SlideShare une entreprise Scribd logo
1  sur  27
Télécharger pour lire hors ligne
DevSecOps
- what does it mean and how will it impact agile teams?
Seb Rose
Twitter: @sebrose
Blog: https://cucumber.io/blog/
E-mail: seb.rose@smartbear.com
@sebrose seb.rose@smartbear.com
Agenda
DevOps
DevSecOps
What’s in a name?
@sebrose seb.rose@smartbear.com
Agenda
DevOps
DevSecOps
What’s in a name?
@sebrose seb.rose@smartbear.com
DevOps
Characterized by key principles: shared ownership, workflow automation, and
rapid feedback. At its most successful, DevOps is a combination of specific
practices, culture change, and tools.
“A set of practices intended to reduce the time between committing a change
to a system and the change being placed into normal production, while
ensuring high quality” - Bass, Weber, Zhu
There is no universally agreed
definition of the term.
https://en.wikipedia.org/wiki/DevOps
@sebrose seb.rose@smartbear.com
Idealised transformation (US)
With the help of a prospective board member
and his mysterious philosophy of The Three
Ways, Bill starts to see that IT work has more
in common with manufacturing plant work
than he ever imagined. With the clock ticking,
Bill must organize work flow streamline
interdepartmental communications, and
effectively serve the other business functions
at Parts Unlimited.
@sebrose seb.rose@smartbear.com
Idealised transformation (UK)
Watch a large software-intensive project,
called FPP, that has been running late since
day 1, but now, suddenly, needs to launch on
an impossibly early date, or else. You feel their
pain, and their joy, as they battle problem after
problem until, slowly, torturously, they
rediscover the few - but fundamental -
principles underlying successful commercial
software development.
@sebrose seb.rose@smartbear.com
Ideal outcomes
DORA metrics
- Lead/cycle time (shorter)
- Deployment frequency (higher)
- Mean time to restore (shorter)
- Change fail percentage (lower)
@sebrose seb.rose@smartbear.com
Typical transformation
Dev Ops
Dev
Dev Ops
Before After
Excessively
cynical
@sebrose seb.rose@smartbear.com
Living the dream
DevOps
@sebrose seb.rose@smartbear.com
Scaling the dream
DevOps
DevOps
DevOps
DevOps
DevOps
DevOps
DevOps DevOps
@sebrose seb.rose@smartbear.com
Ops as platform team
Platform
tools
Ops
Dev (use platform tools)
platform team
Dev (use platform tools)
Dev (use platform tools)
Dev (use platform tools)
Dev (use platform tools)
@sebrose seb.rose@smartbear.com
Agenda
DevOps
DevSecOps
What’s in a name?
@sebrose seb.rose@smartbear.com
Traditional silos
Dev Sec Ops
@sebrose seb.rose@smartbear.com
Agile dream
Dev Sec Ops
@sebrose seb.rose@smartbear.com
Orthogonal concerns
Dev practices and tools
Architecture and design
Build pipelines
Cloud providers
Source control
OWASP scans
Code vulnerabilities
DEVELOPMENT
S
E
C
U
R
I
T
Y
OPERATIONS
@sebrose seb.rose@smartbear.com
Who owns security?
Survey
2020
https://devops.com/whos-responsible-for-security-apparently-it-depends/
The [dev] team is
trusted to do its own
security research and
implementation
I regularly put security
suggestions in the
box of suggestions,
only to be ignored
There’s a security team, but it
doesn’t involve face to face
with us, the dev team. So we
just run the dev process
without counting on them
I am the only one
who actually cares
about security in
my organization
@sebrose seb.rose@smartbear.com
Desire paths
http://www.databoxdigital.com/2014/02/02/desire-paths/
@sebrose seb.rose@smartbear.com
Building on DevOps
Platform
tools
Ops
Dev (use tools provided)
Security
tools
Sec
@sebrose seb.rose@smartbear.com
Platform
tools
Dev enablement
Ops
Dev (specify & use tools)
Sec
Security
tools
@sebrose seb.rose@smartbear.com
Agenda
DevOps
DevSecOps
What’s in a name?
@sebrose seb.rose@smartbear.com
What’s in a name?
O, be some other name!
What’s in a name? That which we call a rose
By any other name would smell as sweet
William Shakespeare, Romeo and Juliet
@sebrose seb.rose@smartbear.com
The name is not the thing
@sebrose seb.rose@smartbear.com
Names are important
https://www.digdeeproots.com/articles/on/naming-process/
@sebrose seb.rose@smartbear.com
Honest
@sebrose seb.rose@smartbear.com
Dishonest
Dev
Sec
Ops
@sebrose seb.rose@smartbear.com
The name is not
the thing
Platform teams
facilitate delivery
AND
scaling consistency
Takeaways
Burnout is a thing
Seb Rose
Twitter: @sebrose
Blog: https://cucumber.io/blog/
E-mail: seb.rose@smartbear.com
http://bddbooks.com

Contenu connexe

Similaire à DevSecOps - Agile Get-Together 2022.pdf

DevSecOps IT Modernization Training Bootcamp for Security Staff, IT Leadership
DevSecOps IT Modernization Training Bootcamp for Security Staff, IT LeadershipDevSecOps IT Modernization Training Bootcamp for Security Staff, IT Leadership
DevSecOps IT Modernization Training Bootcamp for Security Staff, IT Leadership
Bryan Len
 

Similaire à DevSecOps - Agile Get-Together 2022.pdf (20)

DevOps Culture & Methodology Intro
DevOps Culture & Methodology IntroDevOps Culture & Methodology Intro
DevOps Culture & Methodology Intro
 
Managing delivery of your app with Azure DevOps by K.Thitaree & K.Seubpong
Managing delivery of your app with Azure DevOps by K.Thitaree & K.Seubpong Managing delivery of your app with Azure DevOps by K.Thitaree & K.Seubpong
Managing delivery of your app with Azure DevOps by K.Thitaree & K.Seubpong
 
What DevOps Isn't
What DevOps Isn'tWhat DevOps Isn't
What DevOps Isn't
 
Software architecture in a DevOps world
Software architecture in a DevOps worldSoftware architecture in a DevOps world
Software architecture in a DevOps world
 
Comprehensive Guide to Hire DevOps Engineer.pdf
Comprehensive Guide to Hire DevOps Engineer.pdfComprehensive Guide to Hire DevOps Engineer.pdf
Comprehensive Guide to Hire DevOps Engineer.pdf
 
DevOps Torino Meetup - DevOps Engineer, a role that does not exist but is muc...
DevOps Torino Meetup - DevOps Engineer, a role that does not exist but is muc...DevOps Torino Meetup - DevOps Engineer, a role that does not exist but is muc...
DevOps Torino Meetup - DevOps Engineer, a role that does not exist but is muc...
 
DevOps
DevOpsDevOps
DevOps
 
Dev ops
Dev opsDev ops
Dev ops
 
DevSecOps IT Modernization Training Bootcamp for Security Staff, IT Leadership
DevSecOps IT Modernization Training Bootcamp for Security Staff, IT LeadershipDevSecOps IT Modernization Training Bootcamp for Security Staff, IT Leadership
DevSecOps IT Modernization Training Bootcamp for Security Staff, IT Leadership
 
50 Shades of DevOps
50 Shades of DevOps50 Shades of DevOps
50 Shades of DevOps
 
DEVOPS COURSE PDF.pdf
DEVOPS COURSE PDF.pdfDEVOPS COURSE PDF.pdf
DEVOPS COURSE PDF.pdf
 
DevOps + Azure
DevOps + AzureDevOps + Azure
DevOps + Azure
 
Skills Matter DevSecOps eXchange Forum 2022 - Software architecture in a DevO...
Skills Matter DevSecOps eXchange Forum 2022 - Software architecture in a DevO...Skills Matter DevSecOps eXchange Forum 2022 - Software architecture in a DevO...
Skills Matter DevSecOps eXchange Forum 2022 - Software architecture in a DevO...
 
JavaLand 2022 - Software architecture in a DevOps world
JavaLand 2022 - Software architecture in a DevOps worldJavaLand 2022 - Software architecture in a DevOps world
JavaLand 2022 - Software architecture in a DevOps world
 
DevOps:建造開發維運的跨界之橋 (@ C.C. Agile #37)
DevOps:建造開發維運的跨界之橋 (@ C.C. Agile #37)DevOps:建造開發維運的跨界之橋 (@ C.C. Agile #37)
DevOps:建造開發維運的跨界之橋 (@ C.C. Agile #37)
 
DevOps The Cultural revolution
DevOps The Cultural revolutionDevOps The Cultural revolution
DevOps The Cultural revolution
 
DevOps for the DBA
DevOps for the DBADevOps for the DBA
DevOps for the DBA
 
DevOps to DevSecOps Journey..
DevOps to DevSecOps Journey..DevOps to DevSecOps Journey..
DevOps to DevSecOps Journey..
 
All daydevops 2016 - Turning Human Capital into High Performance Organizati...
All daydevops   2016 - Turning Human Capital into High Performance Organizati...All daydevops   2016 - Turning Human Capital into High Performance Organizati...
All daydevops 2016 - Turning Human Capital into High Performance Organizati...
 
Azure article
Azure articleAzure article
Azure article
 

Plus de Seb Rose

Software testing - learning to walk again (expoQA22)
Software testing - learning to walk again (expoQA22)Software testing - learning to walk again (expoQA22)
Software testing - learning to walk again (expoQA22)
Seb Rose
 
Software contracts or: how I learned to stop worrying and love releasing. Agi...
Software contracts or: how I learned to stop worrying and love releasing. Agi...Software contracts or: how I learned to stop worrying and love releasing. Agi...
Software contracts or: how I learned to stop worrying and love releasing. Agi...
Seb Rose
 

Plus de Seb Rose (20)

Software contracts - Global Enterprise Agile 2023.pdf
Software contracts - Global Enterprise Agile 2023.pdfSoftware contracts - Global Enterprise Agile 2023.pdf
Software contracts - Global Enterprise Agile 2023.pdf
 
Micro-service delivery - without the pitfalls
Micro-service delivery - without the pitfallsMicro-service delivery - without the pitfalls
Micro-service delivery - without the pitfalls
 
Contract testing - Sealights 2022.pdf
Contract testing - Sealights 2022.pdfContract testing - Sealights 2022.pdf
Contract testing - Sealights 2022.pdf
 
Example mapping - slice any story into testable examples - SoCraTes 2022.pdf
Example mapping - slice any story into testable examples - SoCraTes 2022.pdfExample mapping - slice any story into testable examples - SoCraTes 2022.pdf
Example mapping - slice any story into testable examples - SoCraTes 2022.pdf
 
Software testing - learning to walk again (expoQA22)
Software testing - learning to walk again (expoQA22)Software testing - learning to walk again (expoQA22)
Software testing - learning to walk again (expoQA22)
 
A brief history of requirements - Unicom 2022
A brief history of requirements  - Unicom 2022A brief history of requirements  - Unicom 2022
A brief history of requirements - Unicom 2022
 
Example mapping (with builds) - ProductWorld 2022
Example mapping (with builds)  - ProductWorld 2022Example mapping (with builds)  - ProductWorld 2022
Example mapping (with builds) - ProductWorld 2022
 
Example mapping - ProductWorld 2022
Example mapping - ProductWorld 2022Example mapping - ProductWorld 2022
Example mapping - ProductWorld 2022
 
No code, low code, machine code QA ATL 2021
No code, low code, machine code   QA ATL 2021No code, low code, machine code   QA ATL 2021
No code, low code, machine code QA ATL 2021
 
No code, low code, machine code QA ATL 2021
No code, low code, machine code   QA ATL 2021No code, low code, machine code   QA ATL 2021
No code, low code, machine code QA ATL 2021
 
No code, low code, machine code - Unicom 2021
No code, low code, machine code -  Unicom 2021No code, low code, machine code -  Unicom 2021
No code, low code, machine code - Unicom 2021
 
BDD: from soup to nuts - The Future of Work Scotland 2021
BDD: from soup to nuts  - The Future of Work Scotland 2021BDD: from soup to nuts  - The Future of Work Scotland 2021
BDD: from soup to nuts - The Future of Work Scotland 2021
 
Contrasting test automation and BDD - 2020
Contrasting test automation and BDD - 2020Contrasting test automation and BDD - 2020
Contrasting test automation and BDD - 2020
 
Are BDD and test automation the same thing? Automation Guild 2021
Are BDD and test automation the same thing?   Automation Guild 2021Are BDD and test automation the same thing?   Automation Guild 2021
Are BDD and test automation the same thing? Automation Guild 2021
 
"Our BDDs are broken!" Lean Agile Exchange 2020
"Our BDDs are broken!"   Lean Agile Exchange 2020"Our BDDs are broken!"   Lean Agile Exchange 2020
"Our BDDs are broken!" Lean Agile Exchange 2020
 
User stories: from good intentions to bad advice - Agile Scotland 2019
User stories: from good intentions to bad advice - Agile Scotland 2019User stories: from good intentions to bad advice - Agile Scotland 2019
User stories: from good intentions to bad advice - Agile Scotland 2019
 
User stories: from good intentions to bad advice - Lean Agile Scotland 2019
User stories: from good intentions to bad advice - Lean Agile Scotland 2019User stories: from good intentions to bad advice - Lean Agile Scotland 2019
User stories: from good intentions to bad advice - Lean Agile Scotland 2019
 
Software contracts or: how I learned to stop worrying and love releasing. Agi...
Software contracts or: how I learned to stop worrying and love releasing. Agi...Software contracts or: how I learned to stop worrying and love releasing. Agi...
Software contracts or: how I learned to stop worrying and love releasing. Agi...
 
What is a user story anyway - lightning talk 2018
What is a user story anyway - lightning talk 2018What is a user story anyway - lightning talk 2018
What is a user story anyway - lightning talk 2018
 
Contract testing and Pact
Contract testing and PactContract testing and Pact
Contract testing and Pact
 

Dernier

Histor y of HAM Radio presentation slide
Histor y of HAM Radio presentation slideHistor y of HAM Radio presentation slide
Histor y of HAM Radio presentation slide
vu2urc
 

Dernier (20)

Tech Trends Report 2024 Future Today Institute.pdf
Tech Trends Report 2024 Future Today Institute.pdfTech Trends Report 2024 Future Today Institute.pdf
Tech Trends Report 2024 Future Today Institute.pdf
 
Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...
Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...
Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...
 
Axa Assurance Maroc - Insurer Innovation Award 2024
Axa Assurance Maroc - Insurer Innovation Award 2024Axa Assurance Maroc - Insurer Innovation Award 2024
Axa Assurance Maroc - Insurer Innovation Award 2024
 
Workshop - Best of Both Worlds_ Combine KG and Vector search for enhanced R...
Workshop - Best of Both Worlds_ Combine  KG and Vector search for  enhanced R...Workshop - Best of Both Worlds_ Combine  KG and Vector search for  enhanced R...
Workshop - Best of Both Worlds_ Combine KG and Vector search for enhanced R...
 
Automating Google Workspace (GWS) & more with Apps Script
Automating Google Workspace (GWS) & more with Apps ScriptAutomating Google Workspace (GWS) & more with Apps Script
Automating Google Workspace (GWS) & more with Apps Script
 
04-2024-HHUG-Sales-and-Marketing-Alignment.pptx
04-2024-HHUG-Sales-and-Marketing-Alignment.pptx04-2024-HHUG-Sales-and-Marketing-Alignment.pptx
04-2024-HHUG-Sales-and-Marketing-Alignment.pptx
 
Driving Behavioral Change for Information Management through Data-Driven Gree...
Driving Behavioral Change for Information Management through Data-Driven Gree...Driving Behavioral Change for Information Management through Data-Driven Gree...
Driving Behavioral Change for Information Management through Data-Driven Gree...
 
2024: Domino Containers - The Next Step. News from the Domino Container commu...
2024: Domino Containers - The Next Step. News from the Domino Container commu...2024: Domino Containers - The Next Step. News from the Domino Container commu...
2024: Domino Containers - The Next Step. News from the Domino Container commu...
 
Histor y of HAM Radio presentation slide
Histor y of HAM Radio presentation slideHistor y of HAM Radio presentation slide
Histor y of HAM Radio presentation slide
 
Boost PC performance: How more available memory can improve productivity
Boost PC performance: How more available memory can improve productivityBoost PC performance: How more available memory can improve productivity
Boost PC performance: How more available memory can improve productivity
 
Real Time Object Detection Using Open CV
Real Time Object Detection Using Open CVReal Time Object Detection Using Open CV
Real Time Object Detection Using Open CV
 
Data Cloud, More than a CDP by Matt Robison
Data Cloud, More than a CDP by Matt RobisonData Cloud, More than a CDP by Matt Robison
Data Cloud, More than a CDP by Matt Robison
 
How to Troubleshoot Apps for the Modern Connected Worker
How to Troubleshoot Apps for the Modern Connected WorkerHow to Troubleshoot Apps for the Modern Connected Worker
How to Troubleshoot Apps for the Modern Connected Worker
 
Apidays New York 2024 - Scaling API-first by Ian Reasor and Radu Cotescu, Adobe
Apidays New York 2024 - Scaling API-first by Ian Reasor and Radu Cotescu, AdobeApidays New York 2024 - Scaling API-first by Ian Reasor and Radu Cotescu, Adobe
Apidays New York 2024 - Scaling API-first by Ian Reasor and Radu Cotescu, Adobe
 
Strategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff
Strategize a Smooth Tenant-to-tenant Migration and Copilot TakeoffStrategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff
Strategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff
 
Exploring the Future Potential of AI-Enabled Smartphone Processors
Exploring the Future Potential of AI-Enabled Smartphone ProcessorsExploring the Future Potential of AI-Enabled Smartphone Processors
Exploring the Future Potential of AI-Enabled Smartphone Processors
 
From Event to Action: Accelerate Your Decision Making with Real-Time Automation
From Event to Action: Accelerate Your Decision Making with Real-Time AutomationFrom Event to Action: Accelerate Your Decision Making with Real-Time Automation
From Event to Action: Accelerate Your Decision Making with Real-Time Automation
 
Strategies for Landing an Oracle DBA Job as a Fresher
Strategies for Landing an Oracle DBA Job as a FresherStrategies for Landing an Oracle DBA Job as a Fresher
Strategies for Landing an Oracle DBA Job as a Fresher
 
GenAI Risks & Security Meetup 01052024.pdf
GenAI Risks & Security Meetup 01052024.pdfGenAI Risks & Security Meetup 01052024.pdf
GenAI Risks & Security Meetup 01052024.pdf
 
Tata AIG General Insurance Company - Insurer Innovation Award 2024
Tata AIG General Insurance Company - Insurer Innovation Award 2024Tata AIG General Insurance Company - Insurer Innovation Award 2024
Tata AIG General Insurance Company - Insurer Innovation Award 2024
 

DevSecOps - Agile Get-Together 2022.pdf