DevSecOps Worst Practices

on YouTube ↗45m

" summary

Claims 15 recurring DevSecOps failures uncovered from work with over 300 large enterprises: vendors promise zero false positives yet scans take hours and break builds on false positives, teams flip tools on without staging, CI/CD gates become artificial blockers, tests hog resources, and a bank paying $2M/year still misconfigures rollout. Recommends a two‑SLA approach (chip away at legacy criticals while preventing new highs), surface results into developers’ trackers, stage and tune tools before breaking builds, and train staff.

AI-written summary · about

" chapters (17)

1. 0:00Introduction to devsecops
2. 1:38The importance of sharing
3. 5:50Breaking builds on false positives
4. 8:22Testing tools properly
5. 10:14Avoiding artificial gates
6. 11:56Managing test results
7. 14:16Handling runaway tests
8. 17:18Realistic SLAs
9. 21:51Training and support
10. 24:35Backlog maintenance
11. 25:58Positive reinforcement
12. 27:42Collaborative security
13. 30:56Centralized bug tracking
14. 33:02Comprehensive SDLC
15. 34:52Securing CI/CD permissions
16. 36:01Automating outside CI/CD
17. 38:15Conclusion and resources

" related talks

• 26mDevSecOps: The Good, the Bad and the UglyNivedita Murthy · BSides Vancouver 2021
• 29mDevSecOps: Five Common MistakesArjan Gelderblom · Codemotion Amsterdam 2018
• 32mDevSecOps is Dead, Long Live DevSecOpsKymberlee Price · DevOpsDays Washington, D.C. 2024
• 43mTen DevSecOps Culture FailuresChris Romero · Global AppSec Dublin 2023
• 05m5 Pitfalls of Using DevOps to GovernTanusree McCabe · DevOpsDays Washington, D.C. 2024
• 13mTen Ways to Doom Your DevSecOpsGene Gotimer · Conf42 DevSecOps 2023
• 39mDevOps: The Return of SecurityMustafa Toroman · AzConf 2020
• 53mDevSecOps Next: Navigating the Next Era with Industry TitansSid Choudhury, Eyal Dyment, Basheer Janjua · RSA Conference 2024