Lessons from DevSecOps Trenches
summary
A frank account of what actually works: a homemade dynamic analyzer once DOSed PagerDuty so scripts need operational testing; year‑long SAST/DAST rollouts largely fail; asset inventory requires data engineering and developer meeting attendance; buying then customizing vendors (account‑takeover JS, dependency scanners) beats building everything; building OSQuery and a WAF led to real protection and Signal Sciences emerged; paved‑road checks cut impact by ~30%; use MITRE ATT&CK matrices for detections, simple grep rules in CI scale, and social tactics (candy, buying drinks) surface critical bugs fast.
AI-written summary · about
chapters (10)
- 0:00Introduction and panel setup
- 3:09Failed DevSecOps projects
- 7:21Building asset inventory
- 10:27Build vs buy decisions
- 17:41AppSec scanning in pipelines
- 22:53Effective red teams
- 29:18Threat modeling at scale
- 34:32High-ROI security metrics
- 40:46Security engagement strategies
- 45:18First priorities in new org
related talks
57mBuilding a Modern Security Engineering Organization
48mThe Quick Wins of DevSecOps
30mSecuring DevOps using OWASP DevSecOps Tools
45mDevSecOps : add Security to your DevOps!
33mBattle Tested Application Security
34mDevSecOps: How to Use DevOps to Make You More Secure
51mNot Go Quietly Adaptive Strategies and Unlikely Teammates
30mDevSecOps State of the Union