The Operationalism of DevSecOps
summary
Argues that applying Bridgman/Deming operationalism fixes fuzzy DevSecOps metrics by forcing criteria, test, decision definitions; demonstrates using control charts and Donald Wheeler’s statistical process control to spot a container-scan vulnerability trend after a team change (real anonymized weekly data). Runs a Pareto-style analysis over 1,169 controls across 285 frameworks (Secure Control Framework) to reduce cyclomatic risk complexity, and prototypes a YAML DSL linting tool that flags service-mesh/Envoy misconfigurations and missing access logs.
AI-written summary · about
chapters (15)
- 0:00Introduction
- 2:28What is operationalism
- 4:54Dr. Deming’s influence
- 7:21Vague metrics problem
- 9:06DORA metrics need clarity
- 11:54Measurement criteria test
- 13:20Statistical process control
- 15:07Risk control charts examples
- 17:15Risk complexity definitions
- 18:17Verification vs validation
- 20:00Pareto analysis for risks
- 21:24Cyclomatic complexity reduction
- 22:47Secure control frameworks
- 23:49Zero trust governance
- 25:12Final thoughts and key takeaways
