►
From YouTube: How shifting security left can enhance your developer experience and productivity - Galaxy 2023
Description
Interested in enabling your security teams to focus on key strategic priorities using open source and pipelines that don’t sacrifice development speed? Hear from a panel of leading development and security practitioners, including DK Singh, Head of Information Security Engineering at FlipKart, Praveen Kumar, CISO at Zee, and Hilal Lone, CISO at Razorpay, on how they optimised their security practices by focusing on the developer experience. You’ll learn how to remove technology debt and streamline the DevSecOps process to deliver customer value faster and boost developer productivity.
Stay up-to-date on all things GitHub by subscribing and following us at:
YouTube: http://bit.ly/subgithub
Blog: https://github.blog
Twitter: https://twitter.com/github
LinkedIn: https://linkedin.com/company/github
Instagram: https://www.instagram.com/github
TikTok: https://www.tiktok.com/@github
Facebook: http://fb.com/github
About GitHub
It’s where over 100 million developers create, share, and ship the best code possible. It’s a place for anyone, from anywhere, to build anything—it’s where the world builds software. https://github.com
A
Good
morning
and
good
afternoon,
everyone
I
would
like
to
extend
a
very
warm
welcome
to
all
the
audience
across
Asia
Pacific
who
have
joined
us
today,
thanks
for
taking
out
time
from
your
busy
schedules,
I
hope
today's
session,
which
will
be
covering
on
how
shifting
security
left,
can
enhance
your
developer
experience
and
productivity
I
hope
it's
informative
and
useful
to
all
of
you.
Let
me
start
off
with
introducing
myself.
A
My
name
is
amol
Rana
and
I
am
part
of
GitHub
Advanced
security
team
for
Asia
Pacific
I've,
been
based
in
Pune,
India
and
I
have
been
with
GitHub
for
almost
two
and
a
half
years.
Now
it's
been
an
amazing
journey,
interacting
with
customers
across
APAC
and
helping
them
with
their
devsecops
initiatives.
A
I
have
been
lucky
to
be
associated
with
cyber
security
and
application
security
for
almost
two
decades.
Now
thanking
you
again
for
joining
us
today
for
day
two
of
GitHub
Galaxy.
Today's
sessions
are
focused
on
the
theme,
secure
and
reliable,
and
we
have
this
fireside
chat
now
and
later
today,
my
colleagues,
Brent
and
shlomi
are
holding
an
interactive
forum
and
how
to
scale
your
security
team
and
why
so?
A
A
Moving
on
to
the
housekeeping
items
very,
very
important,
if
you
have
any
questions
for
our
speakers
today,
be
sure
to
drop
it
into
the
question
and
answer
tab
today.
We
are
also
joined
by
developer
Advocate,
Michelle
Mandarin,
who
will
be
keeping
an
eye
on
the
questions
which
we'll
cover
towards
the
end
of
the
panel.
A
A
If
you
need
any
help,
troubleshooting
issues
on
the
platform,
please
navigate
on
the
over
the
docs
tab
on
the
far
right
to
find
the
help
documents.
Okay
on
with
the
show
now,
let
me
start
by
introducing
the
speakers.
For
today
we
have
Commander
Deepak
Singh
Commander
Deepak
heads
information,
security
engineering
at
Flipkart,
which
is
a
leading
e-commerce
Giant
in
India
Commander
Deepak
brings
with
him
a
rich
experience
of
20
plus
years
in
defense
services
and
cyber
security.
Both
our
second
speaker
for
the
day
is
Mr
hilal.
A
Loan
hilal
is
currently
the
CSO
with
razor
pay.
Razer
pay
is
a
leading
fintech
company
providing
payment.
Gateway
services
to
our
vendors
hilal
has
in
past,
worked
with
unicorns
like
dream:
11
trevoraka,
Intuit
extra,
so
very
warm
welcome
to
both
of
you
in
our
discussion
today.
Ladies
and
gentlemen,
we
will
be
trying
to
understand
how
organizations
are
working
towards
successful
devsecops
deployment
in
their
organizations
and
in
this
devsecops
deployment.
What
kind
of
challenges
do
they
face?
A
Some
Focus
will
also
be
on
the
fact
that
how
get
some
Advanced
security
has
been
helping.
These
organizations
overcome
these
challenges
well
to
start
I.
Think
I
I've
been
fortunate
to
be
associated
with
application
security
industry
for
almost
a
decade.
Now
you
know
and
be
part
of
a
lot
of
devsecops
transformations
in
many
organizations.
A
Organizations
today
want
to
automate
application
security
and
are
really
looking
to
shift
left,
provide
developers
with
a
better
experience
in
identifying
and
remediating
security
issues,
which
is
kind
of
leading
to
a
higher
remediation
rate
and
also
productivity
increase.
In
fact,
I
was
going
through
a
report
published
by
CIO
magazine
and
asked
for
the
report.
74
of
IIT
leaders
have
confirmed
an
increase
in
accelerating
security
initiative
when
it
comes
to
software
development.
So
why
is
that
really
happening?
Why
is
why
are
organizations
really
focusing
so
much
on
application,
security
and
devsecop?
A
So
let's
talk
about
few
main
drivers.
I
think
you
will
all
agree
with
me
when
I
say
that
data
breaches
have
been
on
a
rise.
You
know.
60
of
these
successful
breaches
are
actually
targeting
application,
Level
vulnerabilities
and
in
some
form
stolen
credentials.
Compliances
have
been
getting
very,
very
stringent.
You
know
ISO
27001,
gdpr,
Auto,
SARS,
cert,
RBI,
catalyze,
that
there
are
many
guidelines
and
compliances
and
and
thanks
to
these
compliances,
getting
stringent
organizations
are
really
looking
at
Security
application
security
very
seriously.
A
Businesses
have
to
go
digital
now
to
stay
in
the
race
and
that's
led
to
a
boom
in
development
of
mobile
applications.
Web
applications
and
more
code
means
more
security.
Issues.
Number
of
releases
have
been
going
up
for
applications.
The
use
of
Open
Source
has
been
going
up.
You
know
almost
70
to
80
percent
of
the
code
that
forms
composition
of
the
software
today
is
open
source,
so
these
are
few
main
drivers
which
have
really
been
kicking
in
the
need
to
look
at
application
security
very,
very
seriously.
A
So,
moving
on
to
our
guests
today,
I
will
I
will
start
by
asking
my
first
questions
so
hilal.
The
first
question
comes
to
you:
you've
been
working
with
a
lot
of
organizations
in
the
past,
you've
worked
with
fintechs,
you've
worked
with
unicorns
and
you've
been
associated
with
cyber
security
and
devsecops.
Primarily
so,
what's
been
your
experience,
how
has
the
journey
been
with
respect
to
devsecops
with
these
organizations
and
what
were
those
challenges
that
you
faced
while
implementing
devsecops?
You
know
with
these
organizations
that
you've
worked
with
you.
B
B
There
are
a
lot
of
different,
basically
challenges
that
we
face
when
we
are
trying
to
implement.
Basically,
like
that's
a
cops
one
of
the
primary
reasons.
Basically,
the
organization
moved
on
from
basically
what
for
models
and
other
ways
to
work
towards
agile
systems
and
all
that
or
even
continuous
delivery
right
was
to
just
increase
the
frequency
of
the
releases,
make
development
process
efficient
and
everything
right.
So
when,
basically,
we
talk
about
the
challenges.
Actually,
there
are
two
main
challenge
that
we
usually
have
in
implementing
the
psychops.
B
One
is
from
the
basically
tactical
perspective
and
another
one
is
from
the
people
perspective.
So
from
the
technical
perspective,
you
have
like
really
distributed
a
way
of
development
they're
like
more
than
one
released
by
a
clients,
they're
like
multiple
different
platforms
that
you
actually
work
on,
and
there
is
no
consistency.
I
mean
there
is
some
consistency
with
respiratory
compliance
or
other
requirements,
but
there's
a
really
a
very
limited
amount
of
mapping
done
to
basically
the
compliance
requirements
right.
B
We
need
to
basically
talk
to
people
and
make
them
understand
how
this
actually
does
not
slow
them
down,
and
that's
actually
one
of
the
major
Challenge
from
the
non-tech
perspective
from
the
people
perspective
as
well.
This,
like
people,
are
very
sort
of
like
not
necessarily
in
the
development
world.
It's
not
necessarily
like
security
focused,
so
a
security
is
normally
like
seen
as
like
a
somehow
somehow
like
a
blocker
for
the
development
exercises
right,
so
to
be
able
to
convince
them
that
okay
yeah,
this
is
not
going
to
slow
you
down.
B
The
real
cycle
is
not
going
to
be
stopped
and
because
of
this-
and
this
is
something
that
will
Empower
you
rather
than
actually
inhibit
you
so
basically
making
them
understand
that
what
is
always
going
to
be
challenging-
and
this
is
the
challenge
that
I
faced
through
my
industrial
Journey
right
apart
from
that
I.
Think
one
of
the
most
important
aspect
was
that
when
we
are
actually
planning
for
implementation
of
District
Ops,
what
happened
was
there
was
no
standardization
of
tooling
and
automation
right.
B
So
that's
something
that
we
have
to
basically
think
through
and
once
basically
we
had
enough.
Basically
research
done
on
Automation
and
tooling,
then
we
did
actually
like
say
that
okay
developers
need
these
tools
and
all
that,
so
you
know,
in
order
for
us
to
achieve
that
kind
of
synergy.
The
developers
had
to
be
involved
and
getting
time
from
time
is
always
going
to
be
a
little
bit
challenging
so
yeah.
B
So
both
Technical
and
non-technical
challenges
are
obviously
going
to
be
there
when
you
try
to
basically
like
Implement
as
a
cause,
but
once
you
actually
like,
basically
like
damn
just
Beast
right.
So
what
happens
is
that
it
becomes
really
rewarding
and
I.
Don't
think
that
anybody
would
regret
actually
going
through
desk
Ops
Journey.
A
Yeah
that
I
completely
agree
with
you
hilal
on
on
the
fact
that
this
is
not
only
a
technical
problem,
but
also
a
people
problem,
so
this
this
basic
friction
that
we've
generally
seen
when
you
know
Security,
Professionals,
try
and
Implement.
You
know
security
controls
in
the
development
cycle
and
then
there's
a
resistance
coming
in
from
you
know,
developers
in
terms
of
okay.
A
This
is
slowing
me
down
and
you
know
why
why
do
I
have
to
even
bother
my
my
focus
is
features
functionalities
so
completely
in
sync,
with
you
thanks
for
that,
the
great
answer
moving
on
to
Deepak
now
Deepak
so
Flipkart
has
been
using
GitHub
Advanced
security
for
a
few
years
years
now
and-
and
you
know,
as
hilal
emphasized
the
challenges,
so
could
you
give
us
some
pain
points
that
you
were
able
to
overcome
using
GitHub
Advanced
security?
You
know
probably
shifting
left
or
PR
integration,
whatever.
C
B
C
You
know
absec
evangelization,
actually,
where
developers
were
able
to
understand
the
secure
the
risk
associated
with
this
with
the
code
and
I
think
you
know,
the
entire
Journey
was
not
already
taken
by
the
security
folks,
but
it
was
also
by
the
by
the
developers
per
se
and
to
be
very
honest,
amol
and
hilal.
I
would
just
like
to
share
with
you
know
the
audience
here
that
the
last
couple
of
times
my
experience
has
been
that
most
of
these
bugs
you
know,
don't
even
go
through
the
segment
cycle.
C
I
mean
developers
are
able
to
resolve
70
of
the
bugs
themselves.
So,
in
a
way,
this
entire
effort
in
entire
journey
of
devsecops
I
think
we
have
come
a
long
way
in
getting
developers
on
this
track,
along
with
the
security
folks
and
I
think,
to
a
large
extent,
the
credit
has
to
go
for
two
links,
like
you
know,
GitHub
Advanced
security,
which
you
know
I
think
as
more
and
more
with
time.
C
They
have
gone
into
sophistication,
ensured
Automation
in
the
complete
sense
and
today,
when
I
say
that
developers
are
able
to
fix
70
80
of
the
vulnerabilities
without
even
you
know,
raising
a
bug
about
that.
I
think
it
is
a
great
commentary
on
the
efficacy
of
GitHub
Advanced
security.
So,
yes,
I,
think
I
I
think
it's
a
great
tool.
I
would
say
it's
a
blessing
which
probably
the
developers
Community
was
waiting
for
and
I
would
say
an
ideal
recipe
for
devsecops,
taking
both
the
development
team.
A
Thanks
Deepak
that
was
really
encouraging,
so
yeah
I
completely
agree
with
you.
I
think
it
is.
It
is
primarily
the
shift
in
terms
of
mindset
wherein
you
know
what
GitHub
Advanced
security
does
is
basically
focuses
changes.
The
focus
from
you
know,
security
being
only
something
to
do
with
Security
Professionals
to
really
making
it
something
which
is
for
developers.
You
know
empowering
developers
giving
developers
a
better
experience
which
primarily
leads
to
you
know.
A
You
know
higher
remediation
rate,
higher
productivity
and
all
that
so
I
completely
am
in
sync
with
you
thanks
a
lot
for
those
good
words,
Deepak,
very
encouraging.
Moving
on
to
hilal,
so
hilal,
I.
Think
in
your
first
question,
you
were
talking
about
the
friction
that
you
see
from
developers,
and
you
know
the
challenges
that
you
had
to
face
as
a
security
team
in
terms
of
convincing
the
developers.
Okay,
this
is
really
very,
very
important.
B
Basically
what
is
the
objective
and
what's
the
end
goal
when
we
are
starting
on
this
journey
right.
The
second
is
basically
like
making
sure
that
we
enable
the
developers
by
enabling
developers
it's
basically
giving
them
the
tooling
the
automation,
that's
going
to
be
helping
them,
basically
simplify
the
testicops
requirements.
Right
I
think
you
were
just
talking
about
the
GitHub
Advanced
security
right.
So
it's
one
of
those
tools
that
actually
does
that.
That
simplifies,
basically
this
process
right-
and
it's
not
just
limited
to
that
right.
B
So
I
think,
once
we
enable
the
developers
I
think
it's
going
to
be
really
super
important
to
make
sure
that
we
also
at
the
same
time,
give
them
necessary
training
and
the
knowledge
to
use
them
effectively
and
because
they
sit
closest
to
the
source
right
so
because
they
develop
the
code
and
everything.
So
they
have
better
visibility
on
the
coverage
as
well
and
if
they
can
be
a
sort
of
like
send,
be
sensitized
about
what
are
the
security
requirements.
B
What
are
the
different
best
practices
that
we
need
to
keep
where
we
are
developing
the
code?
That's
actually
very,
very
important,
and
they
can
do
a
much
much
better
job.
If
don't,
if
they
know
exactly
why
they
are
doing
a
certain
thing,
we
can
give
the
recommendations.
We
can
use
them
to
play
books.
We
can
give
them
all
sorts
of
basically
checklists
and
things
like
that,
but
it
will
only
go
that
far
if
they
do
not
understand
the
importance
of
underlying
basically
the
requirements
right.
B
So
empowerment
comes
from
basically
like
making
sure
that
we
do
obviously
like
the
training
and
coaching
is
going
to
be
one
of
those
aspects
where
we
do
that
empowerment,
but
at
the
same
time
we
also
need
to
understand
this
that
whatever
security
team
used
to
be
doing
in
the
traditional
way
where
they
used
to
give
approvals,
they
had
to
like
go
through
a
lot
of
Hoops
and
they
had
to
go
through
a
lot
of
basically
like
back
and
forth
communication
on
what
can
be
done.
What
cannot
be
done?
B
I
think
that
should
be
delegated
to
basically
developers
as
well.
We
should
obviously
like
make
sure
that
the
security
has
the
governance
and
the
oversight
and
make
sure
that
they
do
the
validation
of
basically
the
coding
and
whatever
application
development
that
we
do
in
our
sdlc
right,
so
that,
obviously
the
job
is
with
the
security,
but
security
should
not
actually
be
involved
in
the
business
as
usual
activities
with
respect
to
the
developers,
I
think
and
also
the
decision
making
with
respect
to
adoption
of
the
technology
or
the
process.
B
I
should
lie
with
the
developers
as
well.
Of
course,
it's
a
collaborative
activity,
the
security
and
the
developers
can
have
this
done
in
a
collaboration
right,
but
at
the
same
time
we
have
to
make
sure
that
there
is
a
governance
on
top
of
that,
so
that
we
do
not
miss
out
if,
for
example,
some
basically
something
does
fall
through
the
crack
side.
So
in
summary,
like
it's
all
about
basically
like
engaging
the
developers
enabling
them
and
just
empowering
them.
A
I
I
think
hilal.
You
hit
the
nail
when
you
said
that
you
know
it's
important
to
empower
the
developers.
I
think
that's
that's
the
real
game
changer
when
it
comes
to
successful
devsecops
deployment,
we're
in
security
teams
primarily
have
to
do
governance,
part
of
it
and
let
the
developers
be
able
to
identify
and
remediate
vulnerabilities
in
their
workflows
itself.
So,
rather
than
you
know,
they
only
focusing
on
writing
the
code
on
the
features
and
functionalities.
I
think
it
has
to
come
from
Top.
A
It
has
to
be
a
top-down
approach,
a
boardroom
discussion
wherein
you
know
they
are
aware
about.
You
know
what
what
really
security
means,
what
it
means
to
really
fix
these
vulnerabilities
before
the
application
goes
into
production,
so
I
think
that
is
really
very,
very
important
and-
and
you
know,
security,
taking
least
import.
A
You
know,
I
would
say
at
least
part
in
this
entire
activity
and
letting
developers
be
empowered
and
letting
developers
do
majority
of
the
things
of
fixing
these
vulnerabilities,
as
Deepak
also
said
in
the
last,
you
know
his
part
of
it
wherein
you
know
he
said
that
almost
70
to
80
percent
of
the
vulnerabilities
are
actually
being
fixed
by
developers
very
early
in
the
development
life
cycle.
I
think
that
is
what
the
whole
shift
that
we
all
talk
about.
Shifting
security
lift
is
all
about.
A
So
thanks
thanks
hilal
for
those
encouraging-
and
you
know
very
important
thoughts.
Moving
on
to
our
next
question
that
I
think
will
be
for
Deepak
now
Deepak
the
market
data
tells
us
that
there
will
be
almost
500
million
new
applications,
micro,
Services
being
written
and
developed
in
the
next
four
years.
So
so
much
of
code
is
being
developed.
A
C
Community
right,
the
kind
of
development
velocity
they
are
looking
at
was
something
which
was
Unthinkable
in
I
think
earlier
times
right,
but
along
with
that,
of
course,
I
think
all
of
us
I'm
sure,
with
the
exception
of
no
one,
that
we
are
also
sensitive
about
the
security
challenges,
these
kind
of
development
velocities
bring
to
us
right.
This
is
something
which
is
known
right
from
the
top
of
the
leadership
right
to
the
developer
on
the
ground,
who
is
actually
coding,
he's
also
I,
think
quite
sensitized
on
the
aspect
of
security.
C
So
when
these
kind
of
you
know
explosive,
you
know
application
development
is
the
present
theme.
I
think
there
is
equal
amount
of
responsibility
on
everyone,
not
on
security.
Folks
alone,
to
to
you
know,
incorporate
security
to
make
much
I
I
would
say
to
leverage
that
integrated
automated
tooling
that
we
are
talking
about.
That
was
also
you
know,
giving
his
opinion
on
I
think
that's
where
we
need
to
take
developers
on
board,
so
this
is
only
going
to
be
possible
when
it
is
going
to
be
a
completely
a
seamless
collaborative
effort
right.
C
Well,
of
course,
the
app
set
goes
around.
The
governance
of
this
particular
effort
in
terms
of
development,
I
think
is
also
equally.
You
know,
I
think
the
the
onus
lies
on
us
to
ensure
that
the
continuous
sensitization
of
the
developers
community
of
everyone
in
this
ecosystem,
on
the
challenge
of
security
in
such
an
you
know
the
the
environment
where
we
are
seeing
witness
in
this
kind
of
development
velocity
for
the
applications.
I
think
it
puts
probably
on
us
on
all
of
us
right,
and
that
is
where
I
think
the
security
folks.
C
C
Think
there's
going
to
be
a
kind
of
a
paradigm
shift
in
way
people
processes
and
Technologies.
All
of
them
are
going
to
align
with
each
other
to
ensure
that
we
still
have
security.
While
we
have
this
High
development.
High
velocity
of
you
know,
application
development
right
putting
them
together
is
something
which
is
going
to
be
a
collective
responsibility
and,
yes,
we
are
prepared
for
it.
I
think
organizations
are
aware
of
it
and
they
are
doing
everything
at
their
disposal
to
ensure
that
security
moves
along
with
application,
development.
A
Yeah
I
think
I
I
I
am
in
agreement
with
you
on
that
development.
Velocity
is
all
about
devops,
so
we've
been
talking
about
devops
for
a
good
amount
of
time
now
so
agility,
agile
methodologies,
you
know,
developer
velocity
I
think
is
the
key,
and
if
you
have
to
stay,
businesses
have
to
stay.
You
know
competitive.
You
know,
in
fact
you
know
just
to
give
you
an
example.
You
know
a
few
years
back
when
we
used
to
interact
with
development
Community.
A
We
would
generally
see
that
every
application
would
have
maybe
three
or
four
releases
per
year.
That
number
has
gone
up
to
more
than
100
releases
every
year.
In
fact,
there
are
applications
that
would
need
a
release
every
day.
So
that's
the
kind
of
velocity
that
we
are
looking
at.
That's
the
kind
of
development
that
we
are
looking
at
and
if
this
is
the
scenario
where
developers
have
to
be
on
their
toes
I
think
so
much
of
code
getting
you
know,
introduced
I.
A
So
yeah
completely
in
sync
with
you
on
that,
in
fact,
with
this
particular
thought
of
you
know,
developer
velocity
comes
in
the
thought
that
how
do
you
really
do
it
and
a
lot
of
organizations
have
really
you
know,
tried
to
solve
this
problem
by
use
of
Open
Source.
So
a
lot
of
as
I
said
earlier.
In
my
you
know
a
statement
that
today
almost
70
to
80
percent
generally
in
the
organizations
70
to
80
percent
of
the
code.
A
That
forms
composition
of
your
softwares
is
open
source
and
you
know,
while
that's
the
right
thing
to
do,
but
what
you
know
the
biggest
challenge
that
now
the
organization
faces.
Okay,
what's
what's
the
security
threat
or
issues
that
this
particular
open
source
would
bring
in
so
I
my
developers
would
be
using
open
source
dependencies
libraries,
but
what's
the
risk
associated
with
it?
So
you
know
maybe
hilal
your
thoughts
on
that.
You
know
how
exactly
you
see,
you
know
open
source
risk
and
how?
B
Some
of
the
stuff
from
the
Internet
is
like
always
a
like.
It
allows
me
to
basically
do
development
fast
right,
so
there's
always
going
to
be
a
challenge
right.
So
there
are
obvious,
basically
benefits
by
using
open
source,
there's,
no,
no
denying
that
fact,
because
it
accelerates
the
development
deployment
and
everything
right
at
the
same
time
like
it
also
brings
in
a
very
critical
risk
government
into
the
development
life
cycle.
So
what
happens?
Is
that,
like
you,
are
always
going
to
be
unsure
about?
B
Basically,
what
is
my
attack
surface
area
if
I
do
adopt
an
open
source
library
or
open
source
tool
and
because
the
open
source
tools
do
not
go
through
the
rigorous,
basically
development
hygiene
that
we
otherwise
actually
expect
commercial
application
and
of
basically
all
the
other
software
to
go
so
there's
always
a
chance.
That's
there
is
basically
going
to
be
some
weakness
in
the
software
that
we
have
not
identified
yet
and
because
the
maintenance
is
so
sketchy
and
maintenance
may
not
be
assured.
So
there
is
always
a
chance
that
we
may
have.
B
We
may
be
running
something
in
the
Legacy.
That's
going
to
be
there
forever
right,
and
it's
only
a
matter
of
time
before
somebody
discovers
that
flow
right.
So
so,
and
it's
a
very
scary
thing
right.
So,
for
example,
you
have
an
open
source,
basically
software
component
in
your
code,
and
then
you
release
that
application,
and
now
it's
in
a
production
right.
So
it's
an
internet
facing
people
use
it,
your
consumers
use
it.
Customers
use
it
and
you
it
puts
your
entire
basically
application
at
risk
right.
B
B
B
So
we
have
to
be
proactive
about
basically
making
sure
that
all
the
open
source
software
actually
is
risk-free
and
as
much
as
we
can,
we
should
limit
their
exposure
in
critical
application,
at
least
in
the
front
facing,
and
at
least
where
the
attack
surface
is
actually
much
much
higher.
So
it's
also
that
so
so
in
summary,
I
think
it's.
B
We
are
not
going
to
go
away
from
open
source
anytime
soon
right,
so
the
best
we
can
do
is
basically
have
governance
and
monitoring
and
keep
as
Vigilant
as
possible
and
a
use
tools
that
are
going
to
be
helpful
in
either
upgrading
them
or
updating
them
or
making
sure
that
they
do
not
have
any
weaknesses
and
test
them
from
time
to
time.
If
you
have
that
kind
of
capability.
A
I
think
very,
very
important
to
use
tooling
because
yeah,
as
you
said,
open
source
is
not
going
to
go
away,
I
think
it.
It
should
not
because
it
is
the
right
way
and
right
approach
to
basically
agility
achieving
agility.
But,
yes,
what
we
could
do
is
basically
identify
and
mitigate
the
risk
associated
with
bringing
in
open
source
code
and
dependencies
by
using
you
know,
tools
like
software
composition,
analysis.
A
You
spoke
about
dependency
review
when
you
spoke
or
depend
about
yeah,
so
they
are
very
good
tools
which
help
you
identify
vulnerabilities
or
security
issues
in
these
dependencies
very
early
in
the
development
life
cycle.
So
basically
the
idea
is
that,
before
your
application
goes
into
production,
you
should
have
identified
these
risks
and
should
have
mitigated
these
risks
so
completely
in
sync,
with
you
on
that.
Moving
on
to
our
next
question
that
will
be
for
Deepak,
Deepak
I
think
you
know.
A
We've
we've
been
speaking
about
governance,
and
you
know
what
security
team
should
really
do.
Is
governance
and
let
developers
manage
the
vulnerabilities
and
repudiations
so
now
application
security
governance
to
manage
these
the
health
of
applications
across
your
organization?
It's
very
very
important
because
that's
the
whole
job
of
governance.
How
do
you
see
what's
the
health
of
your
applications?
Are
they
getting
scanned?
You
know
what
vulnerabilities
do
exist.
How
are
they
getting
fixed?
A
Which
team
is
not
doing
it
and
all
that-
and
you
know
there
are
plans
of
integrating
application
security
with
Sim
technology
as
well.
So
you
know
there
are
different
Sim
Technologies.
So
what
are
your
thoughts
on
the
same?
And
how
exactly
are
you?
You
know
managing
governance
in
your
organization
and
what
thoughts
do
you
have
when
it
comes
to
integrating
application
security
with
the
SIM
technology.
C
Hi
amul
I
think
thank
you
for
this.
Such
a
pertinent
question
right
and
as
I
think
ilal
brought
out
right
with
the
again
I
would
say.
Explosion
of
you
know
open
source
right
in
the
application
development
process
primarily
to
meet
the
business
needs
right
to
meet
the
as
I
said
again,
the
high
you
know,
development
velocities,
why
you
need
this
source
code
components
and,
of
course,
as
I
said,
this
native
organizational
code
is
I.
C
C
I
think
the
challenges
for
apps
that
governance
only
grows
if
many
phone
right
and
the
this
is
something
that
there's
been
a
lot
of
thought,
a
lot
of
deliberation
at
Flipkart
itself
or
my
own
organization,
and
as
to
how
do
we
prepare
ourselves
to
you
know,
take
on
these
challenges
of
especially
about
scanning
these
open
source
components,
availabilities
and
trying
to
preempt
any
kind
of
a
supply
chain
attack
right.
We
all
know
almost
as
recent
as
working
couple
of
days
back,
there
was
a
very,
very
prominent.
C
You
know
breach
about
an
open
source
library,
right,
I'm
sure
most
of
you
would
have
read
about
it.
The
fact
is
that
this
can
happen
to
anyone
it's
a
kind
of
a
ticking
Time
Bomb
right,
so
it
only
goes
on
to
probably
reiterate
the
the
necessity
of
putting
a
very,
very
robust,
absent
governance
around
it
and
that
one
thought
I
think
is
about
trying
to
do
integration
of
sim.
With
the
you
know,
application
security
process
itself,
I
think,
is
going
to
be
again
a
probably
a
great
enabler
towards
ensuring
a
robust
security
governance.
C
So
yes,
Amor,
that
is
already
a
discussion
in
my
organization
right.
It's
about
I,
believe
that
you
know
advanced
security.
I
think
can,
though
they
have
those.
Those
connectors
which
can
allow
us
to
you,
know,
get
them
to
sim,
but
I
think
the
bigger
challenge
which
I
feel
right
as
something
ago
again,
which
is
being
internally
discussed
right
at
a
high
level,
while
of
course,
abstract
governance
is
required
and
the
same
integration
is
going
to
be
playing
a
kind
of
You
Know
instrumental
role
about
that.
C
C
Now
the
would
you
want
to
let
these
alerts
and
notifications,
you
know,
seamlessly
flow
to
the
developers,
so
they
get
to
see
for
themselves
what
they
need
to
fix,
something
that
we
are
doing
it
as
of
now,
but
the
scale
will
be
much
bigger
when
we
integrate
with
same
with
the
same,
and
so
what
we
are
right
now
looking
at
is
technically.
This
seems
to
be
a
very
sound
proposition,
but
I
think
internally,
we
are
trying
to
build
a
process
as
to
what
happens
next,
I
mean
you
are
going
to
get.
C
The
SIM
is
going
to
give
you
that
kind
of
visibility,
T
that
kind
of
threat,
intelligence
about
what
kind
of
vulnerabilities
can
affect
your
application,
and
how
do
we
respond
to?
Those
kind
of
you
know,
alerts
that
some
kind
of
threat,
intelligence
inputs
coming
from
SIM
is
a
process
that
needs
to
be
well
defined,
needs
to
be
very
well
scoped
and
I.
C
C
A
A
So
this
was
a
very,
very
difficult
question
at
that
time,
but
you
know
very
relevant
as
well,
because
what
happens
is
you
know
the
biggest
challenge
that
we
have
today
with
application
Securities,
while
you'll
be
able
to
identify
and
remediate
majority
of
the
vulnerabilities,
but
can
you
fix
100
vulnerabilities
before
your
application
goes
into
production?
No,
you
can't
do
that.
So
what
is
it
that
you
can
do
to
at
least
prevent
your
applications
from
getting
attacked
or
hacked
despite
having
vulnerability?
So
that
was
a
thought
process.
A
You
know:
can
a
threat
Intel
be
provided
to
you
know
the
Sim,
wherein
they
could
basically
monitor,
so
they
would
have
a
similar.
Your
sim
has
idea
on
what
kind
of
vulnerabilities
are
still
open
with
your
applications
and
can
that
be
monitored
by
your
sock
team
and,
and
you
know,
prevented
from
getting
breached
so
yeah
I
think
this
is
I.
A
I
know
we
both
have
been
talking
about
this
for
some
time
now,
and
you
know
we've
been
discussing
on
this,
but
a
very
relevant
and
pertinent
topic,
I
think
or
GitHub
Advanced
security
is
really
working
very
seamlessly
on
this.
In
fact,
we've
already
had
Integrations
available
with
Sentinels
Sumo
logic
Splunk,
and
we
are
working
on
Integrations
with
other
Sims,
so
another
advantage
that
csos
generally
get
is
now
they
have
don't
have
to
look
at
multiple
dashboards.
They
just
have
a
single
dashboard
where
they
can
get.
A
You
know
security
reports
from
all
their
different
Technologies
and
now,
including
application
security
as
well
so
yeah
I
think
that
that
really
is
going
to
be
the
next
thing
when
it
comes
to
application
security.
Moving
on
to
hilal,
so
I
think
we
spoke
about
developer
empowerment.
We
spoke
about
you
know:
how
do
you
basically
ensure
that
developers
really
are
in
sync
with
what's
happening
on
application
security?
So
what
do
you
feel
I
think
we
you
spoke
about
it,
but
I
would
want
to
understand
in
detail.
A
B
Yeah,
so
it's
going
to
be
favored
out
for
the
success
of
under
circus
program
right.
So,
if,
let's
assume
for
a
minute
right,
so
we
have
a
very
well
built
CI,
CD
Pipeline
and
we
have
integrated
all
the
necessary
security
tools
and
everything
right
and
now
each
of
those
security
tools
is
actually
intelligent
enough
to
give
you
the
results
that
you
need,
but
somebody
has
to
decipher
them
where
somebody
has
to
take
action
on
them
right.
B
So
normally
what
happens
like
if
you
implemented
a
tool,
it
gives
a
bunch
of
basically
like
results,
and
somebody
has
to
go
and
say:
oh
I
had
to
basically
assign
some
criticality
to
it
or
ask
to
assign
some
severe
ready
to
it,
and
that
cannot
happen
if
that
particular
person
who's
actually
evaluating
those
results
is
not
familiar
with.
What
exactly
that
result
tool
is
telling
him,
so
it's
very
important.
B
It's
one
thing
that
actually
will
make
or
break
your
desktop
program
developers
need
to
be
confident.
They
need
to
be
basically
aware
of
exactly
like
how
to
interpret
not
just
the
results,
but
also
how
to
optimize
those
tools
and
how
to
basically
execute
basically
the
test
cases
that
they
may
have
or
execute
any
kind
of
security
requirements
that
they
have
right.
So,
in
order
for
basically
like
people
to
do
basically
all
the
training,
that's
required
right.
B
So
what
that
means
is
that
you
should
have
basically
like
subject
matter
experts
who
can
actually
come
and
basically
explain
to
you
like
what
exactly
a
particular
result
means
and
how
do
you
actually
like
assign
a
vulnerability
scores
to
them
and
how
do
you
sort
of
like
fix
them?
So
now
there
are
different
ways
to
basically
like
to
basically
train
the
developers
around
application
security.
B
You
have
like
gamification
of
application
security,
which
is
catching
on
quite
heavily
right,
so
which
is
actually
interesting
concept
where
you
have
some
small
small
business
like
application
security
exercises
which
are
relevant
to
what
you
are
doing
or
what
you
are
actually
developing,
and
that
becomes
really
good
tool
for
the
people
for
the
developers
to
use
in
order
to
understand.
Basically,
the
root
cause
of
vulnerabilities,
so
that
that
vulnerable,
that's
actually
going
to
be
recurring,
does
not
actually
occur
again.
B
Similarly,
like
there
are
other
things
that
we
can
do,
for
example,
I
think
the
security
Champions
program,
which
I
think
is
very
common
concept
right.
So
it's
very
important
that
you
get
a
basically
some
people
from
the
development
Community
train
them
on
the
security,
so
that
they
can
actually
act
as
your
extended
hands
within
the
development
teams
and
train
rest
of
the
teams.
Right
so
and
that's
the
way
you
actually
like
scale
based
on
the
training
in
the
in
your
engineering
organizations.
B
Apart
from
that,
of
course,
like,
you
also
need
to
have
some
specialized
way
of
training,
the
people
on
the
automation
that
you
have
done,
or
basically
making
them
familiar
with
the
process,
making
them
familiar
with.
Basically,
the
different
types
of
threats
and
vulnerabilities
that
we
have
in
our
in
our
software
in
order
for
basically
to
be
for
us
to
basically
deliver
all
of
this
successfully
right.
So
there
has
to
be
a
metric
based
system
right.
You
have
to
understand
that.
B
Okay,
if
we
actually
do
execute
this
particular
a
knowledge
base
or
this
particular
training
program,
how
many
people
exactly
did
actually
benefit
from
it
and
is
the
number
of
vulnerabilities
or
issues
that's
coming
down
are
going
up?
What
is
the
quality
of
the
test?
Security
testing
that's
happening
and
how
secure
are
our
products
when
they
go
into
production?
So
all
in
all
I
think
it's
a
very
comprehensive
planning
that
needs
to
happen
around
security
or
training
and
awareness,
and
it's
I
think
without
it.
B
I
I,
100
percent
believe
that
it's
not
going
to
be
a
successful
broker.
No
matter
how
hard
you
try,
you
may
buy
the
best
of
the
tools
you
may
have
the
best
of
the
continuous
delivery
pipeline
very
smooth,
very
simplified,
but
if
the
developers
do
not
understand
what
they
are
trying
to
basically
prevent
from
happening
what
they
are
trying
to
basically
prevent
from
going
into
production.
So
it
will
be
always
a
challenge.
B
So,
in
order
for
basically
the
engineering
and
the
developers
to
benefit
from
Dosa
cops,
our
training
is
going
to
be
mandatory
and
I
would
actually
start
returning
to
be
honest
right.
So
the
journey
should
start
from
there
like
from
the
awareness
sessions
that
okay,
what
exactly
is
there
a
swaps?
And
how
do
we
actually
implement
this?
What
are
the
different
benefits
that
we
get
from
it
and
all
the
programs
they
have
that
awareness?
They
become
your
stakeholders
in
the
entire
operation
and
once
they
become
your
stakeholders
right.
B
So
it's
their
responsibility
as
well,
and
they
can
own
up
the
security
tasks
within
their
desk
of
Pipeline
and,
as
Deepak
was
earlier
mentioning
right.
So
we
need
to
basically
maintain
the
governance,
but
rest
everything
should
be
actually
like
offloaded
to
the
developer.
So
that
they
can
take
the
decisions
that
they
need
to
make
yeah.
A
Yeah,
in
fact,
I
have
been
speaking
to
a
lot
of
csos
and
Engineering
heads
and
organizations,
and
you
know
they
come
up
with
different
different
innovative
ideas.
As
you
said,
gamification
of
this
entire
learning,
which
is
really
you
know,
Innovative
yeah
you,
you
can't
just
put
people
in
classroom
and
board
rooms
and
just
keep
throwing
you
know
theoretical
information
on
them
and
expect
them
to
you
know
be
Champions,
but
it
has
to
be
I,
think
a
continual
process.
A
D
First
question:
I'll,
ask
is
GitHub,
galaxy
has
covered
a
lot
about
Ai
and
Automation
devops
and
security,
but
what
some
of
the
people
in
chat
want
to
know
is
how
do
we
actually
integrate
devops
and
security
together?
Maybe
you
two
can
talk
about
how
you're
actually
implementing
devops
and
Security
in
your
workplaces.
B
So
in
order
for
us
to
basically
take
those
steps,
basically
like
to
basically
integrate
security
with
devops
right,
so
it's
always
basically
like
important
to
understand
very
clearly
what
is
on
my
release
pipeline
like
how
it
is
actually
shaped
up,
what
are
the
frequency
of
mirror
lasers
and
who
are
the
people
responsible
for
doing
those
releases,
and
once
you
identified
that
okay,
this
is
basically
my
development
environment.
This
is
basically
the
IDE
that
I
use.
This
is
my
tool
set
that
I
use
for
development.
Then
you
have
basically
your
earliest
pipelines.
B
You
have
your
code
repositories
like
GitHub
or
something
where
you
commit
your
code
and
what
exact
happens
there.
Then
you
have
your
other
tools
that
will
be
part
of
that
CI
CD
pipeline,
so
identify
them
very
clearly
that
which
ones
are
you
are
basically
like
pivotal
Tools
in
that
particular
Pipeline,
and
where
exactly
can
you
integrate
security
right
so
each
step
of
the
way
you
have
to
identify
what
is
going
to
be
the
most
beneficial
tool
or
tasks
that
can
be
integrated
with
the
devops
pipeline?
B
So
one
of
the
things,
for
example,
at
the
ID,
you
could
do
potentially
do
syntax
checking
for
security,
vulnerability,
control,
static
analysis.
You
can
do
then
going
forward
when
you
do
code
commits,
and
things
like
that.
You
can
do
software
composition,
analysis,
you
can
do
dependency
analysis,
you
can
do
static
or
analysis,
and
after
that
like
when
it
goes
to
basically
like
in
a
business
staging.
So
you
have
other
tools,
basically,
that
you
can
run,
which
will
be
like
vulnerable
scanning,
Dynamic
scanning,
and
things
like
that.
B
So
you
have
so
it
all
depends
on
how
you
release
pipeline
is
actually
shaped
in
your
organization
and
what
are
the
touch
points
that
you
have
identified
where
these
tools
or
these
Services
can
be
integrated?
So
that
you
get
the
maximum
benefit
and
it's
least
intrusive
as
well,
so,
for
example,
in
a
continuous
delivery
setup,
you
don't
have
a
lot
of
flexibility
with
respect
to
basically
tools
taking
a
lot
of
time
to
basically
complete
the
results.
So
you
have
to
also
identify
the
basically
potential
risks
that
you
actually
be
introducing.
B
When
you
actually
introduce
the
security
tools,
it
should
not
impact
the
performance.
It
should
not
impact
personal
quality
testing
that
it
does.
It
should
not
impact,
basically
the
velocity
of
the
releases
right.
So
once
you
have
that
once
you
actually,
that
plan
is
actually
you
have
the
problem
statement.
You
have
the
release
pipeline
clearly
defined,
and
you
then
you
have
obviously
the
operational
Freedom
that
you
need
to
do
right.
So
once
you
have
actually
identified
that
it
should
be
a
smooth
sailing
with
respect
to
their
servers.
C
D
C
To
hilal
I
mean
of
course,
I
think
so
beautifully
summed
up
right
as
to
why
we
need
to
bring
in
security,
I
think
it's
important
to
take
the
developers
on
board
right,
I.
Think
this
whole.
If
you
see
devops
have
evolved
to
sort
out
a
certain
operational
inefficiencies
between
operations,
team
and
development.
Now
we
need
to
represent
Security
in
that
chain.
I
think
it's
all
about
that
right
and
so
most
of
the
times
as
brought
out,
he
once
a
developer
right.
C
So
he
now
in
the
security
side,
he
understands
the
advances
of
security,
so
I
think
it's
about
a
constant
evolution
of
training
and
sensitization
to
the
developers
right.
You
must
use.
In
my
opinion,
what
we
do
is
every
time
there
is
a
particular
incident
of
reach,
which
is
reported
in
public
domain.
We
try
to
take
that.
You
know
as
an
example
as
to
why
we
need
to
bring
in
security
through
the
entire
development
life
cycle
right
and
as
I
think
Halal
brought
out.
It's
very
important
to
to
find
the
problem
statement.
C
Understand
the
CI
CD
pipeline
pick
up
touch
points
where
you
want
to
bring
in
security
and
only
security
to
the
point
that
the
developer
is
convinced
is
going
to
bring
a
lot
of
value.
Add
right
and
in
a
way
it
should
be
seen
as
something
which
is
adding
to
your
probably
through
a
throughput,
because
eventually,
if
something
goes
wrong
with
security,
you
want
to
come
back.
You
know,
look
at
the
code
once
all
over
again,
so
overall
I
think
security
has
to
be
seen
as
a
terms
of
in
terms
of
improving
the
efficiency
right.
C
D
Fantastic
I
think
we'll
follow
that
line,
then
of
implementing
devops
and
security
or
youth
learning
security
throughout
the
entire
development
life
cycle.
So.
To
that
point,
how
do
we
ensure
that,
because
often
within
businesses,
deliverables
are
quite
tight
and
people
want
things
now
now
and
obviously
a
mole?
You
mentioned
the
words
a
couple
of
times
in
power,
pairing
developers
and
the
word
velocity,
but
how
do
we
ensure
that
you
know
we've
got
this
urgency
of
deliverables.
We
need
to
integrate
security
throughout
the
development
life
cycle
and
we've
obviously
got
regulations.
D
A
I
think
it's
very
important
that
when
choosing
a
solution,
we
look
at,
you
know
a
solution
which
would
help,
as
as
we
all
have
been
talking
about
improving
empowering
developers
and
primarily,
what
does
that
means
is
giving
developers
a
better
experience,
because
at
the
end
of
the
day,
it
is
the
developers
who
are
going
to
fix
your
vulnerabilities.
So
it's
better,
you
make
them
happy,
you
give
them
not
only
training
and
education,
but
you
give
them
those
tools
and
give
those
tools
to
them
very
early
in
the
development
life
cycle.
A
So
the
the
shift,
the
the
maximum
shift
left
that
you
could
do,
would
help
developers
in
you
know
in
in
the
ability
to
fix
vulnerabilities,
identify
and
fix
vulnerability.
So
the
whole
thought
process
that
we've
been
discussing
and
in
fact
we
have
advanced
security,
also
talks
about
it
is
the
approach.
Wherein
can
we
bring
application
security
to
developers
workflow?
Can
we
Empower
developers
to
be
able
to
identify
and
remedy
create
vulnerabilities
in
their
workflow
itself
so
rather
than
they
going
to
different
tools
and
Technologies?
A
You
know
today
what
happens
is
generally
while
we
are
shifting
left.
While
we
are
talking
about
multiple
different
Technologies,
you
know,
like
software
composition,
analysis
to
identify
open
source
vulnerabilities
SAS
to
help
you
identify
open.
You
know:
custom
code,
vulnerabilities
secret
scanning,
Solutions
container
scanning
Solutions,
so
there
is
so
much
that
developers
have
to
really
do
in
terms
of
going
into
different
Technologies
trying
to
identify
and
remediate
vulnerability.
A
So
I
think
very
important
is
to
bring
everything
together
in
one
place
and
provide
developers
with
a
single
pane
of
glass
kind
of
a
view
wherein
they
could
fix,
identify
and
fix
vulnerabilities
from
any
kind
of
technologies.
That
organization
is
using,
so
it's
all
about
giving
developers
a
better
experience.
That's
my
thought.
D
B
Yeah
so
as
Europe
again
so
so
yeah
so
as
Amor
mentioned,
so
it
should
have
least
amount
of
basically
interruption
or
disruption
in
their
workflows
right,
so
they
should
be
able
to
basically
use
the
results,
use
the
deficit
of
automation
or
tools
whatever
in
their
regular
workflow
right.
It
should
be
like
a
business
as
usual
activity
for
them.
It
should
not
be
seen
as
an
additional
thing
that
they
have
to
do.
B
They
are
already
swamped
with
so
many
things
that
need
to
do
right,
so
they
have
to
think
about
availability
resilience.
You
have
to
think
about
performance
and
everything
right
on
top
of
that,
we
also
expect
them
to
basically
make
sure
that
whatever
you
build,
it's
actually
secure
enough
right
so-
and
this
is
important-
and
basically
for
the
developers
to
not
get
basically
slowed
down
by
this
right.
B
So
I
I
strongly
believe
that,
like
the
automation
that
we
built
or
basically
whatever
processes
that
we
put
in
place
for
the
the
setups
right
has
to
be
in
collaboration
with
the
Developers,
so
we
should
100
have
their
commitment
and
their
basically
like
inputs
when
we
are
developing
these
strategies
and
only
basically
when
they
buy
into
it,
and
then
it
will
be
actually
successful.
So
the
least
amount
of
inclusion
that
we
can
do
the
better,
and
it
should
always
be
basically
something
that
they
can.
B
They
enjoy
doing
right
so,
rather
than
this
being
something
okay,
this
should
not
actually
become
like
another
checkbox
right,
so
another
formality
that
they
have
to
do
so
that
they
can
get
the
release
out
of
their
door
right.
So
this
has
to
be
something
meaningful
and,
as
Deepak
earlier
mentioned,
that
there
has
to
be
some
value
addition
because
of
this,
and
they
should
see
that
value
addition.
Now.
Only
then
I
think
that
that's
program
will
be
successful.
B
C
Eventually,
security
has
to
be
developed
into
oriented
right.
We
understand
until
we
get
them
to
to
understand
the
advances
of
security.
I
think
the
effort
wouldn't
be
really
achieved
in
its
entirety,
and
how
do
we
do?
That
is
a
tough
challenge
for
security,
folks
right
so
I
think
at
that
point.
This
is
where
we
feel
various
other
initiatives:
sensitization
training,
gamification,
something
which
really
comes
as
it's
a
very
interesting
concept
where
developer
developers
themselves,
you
know,
feel
very
connected
to
security.
C
So
the
idea
is
that
as
amul
also
brought
out
the
more
you
shift
left
right,
I
think
most
of
these
issues
are
already
taken
care
of
at
the
start
of
the
development
cycle
itself.
So
when
you
probably
you
know,
selecting
a
package
for
a
project
you're
going
to
write
a
test
function,
we're
going
to
conduct
some
tests
and
even
you're,
going
to
conceive
a
kind
of
a
deployment
environment.
So
when
that
kind
of
project
planning
is
happening,
imagine
if
security
taking
care
of
that
point
of
time,
I
think
bulk
of
the
journey.
C
We
have
covered
very
early
in
this
development
life
cycle,
and
that
is
why
I
think
it
gets
natively
built
into
the
process
and
it
becomes
you
know,
seamless
to
the
developer,
and
the
entire
experience
looks
like,
as
is
business
as
usual
as
something
which
he
has
brought
out.
I
think
these
are
some
of
my
thoughts
and
moving
forward.
I.
Think
good
tools,
like
you'd
have
advanced
security
I
think
is
making
a
lot
easier
for
the
security
folks
to
drive
this
message
home
to
the
developers
Community.
That's
all
for
my
site
on
this.
D
I'm
glad
that
the
tools
are
making
it
much
easier
for
you.
So
speaking
of
the
tools,
if
you
have
a
project,
whether
it's
an
open
source
project
or
you've,
just
started
something
new
or
you're,
picking
up
a
legacy
system
within
your
team
or
your
organization,
and
it
doesn't
actually
have
any
Security
in
it-
that's
been
built
throughout
the
pipeline.
What
is
the
best
way
to
then
add
Security
on
top
I
think
this
question
is
probably
coming
from
people
who
are
you
know,
building
projects
and
going?
Oh,
we
actually
don't
have
any
security.
A
D
C
Can
but
I
can
say,
I
come
from
that
background,
where
we
you
had.
We
had
a
lot
of
Legacy
systems
to
look
after
right
and
of
course,
if
security
was
an
afterthought,
then
what
do
we
do
now
right?
I
think
this
is
the
challenge
which
I
think
Michelle's
bringing
out
I
think
we
don't
have
to
really
get
too
worried
about
that.
Most
of
it
as
I
said
right.
C
If
you
take
a
small
deep
dive
into
the
security
aspect,
for
example,
static
code
analysis
right:
if
you
do
that
kind
of
code
analysis,
we
get
to
know
the
vulnerabilities
in
the
code
itself,
there
will
be
a
lot
of
false
positives.
As
I
said,
it
has
been
a
journey
for
everyone,
so
it's
going
to
be
for
Journey
for
those
who
haven't
taken
security
at
the
start
of
the
journey
right,
so
they
need
to
get
aligned
with
it
and
I
think
it
is
also
going
to
be
an
incremental
Journey
right.
C
I
think
they
do
not
need
to
get
bogged
down
by
the
but
too
many
other
factors
about
insurance
security.
Pick
up
one
item
at
a
time.
Maybe
I
would
suggest
I
think
if
they
already
have
a
project
running,
get
into
some
kind
of
a
static
code.
Analysis
in
a
more
CS
basis,
right
and
I
think
be
very,
very
wary
of
whatever
the
open
source
components
they
use
in
the
in
their
project.
In
case
they
are
being
used,
they
must
be
scanned
for
vulnerabilities.
I.
A
Thanks
mesh
I'm,
sorry
I
know
there
are
a
lot
of
questions
which
we
probably
would
try
and
get
back
to
you
all.
You
know
offline,
but
thank
you
so
much
everybody.
This
is
end
of
session
thanks
hilal,
thanks,
Deepak
amazing
session
thanks
audience,
just
to
recap,
I
think
I'm
sure
you've
taken
something
from
here
today
when
we
talked
about
you
know,
devsecops,
with
respect
to
shifting
security
left
with
respect
to
empowering
developers
to
with
respect
to
you
know
giving
developers
a
better
experience.
A
You
know
learnings
trainings
and
you
know
I
think
the
gamification
part
of
it
so
I
think
it
was
all
all
important
and
very
meaningful
to
all
of
you.
So
I
think
we
have
some
highlights.
We.
We
have
some
more
sessions
coming
up
for
you
all
today.
So
today
we
have
another
session
which
is
scale
your
security
with
global
community
of
security
research.
My
colleagues,
Brenton
shalomi,
would
be
handling
that
we
have
tomorrow.
We
have
another
sessions
for
you,
which
is
more
on
the
efficient
and
collaborative
timelines.
A
Fireside
chat:
how
to
increase
developer
productivity
by
investing
in
more
efficient
tooling.
This
is
hosted
by
fathin
and
featuring
Commonwealth
Bank
uran,
KPMG
Tokyo,
so
amazing
sessions.
For
you
all.
We
also
have
reduced
text
stack
complexity
with
GitHub.
This
is
hosted
by
Karthik
and
Shilpa,
we'll
be
sending
a
follow-up
email
once
sessions
are
available
to
watch
On
Demand,
so
keep
an
eye
for
this
in
your
inbox
before
we
wrap
up
folks
I
would
like
a
deeper
dive
on
anything
we
covered
here
today.
A
A
You
will
find
the
link
to
that
survey
in
the
documents
tab
at
the
right
of
your
screen
in
the
resources
or
in
the
chat
we
designed
this
program
for
you
and
want
to
be
sure
that
you're
getting
the
most
value
out
of
your
time.
Here
we
do
take
this
feedback
and
our
learnings
to
optimize
our
future
programs
to
continue
to
raise
the
bar
for
you.
So
don't
be
shy.
Tell
us
what
you
think
and
with
that.
Thank
you
all
for
joining
us
looking
forward
to
seeing
you
all
in
the
next
one.
Thanks
thanks.