Wrangling Compliance in the Wild West of Software Delivery
summary
Argument that compliance must become governance with measurable risk controls, not checkbox theater. Defines three enforceable controls: two sets of eyes, least privilege, and only approved changes to production. Recommends source everything, peer reviews, pipelines as the only path to production with break‑glass for emergencies, and automated attestation from tool data. Warns against “block left” false positives, cites the 2019 DevOps Automated Governance paper and the book Investment Unlimited as implementation references.
AI-written summary · about
chapters (11)
- 0:00Introduction and journey
- 6:26DevOps and the missing groups
- 9:13Compliance and governance explained
- 12:49Risk management in SDLC
- 16:25Why controls are necessary
- 18:11Modern SDLC controls
- 21:39Least privilege and automation
- 24:07Attestation and data
- 26:17DefSecOps and shift left
- 28:31Shift left is not block left
- 30:38Q&A and closing
related talks
22mPutting Governance Into your DevOps Processes
33mCompliance as Code - Lessons Learned From Regulated Organizations
22mRethinking Risk, Governance, and Compliance Applying Automation
43mRegulatory Compliance as a DevOps Enabler
33mCompliance Without the Chaos: Building It Right Into Your DevOps...
30mAutomating Governance - Dear Security, Compliance, & Auditors We’re Sorry. Love DevOps
05mHow To Automate Compliance If You Aren't Chuck Norris
22mKeynote Session: Compliance at the Point of Change: Security and Dev..