From DevOps to DevSecOps
summary
A step-by-step framework proven at Comcast across 600 teams and 10,000 developers that moves teams from words to actions through 90‑day workshops: a coach-led meeting with the two‑pizza team, pipeline owner and business decision‑maker in the room, pick 1–3 prioritized practices, and commit to gates like branch protection checks and a tunable policy dial for SCA. Coaching plus dev toolsmiths feed pull‑request feedback so teams reduce production vulnerabilities ~6x, cut cost to one‑fourth, and hit ~93% adoption.
AI-written summary · about
chapters (9)
- 0:00Start
- 0:40The Theory of Constraints
- 0:52Weakest Link
- 5:34How Do You Get Developers To Change
- 13:55Three Ways of Devops
- 21:45The Maturity Model
- 29:35Install an Sda Tool in Github Actions
- 36:43Dev Blueprint
- 37:40Toolsmiths
related talks
30mThe future of Dev[Sec]Ops transformation
47mBuilding Security In—DevSecOps
30mDevSecOps: More Than Just Pipelines
36mHow to Turn DevOps into DevSecOps
31mDevSecOps, or How to Integrate Security into DevOps Practices
45mLessons From DevOps: Taking DevOps Practices Into Your AppSec Life
23mTrue DevSecOps with People, Processes, and Technologies
32mHow to fit Sec into DevOps without Security team