When DevOps Meets Security
summary
Government Digital Service builds gov.uk and proves rapid delivery is possible, claiming deploy six times a day and showing that traditional accreditation breaks down: a quick audit finds 95% of changes bypassed the old process. The guidance publishes eight principles (accept uncertainty, embed security in teams, threat-aware decisions) and promotes concrete practices: standard threat models, automated penetration testing, anti-personas, attack trees, red teams and integrated repeatable tests that teams own to shift security from a gate to an enabler.
AI-written summary · about
chapters (35)
- 0:00Introduction
- 0:53Government Digital Service
- 3:58The state of information security in 2015
- 4:39Approval to operate
- 5:15Certification
- 5:39Traditional model
- 9:08Agile changes everything
- 9:36Focus on flow and cycle time
- 11:07A security nightmare!
- 11:18Security needs to be an enabler
- 12:00Biggest consistent finding?
- 13:35Principles over rules
- 13:47The UK Government published 8 principles
- 14:17Accept uncertainty
- 14:34Security as part of the team
- 15:07Understand the risks
- 16:14Trust decision making
- 16:38Security is part of everything
- 16:48User experience is important
- 17:30Audit decisions
- 18:06Understand big picture impact
- 18:46Choose security model that's appropriate
- 19:22Understand the threats
- 20:32Educate decision makers to risks
- 20:47Make risk decisions, per story, in the team
- 21:13What do you do about it?
- 21:38Transfer
- 21:58Mitigate
- 23:06Deter, Detect, Prevent
- 23:19Reactive countermeasures
- 23:34Traditional security people understand this
- 24:04Misuse cases
- 24:33Attack trees
- 24:54Red teams
- 25:36Automated Integrated Repeatable
related talks
34mDevSecOps: How to Use DevOps to Make You More Secure
39mThe Path Of DevOps Enlightenment For InfoSec
39mDevOps: The Return of Security
48mWhen DevOps Meets Regulation: Integrating 'Continuous' with 'Government'
06mDevSecOps – Security Throughout the DevOps Pipeline
27mDevSecOps: How to Use DevOps to Make You More Secure
31mDevOps: You Build It, You Secure It
30mThe 3 Ways of DevSecOps – Making Shift Happen