSecOps
Institution

2. What will DevSecOps Look like
If DevOps Existed
If DevOps did not Existed
Program manager to
Developer

4. General DevSecOps Architecture - 3 lines Model
Guide pratique _
Audit interne et 2ème
ligne de maîtrise.pdf
(theiia.org)

5. General DevSecOps Architecture - 3 lines Model

6. DoD Enterprise
DevSecOps Reference
Design v1.0_Public
Release.pdf
(defense.gov)

7. DEV OPS
Change
Stabilit
y

8. Conway’s Law
“Any organization that designs a system (defined more
broadly here than just information systems) will
inevitably produce a design whose structure is a copy of
the organization's communication structure”

9. Minimal Viable Security
● How do you prove that we are safe?
● How do we demonstrate that we are secure?
● How are we Rollbacking for Chaos?Is it a right or a wrong Strategy

10. Security Transition is Crazy
Change the Right way don't mess it up - make it the ultimate objective and rule the
Ops and let the Dev’s also make some decision.

11. Take Risk by
● Change Management
● Continuous Verification
● Make a major mechanical shift

14. Guidance on Cloud Security Assessment and Authorization (ITSP.50.105) - Canadian Centre for Cyber Security

16. Have some Defensive Strategy
Detect and Respond

17. Build a Architecture for the Trust
● Perimeter Based Trust for the Architecture
● Zero Trust Architecture
● Distributed Trust for the System Design

18. Make a Impact now just be novel for this Era
● Data Mesh for the less Critical Data
● DevOps Automated Governance
● Distributed Trust model,Identity and Secrets
● Make Sure You have high Trust Audits

19. DevOps Automated Architecture
Dependency
Management
Artifactory
Repository

20. So now we have the Modern Solution for the World
● NIST 800-207
● SPIFEE
● SigStore
● CNSF
● ISO
● CFA
● And so on

21. Zero Trust Architecture (nist.gov)

22. Reason I and you Exist today is Because old folks also
Did
DevSecOps