The Ugly Truth About Your DevSecOps Guidelines and Security Policies
A presentation at IDC IT Security Finland 2022 in in Helsinki, Finland by Bruno Amaro Almeida
The Ugly Truth About Your DevSecOps Guidelines and Security Policies Bruno Amaro Almeida September 2022 Photo by charlesdeluvio on Unsplash
Hello! About me • Head of Technology & Architecture at Fortum • Independent Advisor / Architect Consultant Bruno Amaro Almeida brunoamaro.com Reach out on: @bruno_amaro @brunoamaroalmeida
Fortum Digital Development: Energy Optimization, Sustainability, Electric Mobility Generation, Trading and Asset Optimization District Heating, Recycling & Waste Consumer Solutions Enterprise 3 … … Startups
Policies Cloud Guardrails IAM Hardened Images … Guidelines Cloud Security Privacy Open Source Vulnerability Management Incident Management Quality & Testing Enterprise Architecture … 4 Photo by Sixteen Miles Out on Unsplash
Security vs Developers 5 Photo by Jeremy Bezanger on Unsplash
Security Threat Modeling “Threat modelling works to identify, communicate, and understand threats and mitigations within the context of protecting something of value.” source: owasp.org 6
AWS and Azure Well-Architected Framework & Review • Consistent, Repeatable Assessment • Identify Risks & Opportunities • Outside perspective new Sustainability 7
Fortum Digital Development Handbook Inspired by 💚 https://s-group-dev.github.io/development-guidelines/ 8 (…)
Guidelines Digital Development Handbook Assessments 9 HOW WHY WHAT Builders Library HOW
Connecting the dots with Backstage • Tech Radar • Digital Development Handbook • Core IT Handbook • Builders Library and Templates • Metrics (e.g. DORA, SLAs, SLOs) • … 10 source: backstage.io
Culture > Processes > Technologies 11
Thanks! Questions? Feedback? Bruno Amaro Almeida brunoamaro.com Reach out on: @bruno_amaro @brunoamaroalmeida
Today everyone understands why cyber security is crucial to any business organization. Yet, most software engineering teams building products and services still struggle to improve their security posture.
Organisations, especially large enterprises, invest large sums in training, creating DevSecOps guidelines that follow industry best practices and applying security policies to the whole organization. However, are those actually applied practice? Are engineering teams adopting security practices?
In this talk, we are going to explore how organisations, especially their SW engineering teams, can truly assess and measure their security posture, making sure that organizational guidelines and policies actually make sense and are followed in practice.
Buzz and feedback
Here’s what was said about this presentation on social media.
