DevSecOps - By Any Other Name
summary
Argues that “DevSecOps” often becomes a renamed silo unless an organization invests in tooling and process change; cites a 2020 GitLab survey showing no consensus on who owns security and real cases where automated security scans dump dozens of tickets into dev backlogs (e.g. 30 at once), which is unhelpful. Recommends platform enablement teams that build CI/CD, dependency management and deployment tooling (Amazon example) so developers configure but don’t manage patching or infra; this approach works but requires upfront investment and culture change.
AI-written summary · about
chapters (17)
- 0:00Intro
- 0:16Agenda
- 1:47Traditional silos
- 2:30Agile dream
- 3:29Orthogonal concerns
- 6:04Ideal outcomes
- 7:39Idealised transformation
- 8:13Typical transformation
- 8:34Living the dream
- 9:35Ops as platform team
- 11:45Who owns security?
- 15:46Building on DevOps
- 16:49Dev enablement
- 18:09What's in a name?
- 19:13The name is not the thing
- 20:19Dishonest
- 20:35Takeaways
related talks
06mDevSecOps is a Misnomer
38mDevSecOps - what does it mean and where is it taking us?
32mDevSecOps is Dead, Long Live DevSecOps
30mDevSecOps: More Than Just Pipelines
06mDevSecOps – Security Throughout the DevOps Pipeline
48mDevOps Is Automation, DevSecOps Is People
01h 02mDevSecOps for Developers: How To Start
23mTrue DevSecOps with People, Processes, and Technologies