Organizational Change Through The Power Of Why - SecDevOps Enablement
summary
An internal SecDevOps program introduces category-based security controls surfaced as Trello boards (populated by a Python script) and tracked via Trello webhooks into a maturity model used across 40 teams. Controls pair why/ how content (case studies plus STRIDE threat modeling) with tools like Talisman, gitleaks, ScoutSuite and Sumo Logic. Security champions are nominated by tech principals, co-facilitate 90-minute threat models, and the program yields a measurable ~25% increase in reported incidents and faster remediation.
AI-written summary · about
chapters (13)
- 0:00SecDevOps enablement journey
- 3:01Traditional security challenges
- 5:31Security Center of Excellence
- 7:16Security Champion program lessons
- 10:26Security controls with Why and How
- 14:01Integrating security controls
- 16:27Business value of security
- 18:34Empowering teams with ownership
- 21:04Security maturity visualization
- 24:42Data-driven risk decisions
- 25:25Security Champions support
- 28:14Measuring security impact
- 31:23SecDevOps takeaways
related talks
42mFrom Devops to DevSecOps
53mThe Psychology of DevSecOps
51mThe End of DevSecOps?
30mHandling Security Objections to DevOps
30mSecuring DevOps using OWASP DevSecOps Tools
38mChampioning Security for your Agile Development
31mWhy SecDevOps is the new way in Cybersecurity?
36mHow to Turn DevOps into DevSecOps