An Unlikely Happy Couple - DevOps and IT Audit?
summary
Claims that continuous delivery and DevOps reduce organizational risk by design and that auditors can be satisfied by concrete controls and evidence. Recommend guard your pipeline, centralize and protect logs, enforce least privilege and tokenized auth, automate audit trails so every build traces to a commit and approver, and use a risk-based change matrix (low/medium/high) so many changes flow automatically. Example: an airline audit stopped a failing custom reservation project; Google practices validate the approach.
AI-written summary · about
chapters (26)
- 0:00Intro
- 0:25Joannes background
- 1:42Audits
- 2:08What are Audits
- 3:23Root Cause Analysis
- 4:20Reduce Risk
- 4:39Use of Technology
- 5:07The bottleneck
- 5:44Cybersecurity and breaches
- 6:36A dirty little secret
- 8:05Biggest risk
- 8:27Audit risk
- 9:56Audit methods
- 10:14Slow moving vehicle
- 10:40Risk reduction
- 12:06How to resolve the conundrum
- 12:18Create the common understanding
- 15:47Mind your access
- 20:25Provide evidence
- 21:15Riskbased approach to change
- 22:42The senior man
- 23:42Be disciplined
- 25:50Performance measurement
- 27:25Take responsibility
- 28:05Dont fight stupid
- 28:22Thank you
related talks
29mPanel Discussion: Ask an Auditor Anything: DevOps Compliance
32mHell Has Frozen Over: DevOps & Security
42mSolving for DevOps Auditors with Automated Compliance
01h 10mAuditors' Workshop: What You’ve Wanted to Ask an Auditor, but Were Afraid To Ask
33mCompliance Without the Chaos: Building It Right Into Your DevOps...
48mDesigning a Secure Software Development Lifecycle with DevOps
30mHandling Security Objections to DevOps
34mDevOps from an Auditor’s Perspective: A Meaningful Partnership to Drive Business Transformation