Software Engineering Radio - the podcast for professional software developers avatar

Dexa/Software Engineering Radio - the podcast for professional software developers

Learn more
Published Sep 3, 2019

SE-Radio Episode 288: DevSecOps

Explore the transformative power of DevSecOps as Kim Carter and Francois Raynaud delve into integrating security from the outset of application development, highlighting cultural changes, cost benefits, and the pivotal role of security champions in enhancing collaboration and making applications inherently secure.
Episode Highlights
Software Engineering Radio - the podcast for professional software developers logo

Topics covered

Popular Clips

Episode Highlights

  • Security as Code

    Security as code is a fundamental principle of DevSecOps, aiming to integrate security measures directly into the development process. explains that this approach allows applications to defend themselves by using data from potential attacks to improve security 1. This proactive strategy not only reduces the cost of addressing security issues later but also minimizes the need for constant security interventions during development 2.

    The motto of DevSecOps is security as code, which is, well, you guys are coding, so let me actually change my security as code and you can implement it part of your application, make the application defend itself, become anti-fragile.

    ---

    By embedding security into the code, developers can focus on innovation while ensuring robust protection against vulnerabilities.

       

    Bridging Silos

    Breaking down silos between security and development teams is crucial for effective DevSecOps implementation. emphasizes the importance of collaboration, noting that security professionals often face disdain when isolated from development teams 3. By integrating security into the development process, teams can work together to prevent breaches and improve software quality 4.

    Make your developers part of the security team, make your security guys part of developers, make them work together. It's actually not complicated.

    ---

    This collaborative approach not only enhances security but also fosters a culture of shared responsibility and continuous improvement.

       

    Shifting Security Left

    Shifting security left involves incorporating security measures early in the development lifecycle, which can significantly reduce costs and enhance security outcomes. highlights that DevSecOps enables teams to address security issues during the initial phases of development, avoiding costly fixes later 5. This approach has transformed organizations by embedding security into their culture and processes, leading to more secure and efficient software development 6.

    By shifting left your security, by discovering issues and bugs at an earlier stage, you can easily incorporate part of your QA process and the company will actually grow.

    ---

    Ultimately, shifting security left empowers teams to build secure applications from the ground up, fostering innovation and resilience.

Related Episodes