It may be hard to believe, but it’s been over a decade since DevOps was introduced. It wasn’t long after that the concept of DevSecOps began to emerge as security practitioners attempted to keep application security practices engaged in software delivery. However, recent studies show that even in organizations that have adopted a DevSecOps model, security is still often viewed as a bottleneck. This can undermine the promise of DevSecOps to deliver a culture of shared responsibility for security.
To understand why we’re struggling, this session dives into the key issues that keep security shut out of the DevOps Pipeline. It will provide insights from recent research into the state of DevSecOps and Open Source Security and share evidence that indicates organizations are still failing to mature their processes and achieve the ideal shared responsibility culture.
From this analysis, tangible, practical actions will be identified that security practitioners can take to successfully engage security practices within the pipeline. We’ll move beyond traditional security gates and break-the-build approaches to show a process that motivates committed adoption. Steps that can be taken to create accountability between Development, Security, and Operations disciplines will be outlined. Ultimately, this session delivers a forward-looking viewpoint for what lies beyond DevSecOps, and how this culture can be extended to include the broader business.