Zero to Ninety in Securing DevOps
Delivered at DevSecOps Days 2018, RSA Conference j. Wolfgang Goerlich About J. Wolfgang Goerlich About J Wolfgang Goerlich CBI (Creative Breakthroughs, Inc.) Cyber Security Strategist J Wolfgang Goerlich provides strategic guidance for securing development and DevOps programs in the healthcare, education, financial services, and energy. He is currently with CBI, a cyber security consultancy, as the VP for strategic security programs. Wolfgang also leads the CBI Academy teams, providing mentoring and coaching to the junior-level talent. Prior roles included VP for a managed security services provider, VP for an IT firm specializing in high speed high secure networks, and IT security officer and manager for a financial services firm. He is an active part of the security community; co-founding the Converge Detroit and organizing the BSides Detroit conferences. Wolfgang regularly advises on and presents on the topics of secure development life cycle, DevOps, risk management, incident response, business continuity, and more.
Empfohlen
Weitere ähnliche Inhalte
Was ist angesagt?
Was ist angesagt? (20)
Ăhnlich wie Zero to Ninety in Securing DevOps
Ăhnlich wie Zero to Ninety in Securing DevOps (20)
KĂźrzlich hochgeladen
KĂźrzlich hochgeladen (20)
Zero to Ninety in Securing DevOps
- 1. Zero to Ninety in Securing DevOps J Wolfgang Goerlich VP Strategic Programs, CBI
- 3. Developers Security It takes two years for technology to go from builders to breakers.
- 9. Are we really doing DevOps? Really?
- 10. Ad Hoc Defined Optimized Ad Hoc Defined Optimized DevOps What are our levels of maturity?
- 11. What is the CI/CD pipeline? Wait ⌠pipelines?
- 13. Wins ⢠Directory of people ⢠Inventory of DevOpsâd apps ⢠Inventory of CI/CD pipelines ⢠Stay alive (task and stress management)
- 15. Code Review SCA
- 17. Assess. Donât audit. (No one likes auditors)
- 19. Hug a Checklist ⢠NIST SP 800-64 Development Lifecycle ⢠NIST SP 800-190 Container Security ⢠ISO 27002 (Yeah, I know) ⢠ISO 27034 Application Security ⢠CSA Guidance 4.0 Application Security ⢠BSIMM, SAMM Maturity
- 20. And the most important checklist of them all ⌠the one from the Customers.
- 23. Wins ⢠Find a champion Advisory council ⢠Find a pilot pipeline Business case ⢠Define a maturity model Security backlog ⢠Still alive (task and stress management)
- 27. Create a culture of quality and security one line of code at a time
- 28. 30 90 60
- 30. Security as a Product
- 31. Security as a Product ⢠Features: Security Requirements ⢠Process: Borrow from DevOps ⢠Experience: Borrow from UXD Apply industrial design principles and DevOps methods to build our product
- 32. Wins ⢠Innovators and adopters Advisory council ⢠Pipeline security feature Business case ⢠Communicate roadmap Security backlog ⢠Alive! So alive. And kicking!
- 34. DevSecOps Learn Assess Plan Follow the Money Build a Backlog Define Success Implement, Iterate
- 35. J Wolfgang Goerlich VP Strategic Programs, CBI @jwgoerlich https://jwgoerlich.com Thank you.