Security pros have written countless jokes and comics maligning developers' exultant disregard for security and lauding their own long-suffering devotion to repairing reckless dev teams' vulnerable code. Yet, this narrative -- which does nothing to improve application security -- has gone on long enough. This session will help you change the conversation and the trend. You'll learn how to speak developers' language, learn about the real pressures they face in a continuous delivery environment, and discover how to get Dev, Ops, and Security teams aligned and focused on a singular goal.

1. The Security Pro’s Guide To
DevSecOps
How To Get Developers To Write
Secure Code
@fpmosley3 | /in/franklinmosley |
franklin.mosley@ellucian.com

3. Destination: DevSecOps
Press Start
DevOps Processes
Automation
Learning

4. Who Am I?
• Information
Security
Professional
• Reincarnated
Software
Engineer

5. Traditional

6. Today

7. DevOps Cycle

8. Is there a reason I wasn’t invited to the party?

9. IT Operations

10. Developers

11. Security

12. Poll Question #1

13. 50%of developers know security is important but don’t have
enough time to spend on it.
Source: Sonatype 2017 DevSecOps Community Survey: https://www.sonatype.com/2017survey

14. Press Start

16. Risks
Policies
Data
Classification
Standards

17. DevOps Processes

18. Poll Question #2

19. What methodologies do your devs use?

20. User Stories
As a [role], I want to
[desired feature] so that
[value/benefit].

21. User Stories
As a customer, I want to
ensure my data is protected from
unintentional disclosure so that other
customers or external parties may
not access it.
Acceptance Criteria: Data is segregated by tenant.
Administrators and users must be separated by role to prevent
unauthorized disclosure or alteration.

22. How do they collaborate?

23. Collaboration Opportunities
ChatOps
Security Bot

24. Developers often outnumber AppSec
professionals by
Source: Sonatype 2017 DevSecOps Community Survey: https://www.sonatype.com/2017survey
100 to 1

25. What is a Security Champion?

26. Automation
Ahead

27. IASTDASTSAST
DevOps Pipeline
Golden Image Container
TestPackageBuildCode

29. Poll Question #3

30. Testing Challenges
• False Positives
• Long scan times
• Communicating
Findings
• Remediation

31. Measurement

32. Dashboard

34. Of U.S. computer science programs
1 of the
top 36
requires a security course for graduation
Source: CloudPassage

35. Computer-Based Training

36. Lunch & Learn

37. Gamification

38. DevSecOps

39. @fpmosley3 | /in/franklinmosley |
franklin.mosley@ellucian.com