►
Description
In today's market, every organization should evaluate their technology debt and streamline the DevSecOps process to deliver customer value faster and bolster developer productivity. Hear from Tyler Miles, DevOps Product Owner at Liberty Mutual, Lucia Romero, Application Security Technical Leader at MercadoLibre, and Vijay Thumma, Director of DevSecOps at JM Family, on how they optimized their security practices by focusing on the developer experience. From securing open source and pipelines to preventing security issues, their developer-first approach enables security teams to focus on key strategic priorities.
Stay up-to-date on all things GitHub by subscribing and following us at:
YouTube: http://bit.ly/subgithub
Blog: https://github.blog
Twitter: https://twitter.com/github
LinkedIn: https://linkedin.com/company/github
Instagram: https://www.instagram.com/github
TikTok: https://www.tiktok.com/@github
Facebook: http://fb.com/github
About GitHub
It’s where over 100 million developers create, share, and ship the best code possible. It’s a place for anyone, from anywhere, to build anything—it’s where the world builds software. https://github.com
A
Hi
good
morning
and
welcome
to
GitHub
Galaxy.
Maybe
this
is
your
first
session
of
the
day
or
your
third,
but
we
are
so
excited
to
have
you
here
today.
My
name
is
Brittany
O'shea
and
I
am
our
director
of
security
pmm
here
and
we
are
joined
by
a
wonderful
group
of
hosts
and
panelists
today,
but
before
I
get
into
that,
and
we
get
to
meet
some
of
the
exciting
faces
on
this
call.
We've
opened
some
polls.
We
want
to
make
sure
this
content
is
tailored
to
you
so
drop
in
your
feedback
there.
A
If
you
have
any
questions
or
you'd
like
to
ask
anything,
please
use
the
Q
a
tab
right
up
in
the
right
hand,
corner
if
anything
comes
up
and
you're
having
issues
from
a
viewing
perspective.
We
recommend
using
Chrome
and
if
you
have
any
troubles,
there's
also
some
docs
or
there's
a
chat
moderator
that
we
can
ask
questions
to
so
please,
let
us
know
we
want
to
make
sure
you
have
the
best
viewing
experience
today
and
without
further
Ado
I
will
pass
it
over
to
Keith
who's
going
to
get
us
introduced
to
our
panelists.
B
Thanks
so
much
Brittany
hi
folks,
I'm
Keith,
hoodlet
I'm,
a
principal
field,
security
specialist
here
at
GitHub,
and
we
have
an
incredible
lineup
of
leaders
here
to
share
their
perspectives
and
experiences
around
securing
development
systems,
while
optimizing
for
productivity
without
further
Ado
I'd
like
to
invite
the
panel
to
introduce
themselves.
Let's
start
with
Tyler.
C
C
I
work
for
Liberty
Mutual
as
a
product
owner
and
I
work
in
a
team
called
software
delivery,
so
we're
responsible
for
helping
Engineers,
take
their
ideas
and
deliver
them
ultimately
through
the
pipeline
out
to
the
cloud.
So
that's
me,
I've,
been
there.
17
years
means
I'm
getting
pretty
old
and
I'm
really
happy
to
be
here.
B
C
B
D
E
A
Perfect,
it's
exciting
what
a
wide
range
of
panelists
and
attendees
we
have
today
and
looking
at
the
pool,
I'm
excited
to
see
we're
all
in
the
right
place.
We're
seeing
some
things
surfaced
about
difficulty
to
get
our
security
tools
in
the
developer,
workflow
challenges
with
compliance
and
just
overall
wanting
an
edge
on
how
we
fix
findings,
so
we're
going
to
get
to
that.
But
the
one
thing
that
unites
us
all
is
we
all?
No
matter
industry
or
place?
Are
software
companies
at
the
heart
of
what
we
do?
A
We
have
to
use
software
to
get
an
edge
and
get
value
to
customers
more
easily.
So
we're
going
to
talk
a
lot
today
about
how
we
balance
the
security
of
software
with
developer
productivity
and
the
ability
just
to
get
value
to
our
end
users
quicker.
So
we're
going
to
start
with
VJ
BJ
we'd
love
to
hear
your
perspective
on
what
you
would
say,
your
top
challenges
with
securing
your
organization
software
have
been
and
how
you've
overcome
those.
E
Yeah,
you
know
thanks
Brittany
for
that
question.
So
it's
an
interesting
question.
I'll,
take
a
step
back
here
to
talk
about
the
need
to
drive
that
strategic
risk
and
the
need
to
build
more
efficient
and
effective
security
into
the
software
right.
Any
software
can
introduce
vulnerabilities
into
into
the
entire.
You
know:
deficit
Ops
life
cycle.
Just
like
any
other
organizations.
You
know
our
top
priority
at
JM
family
is
to
integrate
security
into
the
software
development
bicycle
so
understanding.
The
threats
that
can
emerge
across
the
entire
software
supply
chain
is
critical.
E
So
in
my
role
as
a
cloud
engineering
leader,
you
know
it
is
to
enhance
the
developer
experience.
You
know
coming
up
with
the
devsec
start,
devsecop
strategy
to
consolidate,
standardize
and
optimize
the
workflows,
the
processes,
work,
environments
to
simplify,
reduce
fiction
and
support
that
speed
to
value
is
to
you
know
in
itself
it's
challenging
right.
So
so,
when
it
comes
to
those
top
challenges,
you
know
you
know
just
like
any
other
organizations.
We
do
have
a
landscape.
You
know
with
different
levels
of
creation,
interoperability
and
the
need
to
make
contextualized.
E
You
know
enforcement
decisions
fast
enough
to
meet
our
business
needs.
Fundamentally,
you
know
requiring
us
to
you
know,
build
those
Foundation
security
techniques
and
processes.
So
we
are
our.
You
know
we're
moving
towards
Cloud
native
applications,
so
we
use
a
multitude
of
Open,
Source
and
third-party
components
lots
of
dependencies
right.
So
we
need
to
be
cognizant
of
you
know.
Software
composition,
analysis
that
stats
so
and
so
tools
right
so
well
in
our
khm
family,
as
we
are
moving
towards
build
everything.
Cloud
native
vulnerabilities
are
only
one
part
of
it
right.
E
There
could
be
other
vectors,
such
as
misconfigured,
CI,
CD
pipelines,
secure
informational.
You
know
unintentionally
committed
to
source
code,
repos,
API
management,
so
using
that
security,
Automation
and
orchestration
in
a
way
that
can
be,
you
know
that
they
can
perform
well-defined,
repetitive
tasks,
you
know
otherwise,
which
otherwise,
maybe
you
know
prone
to
human
right.
So
I
would
say
you
know,
don't
automate
for
the
sake
of
automation,
right
make
sure
security
you
know
remains
consistent
and
up
to
date
with
the
development
pipelines
by
automating-
and
you
know,
codification
of
security,
endpoint
security.
E
You
know
to
provide
the
data
security
as
threat
protection.
You
know,
you
know,
don't
Implement
a
mix
of
defective
and
preventive
controls,
that's
what
they
don't.
They
don't
do
it,
but
it's
something
that
we,
you
know
we
have
to
invest
in
and
then
enforcing
zero
test
right.
It's
been,
it's
been
a
challenge.
Right
I
mean
every
step
of
software,
where
application
configuration
components
of
Open
Source
is
always
challenging
because
there's
it
is
a
strategy
that
needs
to
be
baked
into
the
framework.
You
know
not
a
service,
so
I
mean
I.
E
C
C
You
know
duplicative
tools
to
support
an
international
engineering
community
and
so
a
big
part
of
what
we're,
after
out
of
the
gate
here,
is
this
idea
of
a
one
Global
software
delivery
platform.
So
you
know
that's,
certainly
one
foundational
component
of
what
we're
chasing,
but
the
other
aspect
here
is
the
fact
that,
from
a
security
perspective,
we've
very
much
left
application
engineering
teams
to
their
own
devices.
D
No
I
totally
agree
with
BJ
and
Tyler
I
think
that
another
challenge
that
maybe
it's
not
something
that
happens
to
every
company,
but
it's
the
scale
so
many
languages,
many
packages,
many
developers,
multiple
clouds,
local
Libre,
is
built
in
Java,
JavaScript
girl,
Ruby,
C,
civas,
plus
python
Golan
Etc,
and
we're
almost
15
000
developers
working
on
almost
30
000
repositories.
So
the
scale
and
different
environments
represent
big
challenges
for
for
security.
My
team,
the
Security
application
team
focuses,
as
BJ
said
before,
on
securing
the
development
life
cycle.
D
Of
course,
so
I
think
it's
key
to
have
a
security
presence
in
each
of
these
stages,
because
there
is
no
Silver
Bullet
magic
tool,
effortless
solution
security
must
be
taken
into
account
in
every
step.
Nowadays.
I
think
it's
well
known
that
a
web
application
firewall
does
not
solve
all
of
our
problems.
Back
quantity
program
does
not
solve
our
problems.
I,
don't
know,
frequently
nutrition
testing,
that's
not
all
of
our
problems,
so
I
think
that
complementary
security
strategies
are
key
solutions
for
security
and
I
think
that
scales
kind
of
forces.
E
Yeah
and
Brittany
I
mean
just
adding
to
that
right,
I
think
again,
it's
important
to
select
the
right
tool
hey.
So
what
I've
done
is
you
know,
selecting
GitHub,
Advanced
security
as
our
CI
CD
tool
that
can
provide
code
scanning
secret
scanning
dependency,
reviews
right
to
drive
that
modern,
secure,
develop,
focused
security
and
compliance.
So
you
know
when
it
comes
to
GitHub
Advanced
security.
It's
a
fully
integrated.
You
know,
devsecops
platform
that
just
goes
beyond
just
the
CI
CD
right
as
an
example
depend
about
fines
and
repairs.
E
Vulnerable
dependencies
code
scanning
detects
floss
in
the
new
code.
You
know
during
development
Sam
also
ldap
Integrations,
right
secret
scanning
that
can
prevent
accidental
leakage
of
security
tokens
so
I'm
in
the
early
stages
of
creating
awareness
and
desire
within
the
delivery
teams,
where
devops
Engineers
should
be
intentional
about
the
broad
categories
of
threats
to
watch
out
for,
and
the
tools
and
processes
such
as
Version,
Control,
multi-factor
authentication,
automated
security
scanning
that
are
effective
not
only
just
from
preventing,
but
also
identifying
attacks
at
each
stage
of
the
you
know,
software
supply
chain
right.
E
That's
why
you
know
assembling
a
complete
devsecop
strategy
that
problems,
how
to
code
applications
infrastructure
you
know
and
protected
access
across
the
software
is
very
important.
You
know
which
is
where
I
have,
and
you
know,
I'm
investing
my
you
know
early.
You
know
time
within
the
chain,
family.
C
Yeah
I
think
communication
is
hard.
We
see
you
did
a
great
job
articulating
the
scale
of
your
organ.
You
know
we're
very
similar:
we've
got
8
000
developers,
50
000
repositories
and
so
reaching
everyone
is
really
hard
and
we
continue
to
try
to
build
experiences
around
doing
that.
I'd
say.
Ultimately,
it's
required
some
hustle,
you
know
from
our
perspective,
so
we're
attending
every
kind
of
architectural
Roundtable.
You
know
lunch
and
learn
demo
sessions
and
doing
that
again
and
again
and
a
big
part
of
what
we're
after
here
is
ultimately
to
build
a
culture.
C
D
D
Think
the
awareness
different
kind
of
communication,
as
it
says,
like
we,
also
have
like,
like
a
game
like
a
communication
security
week,
where
developers
can
trying
to
attack
our
own
platform
and
stuff
but
I
think
on
the
board
of
infrastructure
and
architecture.
The
the
the
way
we
address
this
in
Mercury
is
kind
of
different.
We
have
like
secure
default
policies
like
we
try
to
make
things
secure
by
default.
It's
nothing
so.
B
D
We
try
to
not
keep
everything
to
developers
about.
You
know,
infrastructure
architecture,
the
way
they
code
or
maybe
the
way,
the
the
kind
of
dependency
so
normal,
typical
solutions
for
things
like
I,
don't
know
a
web
framework
how
to
do
query.
Studio
database
arrest,
client,
whatever
so
there's
other
teams
here
Magalia
are
not
the
security
team.
That
Focus
isn't
that
you
know
to
give
solutions
that
they
will
later
support.
You.
A
B
Karen
really
quick
as
well
I
just
wanted
to
briefly
share
the
results
from
the
previous
poll
that
we
ran,
because
I
thought
that
it
really
highlighted
the
challenge
that
you're,
all
speaking
to
which
is
around
the
fact
of
just
like
integrating
security,
communicating
with
development
teams
across
that
process,
like
you've
all
spoken
almost
directly
to
this
experience
of
you
know
that
that
difficulty
or
that
that
thought
process
that
goes
into
working
with
developers
right
communication
and
making
sure
that
they
know
what's
going
on,
they
understand
the
challenges.
They
understand
that
feedback.
B
Now,
of
course,
we
have
other
votes
as
well.
I
mean
each
one
of
these
has
over
10
in
terms
of
the
the
you
know,
feedback
as
well,
so
great
things
to
consider
as
we
continue
to
move
forward
now
as
Britney
brought
up.
Compliance
is
one
of
those
things
that
many
of
us
have
to
address,
especially
as
you
get
to
very
large
organizations,
some
of
which
are
international,
but
even
those
that
are
localized
within
a
specific
region.
B
So,
as
compliance
standards
have
evolved
dramatically
in
recent
years,
shifting
away
from
the
check
the
box
standards
to
objective-based
policies.
You
know
this
is
significantly
affected.
Many
organizations
approaches
to
security,
so
maybe
starting
with
Tyler.
You
know,
given
that
you
work
in
an
organization
that
does
insurance
and
works
in
that
sort
of
financial
sector.
In
some
respect,
what
regulatory
requirements
does
your
company
adhere
to
and
how
does
GitHub
Advanced
security
help
you
accomplish
this.
C
Yeah
aren't
I
lucky
I,
get
to
be
the
leadoff
hitter
to
talk
about
compliance
stuff
to
put
everyone
to
sleep
here,
but
yeah
I
mean
you
know,
it's
part
of
selling
insurance
right,
it's
a
highly
regulated
industry,
and
so,
if
we
want
to
continue
to
sell
insurance,
then
we
have,
to
you
know,
do
fun
things
like
get
audited
and
pass
those
audits
right
and
I.
Think
traditionally,
a
lot
of
that
has
been
painful.
C
You
know
certainly
things
like
segregation
of
Duty
things
like
change,
control,
things
like
having
full
traceability
through
that
entire
software
supply
chain
so
that
you
can
go
from
the
point
of
an
originating.
You
know,
artifacts.
You
know
someone
requesting
work
all
the
way
through
the
change
itself,
change,
artifacts
and
things
like
that
and
being
able
to
attest
that
you
know
all
the
boxes
were
checked
and
the
things
that
needed
to
happen
happen
and
from
an
audit
perspective,
and
again
all
of
that
traditionally
happens
very
Downstream.
C
You
know
sometimes
significantly
after
the
change
itself
was
even
made.
You
know,
like
people
will
come
and
be
like
you
know,
hey,
you
know,
you
know
this
change
is
being
audited
and
a
lot
of
people
are
scraps
in
their
head
to
try
to
remember
you
know
what
even
it
was
in
the
first
place,
and
so
what
we're
trying
to
do
is
how
do
we
bring
some
of
that
attestation
and
compliance
earlier
into
the
developer
workflow
into
that
engineering
life
cycle
right?
C
So,
if
there's
things
that
we
can
attest
to
during
a
commit
check,
for
example-
or
you
know,
throughout
the
build
process,
for
example,
whether
that
be
a
security
scan
or
you
know
some
sort
of
opa
type
of
validation,
those
are
the
things
we're
really
focused
on
right
now.
You
know
both
to
ensure
of
compliance
of
our
applications
and
the
work
we
do,
but
also
to
streamline
the
engineering
and
compliance
process
itself
so
that
it's
not
as
painful
as
it
has
been
in
the
past.
C
C
B
You
know
it's
really
interesting
as
well.
Just
looking
at
the
poll
results
here,
it
seems,
like
our
audience,
feels
a
lot
of
this
pain
as
well
right,
like
number
of
audits,
passed
or
compliance
standards
met
like
a
a
large
portion.
You
know
like
if
we
split
these
three
things
that
sort
of
lead,
this
off
of
defects
identified
mean
time
to
remediate
and
audits
or
compliance
standards
met.
It
sounds
like
you're
trying
to
accomplish
pretty
much
all
three
in
some
ways
right.
B
It's
like
you're
trying
to
make
sure
that
the
things
that
you're
doing
from
like
a
detection
in
the
meantime
to
remediate
are
helping.
You
have
that
information
in
a
useful
way,
so
that
you
can
pass
audits
is
the
approach
you're
taking?
Is
that
maybe
a
good
summary
of
what
you're
trying
to
accomplish.
C
So
yeah
in
my
mind
it
really
it's
like
an
observability
first
have
the
data
and
if,
if
your
stuff
is
converged
and
Consolidated
in
a
common
platform
and
you've
got
some
common
tooling
that
sits
on
top
of
that
from
a
scanning
perspective
and
a
validation
perspective,
it
really
starts
to
make
some
of
that
easier.
So.
B
E
Yeah,
you
know,
send
a
kind
of
Tyler
touched
upon.
You
know,
what's
important
from
a
tooling
perspective,
right,
I
think
you
know,
you
know,
keep
the
way
I
look
at.
It
is
security.
Practices
right
needs
to
be
baked
through
the
development
life
cycle.
You
know
through
people,
processes
and
Technology,
it's
just
not
about
tooling
right.
E
That's
an
education
component
building
the
current
process
when
I
when
I
say
that
implies
okay,
are
we
using
the
test
driven
development
from
the
start
right,
every
delivery
we
should
be
tested
and
those
tests
should
include
security
testing,
so
some
common
security
testing,
such
as
you
know,
code
quality,
now
occurs
so
frequently
like
you
know,
it's
no
longer
considered
as
a
separate
security
practice
in
itself
right.
So
it's
merely.
It
should
be
merely
part
of
the
routine
part
of
the
development
right.
E
So
so
we
you
know
in
our
organizations,
we
are
again,
you
know
to
Tyler's
point.
It
doesn't
mean
we're
doing
it.
You
know
the
most
efficient
way,
but
we're
trying
to
get
there
right,
applying
that
security
practice
buying
integrating
security
processes
and
tools
in
the
devops
cycle.
If
you
look
at
the
software
development
lifecycle
processes,
it
is
continuous
everything.
E
So
it's
not
like
one
stage
right,
meaning
that
you
have
to
enable
end-to-end
delivery
to
support
the
natural
progression
of
the
work
to
achieve
that
deficit
of
speed,
where
you
know
so,
embedding
security
across
the
entire
value
chain
right.
So
so
successful.
You
know,
that's
the
cops
in
my
opinion.
You
know
definitely
hinges
on
understanding
and
thoughtfully
innovating
security
into
the
development
process.
So
our
model
is,
you
know,
to
review
each
stage
recommend
what
security
controls
to
integrate
for.
E
So
it
has
an
example
in
the
continuous
planning,
hey,
Architects
and
agile
teams
need
to
integrate
their
execution
plans
across
the
Enterprise
on
our
ongoing
basis
right
where
privacy
requirements
management
threat,
modeling
to
view
the
application,
through
the
lens
of
a
potential
attacker
right,
continuous
development
stage,
where
you're
collaborating
you
know,
planning
the
delivery
of
those
small
frequent
changes.
Ide,
you
know
security,
plugins,
pre-commit
hooks
for
lightweight
static
analysis.
E
You
know
checking
with
an
integrated
development
environments,
peer
reviews,
secure
coding
standards
to
identify
effectively
what
those
call
you
know
what
those
preview
process
and
pre-commit
her
tasks.
Look
like
right,
continuous
integration
right
where
you're
integrating
the
changes
where
you
know
the
developers
are,
you
know
creating
managing
and
sharing
their
code
in
repositories
such
as
you
know,
GitHub
or
Azure
reports.
There's
a
risk
here
that
that
can
lead
to
vulnerabilities
or
unintentionally,
including
credentials
or
tokens
right
in
comments.
So
how
do
you?
How
do
you
scan
that?
E
How
do
you
make
sure
that
the
Republic
scanning
is
enabled
those
capabilities
are
in
there?
Now
with
GitHub
Advanced
security?
You
can
look
at
those
vulnerabilities
for
credentials
or
credentials
change
or
any
flag
for
any
remediation.
Oss
vulnerability
scanning
also
is
there
and
then
I
can
go
in
on
and
on.
Right
depends
on
the
management
or
west
depends
dependency
checks,
right,
continuous
testing
shift,
left
model
right
automatically
test
changes,
app
security,
testing
unit
testing,
infra
testing
and
the
deployment
delivery.
Like
many
other
organizations,
we
use
build
and
release
pipelines
to
automate
and
standardize.
E
The
processes
release
pipeline
should
have
all
those
capabilities
embedded
through
the
testing
environments
and
to
the
production
and
then
and
then
finally,
I
think
you
know
what's
most
important
for
all
of
us
to
take
is
like
you
know,
how
do
we
create
that
culture
of
learning
and
curiosity
right
that
emphasizes
the
importance
of
security?
Super
super
important
right?
You
know
we
need
to
have
the
people
have
that
Curiosity
so
that
everyone
is
really
really
focused
on
hey.
We
discovered
anything,
it
goes
wrong
and
then
you
know
having
security.
B
D
Okay,
so
I
have
like
a
little
bit
of
a
reflection
about
this
and
about
everything
BJ
and
tell
us
yes,
said
so.
I
think
that
regulations
in
many
type
of
regulations
gives
us
like
a
chance
like
opportunity
to
prove
their
value
of
security
in
each
stage
of
the
development
life
cycle,
because
with
regulations
security
strategies
are
required.
We
have,
we
must
have
them,
and
this
brings
us
like
a
really
challenging
question,
at
least
in.
D
D
You
know
because
yeah
yeah,
the
earlier
we
catch
you
back
design,
floor
security
issue
whatever
this
year
and
the
faster?
It's
all
it's
a
little
bit,
but
that's
it
is
a
company
willing
to
to
spend
like
loads
of
lots
of
money
just
to
reduce
the
time
a
developer
is
spending
on
fixing
something
that's
something
in
production.
It's
a.
D
B
D
So
that
means
that
I
saved
the
company,
this
exact
amount
of
money
that
it
will
cost
in
a
faculty
program.
No,
no!
That's
it's
not
that
straightforward
and
that's
why
it's
really
challenging.
How
do
we
measure
that
I
could
go
and
on
and
on
you
know,
money
time,
yeah,
image
and
and
the
reputation
of
the
company
and
the
regulations?
Of
course,
there
are
so
many
factors
to
take
into
account
and
it's
such
a
challenging
task.
Yeah
security
teams
must
be
up
up
to
because
this
is
our
chance.
D
You
know
security
is
something
more
people
is
talking
about
and,
as
we
said,
more
developers
I'm
a
developer
myself.
So
more
developers
are
really
curious
about
security,
so
I
think
it's
key
to
prove
the
value,
not
just
important.
You
know.
We
know
it's
important
to
have
security.
You
know,
Mercado
Libre
also
have
like
a
fintech
part,
smokal
and
I
used.
It.
So
I
know
it's
important
because
it's
my
money,
but
how
do
we
measure
this
value
we
are
given
to
to
the
company.
B
D
B
And
actually
it's
a
really
nice
segue
into
the
next
section,
so
Brittany
I
want
to
hand
it
over
to
you
to
talk
a
little
bit
or
perhaps
ask
some
questions
about
developer
productivity
because
it
sounds
like
what
you're
saying
Lucia
is
not
only
do
we
need
to
make
sure
we're
providing
security,
but
we
need
to
do
so
in
a
way
that
doesn't
inhibit
the
business
from
pursuing
its.
You
know,
financial
and
other
objectives
that
it's
trying
to
accomplish.
A
Absolutely
and
I
think
for
so
long.
It's
felt
like
those
two
metrics
were
at
war
with
themselves
like
meeting
compliance,
standards
and
being
productive,
have
never
felt
like
in
sync
and
like
they're,
empowering
one
each
other
but
I
think
we're
getting
to
a
way
where
we're
starting
to
hold
tools
or
Solutions.
A
We
use
to
a
higher
standard,
a
standard
in
which
we
feel
that
they
need
to
help
us
with
our
velocity,
and
we
know
in
today's
current
macroeconomic
climate,
where
we're
all
being
pushed
to
do
more
with
less
essentially
that
it's
so
important
that
we
use
solutions
that
actually
help
maximize
developer
productivity
and
maximize
the
value
we
can
bring
to
Market.
But
harder
said
than
done
so.
I'm
super
excited
for
Lucia
to
get
your
perspective
as
a
developer.
How
you
have
prioritized
the
developer
experience
in
your
organization
as
it
relates
to
security.
D
Okay,
so
to
answer
this
question,
I'll
give
you
kind
of
a
context.
We
started
working
with
coql
back
in
2020.
when
lttm
was
the
product
not
going
to
have
on
security
first
of
all,
because
it
solves
our
multiple
Technologies
problem:
computer,
supportive,
python,
Java
and
JavaScript
and
grow.
What's
your
work
in
progress,
so
we
use
cloud
ql
to
analyze
the
request
and
to
block
when
any
vulnerability
is
found,
but
the
only
information
we
gave
the
universe
was:
okay,
this
line
of
code
is
vulnerable,
fix
it
and
that's
it.
D
So
we
have
a
lot
of
problems
about
that.
Of
course,
and
GitHub
and
security
had
give
us
a
big
Improvement
on
their
developer
experience.
You
know
they
have.
You
know
they
will
ability
to
be
you
reduced
the
amount
of
time
Wasted
by
developers
and
also
by
security.
Engineers.
All
the
information
to
understand
the
vulnerability
is
spread
out.
You.
B
D
With
useful
links
and
also
the
the
path
you
you
can
see,
the
way
the
user
input
flows
through
a
source
function
to
sync
function.
You
know
all
the
information
is
there,
developers
used
to
have
so
much
trouble
understanding
their
applications
flow
because
some,
sometimes
it's
really
tricky.
Sometimes
applications
are
big,
sometimes
you're,
new,
whatever
so
I
think
this
view
is
key
to
releasing
wasting
time
for
us
and,
as
I
said
before,
also
for
the
security
team,
not
just
for
developers
I'm
available
myself.
So
I
really
enjoy
this
view.
A
D
Some
travel
happens,
you
know,
I
studied
analysis,
has
false
positive.
It's
something
like
this
theory
is
theoretical.
We
can't
do
anything
about
it.
We
create
our
custom
queries.
We
try
to
improve
them,
but
yeah
false
positives
are
there
that
we
also
have
like
a
lot
a
lot
of
wrongly
reported
for
positives,
because
what
I
said
before
we
just
said:
okay,
here,
you
go,
there's
a
vulnerability
fix
it
deal
with
it
whatever.
D
C
These
things
have
been
institutionalized
at
liberty
for
quite
a
while
now,
even
though
it
hasn't
been
too
much
time,
and
but
you
know
prior
to
that
again,
teams
were
sort
of
left
to
their
own
devices
if
they
were
doing
those
sorts
of
things
at
all.
We
would
have
little
pockets
here
and
there
of
you
know
various
tools
and
an
engineering
team
would
identify
and
and
bring
in-house,
and
maybe
it
worked
great-
maybe
it
didn't.
But
there
wasn't
a
lot
of
sharing
going
on.
C
There
wasn't
a
lot
of
convergence
and
and
standardization
and
so
I
think,
like
a
huge
advantage
of
you
know,
moving
into
GitHub
was
on
day
one.
We
turned
dependency
scanning
via
dependabot
and
secret
scanning
on
holistically
on
behalf
of
all
repositories
in
Liberty
Mutual
and
we're
enforcing
that
setting,
and
so
you
know
we're
getting
some
insights
that
we
haven't
had
historically
so
just
being
able
to
go
in
and
get
an
understanding
of
what
our
posture
is
across.
C
These
two
super
important
areas
has
been
a
huge
win
and
then
getting
that
feedback
again
as
early
in
that
engineering
experience
as
possible
is
another
one.
You
know
some
other
things
that
we've
done
historically
in
the
past.
Is
you
know
if
some
kind
of
security
vulnerability
manifests,
or
you
know,
there's
sort
of
some
kind
of
compliance
rule
that
we're
enforcing
it
happens
like
way,
Downstream
post
deployment,
you
know,
Engineers,
are
getting
they're
app,
remediated
or
they're
getting
slapped
on
the
wrist
by
security.
C
Historically,
where
I'm
an
engineer
I
deploy
an
app
oh
whoops,
there
was
some
sort
of
vulnerability
or
some
compliance
thing.
I
didn't
do,
and
post
deployment
that
app
gets
remediated
stopped,
shut
down
something
and
Engineers
like
whoa.
Wait
what
happened?
My
deploy
passed,
my
build
passed,
my
up
got
stopped
like,
and
so
the
amount
of
waste
and
churn
that
would
happen
through
that
experience
was
really
bad,
and
so
now
we're
letting
the
engineer
about
you
know
these
sorts
of
vulnerabilities
or
compliance
misses
when
they're
committing
their
change.
C
During
that
pull
request
experience
so
that
you
know
you
talk
about
productivity
and
Time
Savings,
and
things
like
that
and
I
think
that's
a
really
great
example
of
it
and
so
yeah.
It's
been
interesting.
You
know
we're
we're
on
the
journey
here.
It's
not
perfect.
We
have
a
lot
of
work
to
do
but
I,
like
everything
folks
are
saying
about.
C
You
know
to
me:
it's
about
culture
and
and
community,
and
you
know
getting
Engineers
passionate
about
you
know
securing
their
supply
chain
securing
that
you
know
pipeline
ecosystem
and
you
know
we're
we're
we're
getting
there,
but
you
know
that's
what
we're
really
passionate
about.
That's
what
I'm
passionate
about
is
to
be
in
a
spot
where
we're
not
having
to
remediate
things,
because
you
know
Engineers
are
thinking
about
this
stuff
and
educated
on
on
how
to
build
software
securely
from
the
jump.
A
Absolutely
and
I
think
you
highlighted
something:
that's
so
unseen,
sometimes
in
culture,
but
having
that
transparency
early
can
create
a
culture
of
trust
and
transparency
where
someone
doesn't
feel
blindsided
and
how
that
empowers
them
to
be
a
partner
rather
than
to
be
a
detractor
from
The
Experience
Vijay.
How
has
this
mirrored
your
experience?
Have
you
had
different
techniques
or
a
similar
experience.
E
Yeah
I
think
the
experiences
are
pretty
common
right
across
you
know,
especially
given
that
we
are,
you
know,
trying
to
develop
a
culture.
You
know
around.
You
know
how
we
can
secure
everything.
So
you
know
to
what
Tyler
said:
hey:
what's
a
rework
it's
causing
for
the
organization
when
you
bring,
you
know
security
far
into
the
life
cycle
right,
so
in
my
leadership,
we're
all
at
JM
family.
E
My
focus
is
to
reduce
that
cognitive
load
on
the
developer
teams
by
providing
some
self-service
tools,
capabilities
and
processes
and
I
need
to
provide
a
developer
experience
that
is
demonstratively
better
than
hey
do-it-yourself
approach
right,
so
that's
kind
of
what
it
is.
So
in
collaboration
with
my
extended
Partners
in
the
organization
from
architecture.
You
know,
technology
platform,
agile,
product
infosec
teams
like
I,
am
taking
an
approach
of
devsecops
as
a
product,
so
which
is
what
I'm
calling
here
to
improve
all
facets
of
developer
experience
that
are
affected
by
highly
High.
E
Friction:
development
tools,
Technologies
and
processes
right
so
empowering
those
development
teams
by
using
devsecops
as
a
product
approach
that
focuses
on
delivering
product
features
and
that
let
the
developers
use
those
features.
As
needed
through
a
self-service
platform,
so
that's
my
aspirational
state
in
in
the
organization,
so
these
features
will
span
the
entire
software
delivery
site
and
delivery
lifecycle,
meaning
development,
Frameworks
code
and
artifact
repositories.
Continuous
integration,
continuous
delivery
pipelines
like
with
integrated
actions
and
automations
security
architecture
by
Design,
right
test,
automation,
Frameworks
execution,
environments.
E
That
includes
the
cloud
services
container
platforms
as
we
move
towards
Cloud
native,
of
course,
and
then
you
know
to
earliest.
You
know:
Tyler's
Point,
observability
tools
to
support
those
application
operations
and
then,
of
course,
change
management,
auditing,
etc
for
regular
and
self-operating
as
possible
right.
E
So
what
this
means
is
like
you
know
now
what
I
have
identified
is
I'm
still
putting
this
together
as
hey,
there's
a
new
Need
for
Tool
standardization
and
integration,
meaning
backlog
management,
source
code,
artifact
repository
scans
environments,
to
enable-
and
you
know,
automate,
our
accountabilities
there's-
also
a
need
to
create
an
adopt
Enterprise
pipelines
like
standards
like
with
blueprints
and
patterns,
to
automate
the
compliance
and
end-to-end.
You
know
sdlc,
while
reducing
friction
within
the
technology
teams
right.
There
is
also
an
opportunity.
E
You
know
for
teams
to
understand
owners,
understand
the
ownership
and
accountability
of
the
end-to-end.
You
know
delivery,
meaning
you
know
how
are
they
accountable
and
you
know
they
need
to
own
the
compliance,
security
and
costs
right
and
that's
associated
with
that
there's
an
opportunity
to
consolidate
automation,
Frameworks
such
as
testing
automation,
so
that
way
we
can
reduce
the
maintenance
of
costs.
So
so,
of
course,
you
know
nothing
can
be
done
without
collaboration.
E
You
know
at
communication
knowledge
sharing
tools
right,
so
we
selected
the
GitHub
Advanced
Security
in
an
effort
to
create
that
consistent
developer
experience
which
you're
talking
about
you
know
Brittany,
because
there
is,
you
know
it
does
meet
our
needs
of
having
a
fully
integrated
devsecops
platform
for
collaboration
and
inner
sourcing
right,
that's
important
Automation
and
development
and
providing
the
security
by
Design.
Also,
you
know
we're
also
evaluating
the
GitHub
co-pilot
to
synthesize
the
AI
payer
programming
experience
as
well.
I
know
that's
a
Hot
Topic
right
now.
E
So,
but
let's
not
forget
right
now
that
a
good
developer
experience
should
definitely
focus
on
reducing
the
frustration
and
friction
for
developers
and
other
teams
right
by
reducing
unnecessary
cognitive
load.
That
I
was
alluding
to
right,
a
good
developer
and
create
you
know.
Experience
increases
the
satisfaction
and
capacity
to
deliver
value
and
then
finally,
a
good
developer.
Experience
also
extends
our
processes,
leadership
and
management
of
the
organization
to
be
more
effective.
B
B
That
said
also,
if
you
would
like
to
ask
a
question:
there's
a
q,
a
section
along
the
top
right
of
the
chat
where
you
can
go
ahead
and
ask
your
question:
we'll
be
reading
them
off
or
going
through
them
by
the
number
of
upvotes
so
be
sure
to
vote
the
ones
that
you
like.
So
as
a
general
question,
but
I
think
that
maybe
this
is
a
good
one.
Lucia
for
you
to
start
in
on,
and
then
we
can
go
around.
B
B
B
D
This
question
like
touches
different
things
that
we
we're
already
covering
the
panel
that
but
I
think
that
the
most
important
is
the
awareness
of
the
communication.
You
know,
as
I
said
before,
we
have
like
a
whole
team
that
focuses
on
that
focuses
on
capacitations
on
maybe
meetings
and
lectures
or
whatever
so
the
first
part.
We
we
try
to
report
everything
the
most
clear
and
simpler
as
possible.
You
know
like
well
with
the
health
and
security,
as
I
said
before.
It
was
really
really
clear
also
with
dependencies.
D
We
try
to
to
report
it
as
soon
as
possible,
and
sometimes
we
we
try
to
be
less
straight
because
what
you
said
before
we
are
not
like
the
bad
cop
of
the
organization
that
we're
going
to
to
punish
them
because
they
had
vulnerable
dependencies.
Oh
my
god,
so
we
try
to
report
it
the
clear
as
possible
and
then
to
give
them
the
tools
to
understand
how
to
solve
this
with
GitHub
and
security.
D
D
General
things
and
then
fix
it
in
your
code,
the
same
we
develop
with
vulnerable
dependencies,
and
sometimes
it's
not
that
simple
to
understand
words,
dependency
with
transitive
and
transitive
and
transitive
dependencies
and
the
guys
working
with
no
JavaScript
know
what
I'm
talking
about
you.
You
could
have
like
a
really
big
tree
of
dependencies.
Actually
a
graph.
D
You
know,
because
but
I
I
won't
go
into
that
to
technical
police,
but
it
could
be
a
nightmare
so
we're
trying
to
to
give
them
tools
and
also
to
to
work
with
them
to
help
them,
maybe
having
a
meeting
or
whatever
I.
Don't
I
know
that
as
I
said
before
it
does,
it
does
not
scale,
but
sometimes
it's
a
way.
It's
the
best
way
to
to
have
like
this
face-to-face.
You
know,
because
it's
virtual
but
kind
of
face-to-face
experience.
B
C
Yeah
I
I,
don't
know
that
I
could
do
a
better
job
than
than
we
see
it.
Just
did
I
think
she
answered
it
perfectly,
but
you
know
really
just
trying
to
position
ourselves
with
regards
to
the
engineering
community
at
Liberty
as
as
partners.
You
know
we're
not
here
to
be
big
brother
and
looking
over
folks
shoulders
and
and
slapping
them
on
the
wrist
if
they,
if
they
make
a
mistake
right.
C
You
know
it's
hard
to
make
improvements
if
you
don't
even
understand
what
like
current
state
looks
like
so
that
Baseline
was
super
important
and,
like
Lucille
said,
we've
been,
you
know
using
that
Baseline
that
made
the
rounds
right.
So
whether
we're
talking
about
you
know,
Keith,
you
mentioned
code
coverage
or
we're
talking
about.
You
know:
volume
of
dependency,
vulnerabilities
or
or
secret
standing
alerts
right,
we're
looking
at
that
Baseline
and
then
we're
going
around
and
about
you
know
across
the
communities
and
doing
the
ones
and
words
doing
the
round
tables.
C
C
I
guess
is
maybe
the
challenging
part.
You
know
it's
not
like
we're.
Looking
at
our
reports,
you
know
our
dependency
graphs
or
you
know
things
like
that
and
saying
wow
look
at
these
numbers.
You
know
diving
down
the
next
like.
That's
not
the
case,
you
know
it's
not
going
to
necessarily
turn
on
a
dime
overnight,
but
yeah.
It
I
feel
like
we're
really
headed
in
the
right
direction
and
I
think
you
know
we
have
the
most
important
piece
well
underway,
which
is
starting
to
build
that
culture
and
that
community
and
I.
B
I
hear
a
little
bit
of
what
jez
humble
one
of
the
authors
from
the
devops
handbook.
He
says,
devops
is
just
communication,
coordination
and
collaboration,
and
so
I
I
hear
that
coming
out
of
what
you're
saying
Tyler
but
Jay,
would
you
like
to
add
any
additional
thoughts
on
this
before
we
jump
into
the
next
question?.
E
No,
you
know
no
additional
thoughts,
I
think
you
know
Lucia
and
Tyler,
summed
it
up
really
well
right.
I
think
it
starts
with
the
mindset.
I
mean
at
the
end
of
the
day.
It's
a
cultural
mindset,
it's
a
cultural
shift
as
Leaders
I,
you
know
I
believe
we
are
all
trying
to
do
the
right
things
and
I
can
certainly
learn
from
what
Tyler
and
Lucia
had
shared,
and
you
know
use
that
as
needed
in
my
organization.
Likewise,
I
think
you
know
we
can
you
know
the
people
who
are
listening
to
us.
E
Can
you
know
leverage
some
of
the
best
practices
we're
trying
to
bring
across
our
organization
so
that
we
are
creating
that
end-to-end
developer
experience.
Remember
right,
you
know,
developer
and
developer.
Centric
approach
is
the
best
way
to
do
it
and
if
you
kind
of
put
yourself
on
the
issues
and
think
backwards
right,
you
know
it
it'll
all
becomes.
It
becomes
very.
You
know
tied
back
to
the
culture
that
we're
trying
to
promote.
A
Absolutely
and
I
think
we've
touched
on
this
a
little
bit
for
the
next
question,
but
I
think
it's
really
important
to
frame
it
in
the
way
that
Justin
has
as
well
as
a
new
Dev
self
engineer.
What
would
your
guys's
thoughts
be
around
on
strategies?
A
new
devsecops
engineer
could
use
to
bring
awareness
to
Dev
teams,
help
build
that
relationship
with
Dev
teams
and
help
them
ultimately
care
about
security
as
another
metric
of
quality
BJ
will
start
with
you.
E
Yeah
you
know
thank
you
Justin
for
that
question,
I'm
living
that
you
know
today,
right,
I,
I,
think
it's
important
to
also
not
delineate
or
separate
yourselves
from
a
developer
to
a
deaf,
Cyclops
engineer:
I
I!
It's
again,
you
know
it's
a
mindset
like
yeah.
You
are
going
to
be
that
champion
of
security
that
is
going
to
enforce
and
set
that
clear,
Direction
and
also
have
a
supporting
landscape.
You
know,
which
means
hey.
You
need
to
be
in
front
of
the
funnel,
be
the
leader
to
securely.
E
E
Believe
you
know
correct
me:
if
I'm
wrong,
you
know,
Tyler
or
Lucy
is
supply
chain,
I
mean
supply
chain
levels
for
software,
artifacts,
I
guess
again,
I
could
be
wrong
here,
but
which
means,
basically,
you
know
that
that
framework
will
provide
a
checklist
of
standards
and
controls
to
prevent
hey
tampering.
You
know
how
do
you
improve
Integrity?
How
do
you
secure
those
packages
and
what,
in
the
infrastructure,
how
do
you
manage
the
infrastructure
in
your
project
right?
So
what
this
means
is
that
that
framework
you
know
providing
the
framework
up
front.
E
You
know
we
will
also,
you
know,
help
the
developers
to
understand
hey,
you
know:
here's
what
a
secure,
end-to-end
software
delivery
means
right.
Controls
to
safeguard
those
vulnerabilities
from
vulnerabilities
I
would
say
both
internal
as
well
as
external
sources,
requirements
for
security
and
isolation
of
environments.
How
do
you
build
them
right
and
then
how
do
you?
What
is
the
ability
to
validate
or
authenticity
in
the
source
of
any
executed
binaries
as
an
example?
E
Securing
the
underlying
infrastructure
as
well
right,
don't
forget
about
the
tools
and
processes
right,
so
there's
an
ongoing
visibility
into
that
continuous
compliance
model,
and
finally
I
mean
you
know
you
know
just
in
what
I
would
advise.
You
is
adopt
the
best
practices,
industry
practices
so
managing
the
security
of
the
tools
you
know
so
that
they
can
manage
it
themselves,
so
be
the
champion
right.
You
know,
be
the
champion
work
with
the
you
know,
developers
and
let
them
be
like
you
eventually.
So
that's
that's.
The
recipe
for
success.
I
would
say.
C
C
It's
not
me
telling
people
how
it's
going
to
be
right
and
there
might
be
a
little
bit
of
that
just
from
our
compliance
and
Regulatory
perspective.
Certainly,
but
you
know,
even
in
those
cases,
it's
explaining
why
you
know
making
sure
people
know
why
we're
doing
these
if
we
want
to
continue
to
sell
insurance
and
and
do
what
we
do,
you
know
these
things
are
necessary
and
then
you
know
for
some
of
the
other
things
yeah
just
make
it
clear
that
we're
in
it
together.
You
know
we're
we're
after
the
same
problems.
C
D
Yeah,
just
one
little
thought:
one
of
my
strategies
at
least,
is
to
make
myself
clear
that
security
is
like
efficiency.
You
know,
you're
a
better
developer.
If
you
can
code
securely,
you
know
your
code
is
secure
if
your
code
pass
what
you
want,
what
you
intended
to
do
you
know,
because
that
that's
what
security
is
about,
you
know
an
attacker
finding
a
way
to
do
something
with
your
code
that
you
didn't
prevent.
You
didn't
thought
so
I
think
that's
a
great
idea.
D
B
A
No
I
just
want
to
thank
everybody
for
joining
and
being
so
engaged
in
the
chat
and
a
big
special
thanks
to
our
panelists
I
know.
Your
insights
today
were
so
critical
and
helpful
to
many
here.
So
thank
you.
Everyone
for
joining
and
we'll
get
up
the
schedule
of
events
for
keep
the
talk
through
and
also
we'd
love
your
feedback.
So
we'll
chat
through
that.
B
Yeah
absolutely
so,
once
again
as
well,
you
know
from
my
side
thank
you
especially
to
our
panelists
and
all
of
you
in
the
audience
who
joined
us
today
to
have
a
great
conversation
up
next
at
3
P.M
Eastern
at
12
p.m.
Pacific
we
have
the
scale
your
security
team,
with
a
global
community
of
security.
Researchers
I'm
personally
really
excited
for
this
talk.
A
couple
of
my
colleagues
are
involved
in
that.