DevSecOps - Agile Get-Together 2022.pdf
•
0 gostou•37 visualizações
New software development approaches continue to be promoted. You may be aware of waterfall, RUP, 4GLs, 3-tier client server – all still alive and kicking in some domains. You will be familiar with some (or all) of Agile, Kanban, DevOps, SAFe, No Code/Low Code and many others. A new kid on the block is DevSecOps. What does that mean? Why is it important? How will it affect agile software teams? If we adopted the tenets of DevSecOps without calling it DevSecOps would it “smell just as sweet”? What would it “smell” like if we spun up a DevSecOps team, without understanding the fundamental challenges that DevSecOps was intended to overcome? In this session I’ll explore the origins of DevSecOps before going on to demonstrate how there’s often a distance between the label and the intent of DevSecOps. Finally I’ll discuss the impact that DevSecOps can have on our agile teams and organisations based on my perspective gathered over a 40 year career in software.
Recomendados
Recomendados
Mais conteúdo relacionado
Semelhante a DevSecOps - Agile Get-Together 2022.pdf
Semelhante a DevSecOps - Agile Get-Together 2022.pdf (20)
Mais de Seb Rose
Mais de Seb Rose (20)
Último
Último (20)
DevSecOps - Agile Get-Together 2022.pdf
- 1. DevSecOps - what does it mean and how will it impact agile teams? Seb Rose Twitter: @sebrose Blog: https://cucumber.io/blog/ E-mail: seb.rose@smartbear.com
- 4. @sebrose seb.rose@smartbear.com DevOps Characterized by key principles: shared ownership, workflow automation, and rapid feedback. At its most successful, DevOps is a combination of specific practices, culture change, and tools. “A set of practices intended to reduce the time between committing a change to a system and the change being placed into normal production, while ensuring high quality” - Bass, Weber, Zhu There is no universally agreed definition of the term. https://en.wikipedia.org/wiki/DevOps
- 5. @sebrose seb.rose@smartbear.com Idealised transformation (US) With the help of a prospective board member and his mysterious philosophy of The Three Ways, Bill starts to see that IT work has more in common with manufacturing plant work than he ever imagined. With the clock ticking, Bill must organize work flow streamline interdepartmental communications, and effectively serve the other business functions at Parts Unlimited.
- 6. @sebrose seb.rose@smartbear.com Idealised transformation (UK) Watch a large software-intensive project, called FPP, that has been running late since day 1, but now, suddenly, needs to launch on an impossibly early date, or else. You feel their pain, and their joy, as they battle problem after problem until, slowly, torturously, they rediscover the few - but fundamental - principles underlying successful commercial software development.
- 7. @sebrose seb.rose@smartbear.com Ideal outcomes DORA metrics - Lead/cycle time (shorter) - Deployment frequency (higher) - Mean time to restore (shorter) - Change fail percentage (lower)
- 8. @sebrose seb.rose@smartbear.com Typical transformation Dev Ops Dev Dev Ops Before After Excessively cynical
- 9. @sebrose seb.rose@smartbear.com Living the dream DevOps
- 10. @sebrose seb.rose@smartbear.com Scaling the dream DevOps DevOps DevOps DevOps DevOps DevOps DevOps DevOps
- 11. @sebrose seb.rose@smartbear.com Ops as platform team Platform tools Ops Dev (use platform tools) platform team Dev (use platform tools) Dev (use platform tools) Dev (use platform tools) Dev (use platform tools)
- 14. @sebrose seb.rose@smartbear.com Agile dream Dev Sec Ops
- 15. @sebrose seb.rose@smartbear.com Orthogonal concerns Dev practices and tools Architecture and design Build pipelines Cloud providers Source control OWASP scans Code vulnerabilities DEVELOPMENT S E C U R I T Y OPERATIONS
- 16. @sebrose seb.rose@smartbear.com Who owns security? Survey 2020 https://devops.com/whos-responsible-for-security-apparently-it-depends/ The [dev] team is trusted to do its own security research and implementation I regularly put security suggestions in the box of suggestions, only to be ignored There’s a security team, but it doesn’t involve face to face with us, the dev team. So we just run the dev process without counting on them I am the only one who actually cares about security in my organization
- 17. @sebrose seb.rose@smartbear.com Desire paths http://www.databoxdigital.com/2014/02/02/desire-paths/
- 18. @sebrose seb.rose@smartbear.com Building on DevOps Platform tools Ops Dev (use tools provided) Security tools Sec
- 19. @sebrose seb.rose@smartbear.com Platform tools Dev enablement Ops Dev (specify & use tools) Sec Security tools
- 21. @sebrose seb.rose@smartbear.com What’s in a name? O, be some other name! What’s in a name? That which we call a rose By any other name would smell as sweet William Shakespeare, Romeo and Juliet
- 22. @sebrose seb.rose@smartbear.com The name is not the thing
- 23. @sebrose seb.rose@smartbear.com Names are important https://www.digdeeproots.com/articles/on/naming-process/
- 26. @sebrose seb.rose@smartbear.com The name is not the thing Platform teams facilitate delivery AND scaling consistency Takeaways Burnout is a thing
- 27. Seb Rose Twitter: @sebrose Blog: https://cucumber.io/blog/ E-mail: seb.rose@smartbear.com http://bddbooks.com