The document outlines strategies for integrating DevSecOps effectively within organizations, emphasizing the importance of relationships, maturity assessment, and a culture of security. It highlights the need for defined processes, checklists, and metrics to measure success while navigating the transition from DevOps to DevSecOps. The author, J. Wolfgang Goerlich, stresses the significance of collaboration and communication to achieve security as a product throughout the development lifecycle.

1. Zero to Ninety in Securing DevOps
J Wolfgang Goerlich
VP Strategic Programs, CBI

2. CIO CISO
Dev AppSecDevOps

3. Developers Security
It takes two years for
technology to go from
builders to breakers.

5. Relationships
Perception
Competency
Deliver Wins

7. DevSecOps
Learn
Assess
Plan

8. DevSecOps
Learn
Assess
Plan

9. Are we really doing
DevOps? Really?

10. Ad Hoc
Defined
Optimized
Ad Hoc
Defined
Optimized
DevOps
What are our levels
of maturity?

11. What is the CI/CD pipeline?
Wait … pipelines?

12. Who’s who?
Establish
relationships.

13. Wins
• Directory of people
• Inventory of DevOps’d apps
• Inventory of CI/CD pipelines
• Stay alive (task and stress management)

14. DevSecOps
Learn
Assess
Plan

15. Code
Review
SCA

16. Don’t go
too fast.

17. Assess.
Don’t audit.
(No one likes auditors)

18. Build a
Checklist.

19. Hug a Checklist
• NIST SP 800-64 Development Lifecycle
• NIST SP 800-190 Container Security
• ISO 27002 (Yeah, I know)
• ISO 27034 Application Security
• CSA Guidance 4.0 Application Security
• BSIMM, SAMM Maturity

20. And the most important checklist of them
all … the one from the Customers.

21. Follow the money.

22. Assess and?
Build
relationships.

23. Wins
• Find a champion Advisory council
• Find a pilot pipeline Business case
• Define a maturity model Security backlog
• Still alive (task and stress management)

24. DevSecOps
Learn
Assess
Plan

25. Threat
Model Vuln

26. Measure success.
Define metrics.

27. Create a culture of quality and security
one line of code at a time

28. 30
90
60

30. Security as a Product

31. Security as a Product
• Features: Security Requirements
• Process: Borrow from DevOps
• Experience: Borrow from UXD
Apply industrial design principles and
DevOps methods to build our product

32. Wins
• Innovators and adopters Advisory council
• Pipeline security feature Business case
• Communicate roadmap Security backlog
• Alive! So alive. And kicking!

33. DevSecOps
Learn
Assess
Plan
Relationships
Perception
Competency
Deliver Wins

34. DevSecOps
Learn
Assess
Plan
Follow the Money
Build a Backlog
Define Success
Implement, Iterate

35. J Wolfgang Goerlich
VP Strategic Programs, CBI
@jwgoerlich
https://jwgoerlich.com
Thank you.