Traditional security testing at the end of the pipeline creates friction and downtime, leading to the rise of DevSecOps to integrate security with development and operations.
Implementing DevSecOps successfully requires focusing on its three core pillars—people, process and tools, and governance—rather than just adopting new technologies.
Breaking down traditional silos between development, security, and operations is crucial for creating a shared responsibility model where everyone contributes to security.
Technology enables DevSecOps by automating repeatable security tests like secret scanning, SAST, and software composition analysis within the CI/CD pipeline.
Governance provides structure through policy as code and visualization, helping teams track security posture, manage expectations, and ensure compliance.
Successfully implementing DevSecOps involves navigating cultural resistance, ensuring seamless tool integration, and meeting complex compliance requirements like ISO 27001 and SOC 2.
Shifting security practices earlier in the development lifecycle, such as with pre-commit hooks, significantly reduces the cost and effort required to find and fix vulnerabilities.
Clear and consistent communication with developers about the purpose and implementation of security measures is the most critical factor in reducing friction and ensuring adoption.
26:50Nazneen Rupawalla
51:13Thomas Fuchs, Waleed Arshad & Frank Dornberger & Idir Ouhab Meskine:
42:44Liam Hurrel & Alireza Chegini
45:08Moataz Nabil
32:55Natale Vinto
28:27Niels Tanis
34:46Bruno Amaro Almeida
41:51Jemiah Sius
Jobs that call for the skills explored in this talk.
NTT DATA Österreich GmbH
American CyberSystems
Cedar Rapids, United States of America
