The 3 Ways of DevSecOps – Making Shift Happen
summary
Claims that shifting security left yields reduced schedule risk, higher confidence and reduced costs and proves feasible at scale for a large bank that manages thousands of applications. Argues modern apps contain 80–95% open-source code, so measurement and supply‑chain checks matter. Recommends concrete steps: run CI/CD-integrated automated testing and the same scanners on developers’ desktops, require pre-check-in pen tests for risky work, instrument metrics and feedback loops, and embed security champions in teams to teach and triage.
AI-written summary · about
chapters (29)
- 0:00Introduction
- 2:28BMO
- 2:42Applications
- 3:29Software
- 4:23Modern Applications
- 6:24Two Outcomes
- 7:27Waterfall vs Agile vs DevOps
- 10:21The goal of an application security program
- 11:11Cost
- 11:31Jet Engine Example
- 12:58The Problem with Security
- 14:35The Cost of a Bug
- 16:25The Goal of the Application Security Program
- 18:57The Strategy
- 19:43Systems Thinking
- 20:03Relationships
- 20:26Why DevOps
- 21:06Business Card
- 21:36We are here to help
- 22:51Feedback loops
- 23:55Measuring
- 25:15Training
- 25:35Security
- 25:55Automation
- 26:49Help
- 27:21Experimentation Learning
- 27:59Take a Step Back
- 28:36Share Your Mistakes
- 28:58Security Champions
related talks
22mShifting left, how security fits into the DevOps story
31mWhy SecDevOps is the new way in Cybersecurity?
34mDevSecOps: How to Use DevOps to Make You More Secure
36mUnderstanding the Sec in DevSecOps: Beyond Just Shifting Left
31mDevOps: You Build It, You Secure It
01h 02mDevSecOps for Developers: How To Start
39mDevOps: The Return of Security
54mFrom App Security to Dev Security – Shift left with GitHub Advanced Security