A DevSecOps Tale of Business, Engineering, and People
Talkat OWASP Global AppSec DC 2019 · on Friday, 2019-09-13· at 18:00· Salon 2, Marriott Wardman Park Hotel·
summary
A historical failure (two trains, ~40,000 spectators, boilers exploding) frames a concrete claim: treat security as engineering practice with measurable experiments and tooling. The MEASURE framework lists maker‑driven, experimenting, automating, safety‑aware, unrestrained sharing, ruggedizing, empathy. Examples include codeable security, CI/CD pipeline tests, SCA, WAFs, container checks, deception/honeypots and chaos experiments; a reported outcome is 15,000 deploys in 3½ years at one company, showing frequent deploys plus instrumentation and blameless postmortems actually work.
AI-written summary · about
chapters (6)
- 0:00Start
- 21:12DEVSECOPS FRAMEWORK: MEASURE
- 22:36SECURITY MUST BE ABLE TO WRITE CODE
- 25:08A BUG IS A BUG IS A BUG
- 41:31CULTURE IS THE MOST IMPORTANT ASPECT TO DEVOPS SUCCEEDING IN THE ENTERPRISE
- 52:36QUESTIONS
related talks
39mThe Path Of DevOps Enlightenment For InfoSec
31mDevOps: You Build It, You Secure It
49mEverything is Terrible: Three Perspectives on Building, Configuring, and Securing Software
57mBuilding a Modern Security Engineering Organization
30mThe 3 Ways of DevSecOps – Making Shift Happen
34mDevSecOps: How to Use DevOps to Make You More Secure
31mDevSecOps, or How to Integrate Security into DevOps Practices
26mDevSecOps: The Good, the Bad and the Ugly