DevOps Is Automation, DevSecOps Is People
summary
Argues that security succeeds by changing human practices not just adding tools: embeds checks into the CI/CD pipeline (linters, automated secret scans), runs bug‑bounty triage and office hours to improve feedback, and cites a case where adding a verification timestamp in August cuts average vuln‑fix time from ~90+ days toward 30 days. Highlights Let’s Encrypt as a constructive DevOps solution, recommends role‑playing and cognitive‑bias awareness to shape measurable metrics and incentives.
AI-written summary · about
chapters (23)
- 0:00Intro
- 0:37DevOps
- 6:06Actual Problem Ignored
- 7:17Fantasy Campaign Setting
- 9:44CI/CD Pipeline
- 11:27Communication
- 13:10Risks
- 15:29Empathy
- 16:51Codes of Conduct
- 20:02RPG Threat Models
- 22:15RPG Interpersonal Skills
- 24:23A Fiendish Folio
- 26:43Monstrously Manual
- 28:38Weary of Awareness
- 29:09Meaningful Metrics
- 30:04Improving Fix Verification
- 36:16Unearthing Arcana
- 38:17Manual of the Planes
- 38:44Cognitive Biases
- 42:41Mind Flayer
- 44:06Tough 10(-ish) List
- 45:40Continuous Integration
- 46:15Continuous Deployment
related talks
39mDevOps: The Return of Security
31mDevOps: You Build It, You Secure It
34mDevSecOps: How to Use DevOps to Make You More Secure
23mDevSecOps - By Any Other Name
27mDevSecOps: How to Use DevOps to Make You More Secure
30mDevSecOps: More Than Just Pipelines
23mTrue DevSecOps with People, Processes, and Technologies
31mWhy SecDevOps is the new way in Cybersecurity?