►
From YouTube: How to implement native security practices that deliver customer value and optimize dev experience
Description
Adopting the right approach to security reduces risk and allows teams to deploy quickly and securely. If you’re wondering how you can remove technology debt and streamline the DevSecOps process, this session is for you. Hear from Pascal Muller, Head of IT Application Development & Strategy at DVAG, and Andra Lezza, Senior Application Security Engineer at Checkout, on how they optimized their security practices by focusing on the developer experience. You’ll come away with an understanding of how to focus on key strategic priorities using a developer-first security approach, like securing open source, pipelines, and preventing security issues.
Stay up-to-date on all things GitHub by subscribing and following us at:
YouTube: http://bit.ly/subgithub
Blog: https://github.blog
Twitter: https://twitter.com/github
LinkedIn: https://linkedin.com/company/github
Instagram: https://www.instagram.com/github
TikTok: https://www.tiktok.com/@github
Facebook: http://fb.com/github
About GitHub
It’s where over 100 million developers create, share, and ship the best code possible. It’s a place for anyone, from anywhere, to build anything—it’s where the world builds software. https://github.com
A
A
Oops
there
we
go
excellent,
so
welcome
to
GitHub
Galaxy.
My
name
is
niroshen
rajadare
and
I'm
the
senior
Global
director
for
sales
for
GitHub
Advanced
security.
We
have
an
incredible
lineup
of
leaders
here
to
share
the
perspectives
and
experiences
around
securing
development
systems,
while
optimizing
productivity
first
a
little
bit
of
housekeeping.
So
if
you
have
any
questions,
there's
a
q
a
panel
on
the
top
right
hand,
side
of
the
session,
please
feel
free
to
go
there
and
ask
any
questions.
A
We
have
some
moderators
in
there,
who'll
be
more
than
happy
to
to
take
those
questions,
and
then
we
can
pick
out
some
interesting
ones
to
bring
into
the
forum
if
you
have
it
for
our
panel,
if
you're
having
any
difficulties
with
your
browser,
the
recommended
viewer
that
we
have
is
Chrome.
So
please
try
that
out
if
you're
having
challenges
and
finally,
if
that
doesn't
work,
there's
a
docs
link
inside
the
right
hand,
side
panel,
please
jump
into
that
and
see
if
there's
anything
else,
that
could
help
you.
A
Okay,
so
adopting
the
right
approach
to
security,
reduces
risk
and
allows
teams
to
deploy
quickly
and
securely.
If
you're
wondering
how
you
can
remove
technology
debt
and
streamline
devops
processes,
then
you're
at
the
right
session
without
further
Ado
I'd
like
to
invite
the
panel
to
introduce
themselves.
A
A
Excellent,
thank
you
Andra.
Thank
you
for
taking
the
time
to
be
with
us
today.
Next
we
have
Pascal
Muller,
head
of
IT
application,
developer
development
and
strategy
at
Deutsche
women,
hello,
Pascal,
thank
you
for
taking
the
time
to
share
your
thoughts
with
our
audience
today.
Could
you
tell
us
a
little
bit
about
yourself?
First.
C
C
We
build
tools
that
enable
our
financial
advisors
to
best
serve
their
customers,
while
offering
this
human
touch
that
lies
at
the
very
core
of
our
business,
because
they're
very
much
focusing
on
the
physical
point
of
sale
on
the
person-to-person
basis,
I'm
responsible
for
teams
working
on
it
strategy,
Tech
projects
and
their
underlying
architecture,
as
well
as
teams
on
classical
development,
QA
and
our
platform
team,
providing
these
teams
with
all
necessary
development
tools
and
resources.
Thanks
for
having
me
here
today
and
I'm,
looking
forward
to
an
exciting
conversation,
excellent.
A
Thank
you
Pascal.
Thank
you
again
for
taking
the
time,
and
finally,
we
have
robboss.
Rob
is
a
GitHub
trainer
at
Xperia.
If
any
of
you
have
been
fortunate
to
follow
Robin
LinkedIn,
you
can
see
he's
constantly
sharing
trainings
and
Thoughts
with
the
community
from
his
experience.
Working
with
our
customers.
Welcome
Rob.
D
D
As
we
said,
I
work
experience,
we're
a
guitar
partner,
so
I'm
really
focused
on
doing
the
things
with
GitHub
as
well,
but
I
like
the
the
notion
that
we
have
there
of
developer
first
and
we
bring
everything
there
and
try
to
do
everything
in
a
rounded
away.
So
from
that
I
started,
giving
a
lot
of
training
because
I
see
that
a
lot
of
people
need
that
help
to
get
that
knowledge
over
to
and
the
actual
Engineers
who
do
things
for
us,
and
it's
always
nice
that
somebody
are
up
says
we
need
to
focus
on
security.
D
A
Happy
to
be
here
excellent,
thank
you.
Thank
you
for
sharing
Rob.
It's
it's
really
beneficial
for
all
of
us.
I
understand
there
was
a
little
bit
of
a
technical
hitch
when
we
were
introducing
Andra,
so
perhaps
under
you
could
share
again
for
our
audience
a
little
bit
about
yourself,
and
you
know
your
expertise.
Please.
B
B
Thank
you
for
inviting
me
by
the
way,
so
I
was
saying
that
I
do
application
security
for
a
payments,
company
I
focus
mainly
on
automating
security
and
best
practices,
and
working
with
about
600,
Engineers
or
so
in
our
company
to
adapt
security
to
the
way
they
work
so
that
it
can
easily
supports
them
at
every
step
of
the
sdlc
process
and
I
also
lead
the
OAS
London
chapter
along
with
two
other
very
nice
leaders
on
our
sides.
I
hope
this
one
was
okay.
A
A
A
A
Awesome
so
maybe
Quentin,
if
you
could
maybe
bring
the
poll
up
to
the
screen,
we
can
just
share
with
the
audience
so
that
we
can
see
wow.
Look
at
that,
so
the
predominant
part
of
our
audience
are
developers
it's
great
to
see
developers
caring
about
security
and
learning
how
you
can
bring
security
into
your
code
cluster.
So
that's
really
amazing.
Thank
you.
Thank
you
all
for
joining.
We
have
the
devsec,
Ops
and
infrastructure
teams
here
as
well
and
a
few
security
people
too.
So
thank
you
very
much.
A
A
A
A
A
Actually,
it's
really
interesting
as
we
look
at
these
results
here,
I
mean
one
of
the
founding
principles
of
GitHub
Advanced
security
was,
you
know
where
we
wanted
to
focus
our
focus.
Our
attention,
and
one
of
the
things
that
we
used
to
say
is
that
you
know
in
the
industry.
When
we
launched
Advanced
security
there
there
wasn't
an
information
problem
like
you
have
more
than
enough
information
around,
like
all
the
kinds
of
problems
that
you
have
in
your
code.
We
have
a
remediation
problem.
A
Like
you
know,
we
need
to
fix
things,
so
it's
it's
really
interesting
to
see
that
remediation
is
also
a
priority
here
for
the
audience.
So
thank
you
for
that
great
okay.
So
without
further
Ado
Let's,
let's
kick
on
here,
I
think
we
have
them
through
and
a
very
strong
panel,
excellent
okay.
So
just
for
our
agenda
here.
So
you
know
thank
you.
First
of
all
for
sharing
all
that
information
with
us
from
the
audience.
A
It
really
helps
us
focus
our
attention,
so
I'm
really
grateful
for
our
panelists,
taking
the
time
today
to
share
how
they
optimize
their
security
practices.
By
focusing
on
the
developer,
experience
and
I.
Think
that's
really
in
tune
with
the
background
that
all
of
you
have
in
this
in
this
session
and
also
what
you've
all
kind
of
indicated
are
your
priorities
as
well
for
our
goal
to
today.
A
For
all
of
you
watching,
it
is
for
you
to
come
away
with
an
understanding
of
how
to
Focus
key
strategic
priorities
using
a
developer,
First
Security
approach
like
securing
open
source
pipelines
and
preventing
security
issues.
We'll
do
this
by
touching
on
Three
core
topics.
So
the
first
one
is
understanding
our
panelists
top
challenges
in
securing
software.
A
So
please
feel
free
to
ask
away,
and
as
I
mentioned,
we
have
our
moderators
there
to
try
and
help
in
in
working
through
those
questions.
In
real
time,
too,
okay,
so,
let's
begin
with
our
first
topic,
so
our
panelists
represent
a
range
of
Industries.
However,
since
most
companies
today
are
software
companies
either
developing
their
own
or
leveraging
third-party
software
to
do
business.
Let's
start
our
conversation
with
software
security
and
how
you
balance,
developer,
productive
productivity
with
security,
so
maybe
Pascal,
if
you
could
take
the
lead
here
for
us.
A
C
So,
in
order
to
move
forward
with
this
endeavor
effectively
and
as
fast
as
possible,
we
have
Optima
opted
for
a
very
centralized
approach.
So
we
transformed
our
newly
founded
Cloud
team,
then
to
a
platform
team
as
we
call
it
that
centralized
its
funded
services
like
provisioning
cloud
services,
also
kubernetes,
Source
control,
cicd,
workflows,
testing
tools
and
other
development
tools
and
then
yeah
transformed
and
and
then
have
centralized
as
a
as
a
central
service
provider
for
developer
units
throughout
the
whole
dbhd.
C
And
this
allows
us
or
allows
our
teams
to
focus
on
application
development
more
instead
of
this
maintenance
and
operations
so
and
from
from
this
point
on
the
comprehensive
expansion
of
these
Central
Services,
both
in
Brad
and
in
that
has
been
our
most
important
level
for
optimizing.
Our
recent
application
development
Also
regarding
regarding
security.
C
So
this
centralized
approach
goes
so
far
that
the
platform
team
centrally
defines
the
delivery
of
development
tools
such
as
cicd
workflows,
and
then
ensures
the
use
of
these
standards
across
the
company
and
coming
from
this
standard
approach.
In
order
to
prevent
these
standards
from
becoming
too
rigid
and
all
Fashions,
so
we
continuously
work
on
them
and
develop
them.
The
platform
team
and
our
Elite
developers
regularly
Exchange
information
regarding
adjustments
and
further
developments,
and
also
some
tech
enthusiasts
or
our
Tech
nuts,
were
not
among
the
lead.
D
C
A
Yeah,
no
that's
great
Pascal
I
mean
a
couple
of
things
that
that
I
I
would
pick
out.
There
is
when
you
kind
of
spoke
about.
You
know
how
individuals
or
teams
were
going
off
and
building
their
own
capabilities.
You
know
we
often
talk
about
the
the
fragmentation
and
lack
of
ability
to
share,
as,
like
you
know,
like
a
lack
of
inner
Source
strategy.
So
it
sounds
like
by
moving
the
business
to
a
best
of
Suite,
which
is
broadly
applicable
for
everyone
you're,
creating
an
environment
where
each
other's
you
know
everyone
can
contribute
with
each
other.
A
They
can
be
productive
very
quickly
and
that
you
know
really
does
contribute
to.
You
know,
develop
a
velocity
which
is
a
you
know,
a
key
reason
why
people
look
at
the
platform,
so
you
know
that's
really
interesting
and
I
also
love
how
you've
taken
those
technical,
Champions
and
brought
them
in
as
part
of
the
process
of
building
a
best
of
Suite
ecosystem.
So
that's
that's.
That's
super
valuable
for
sharing
that.
Thank
you,
Andra.
How
about
yourself
at
checkout
we'd
love
to
to
hear
your
perspective
here.
B
Sure
we've
seen
two
main
topics
in
our
engineering
space.
One
of
them
I
call
it
a
an
opportunity
rather
than
a
challenge,
and
it's
quite
similar
to
what
Pascal
mentioned
just
now,
which
is
learning
how
different
teams
approach
development
and
that
security
to
the
way
they
work
instead
of
forcing
Security
on
top
of
what
they
do.
B
So
we've
looked
at
the
processes,
their
platforms,
but
then
we
also
try
to
make
it
as
easy
for
them
to
secure
so
that
we
could
scan
code
and
track
findings
in
a
fairly
centralized
manner.
So
you
can
all
go
and
do
what
you
want,
but
it's
you
know:
GitHub
Advanced,
Securities
really
easily
automated
all.
B
So
yeah
we've
done
that
through
constant
collaboration
and
feedback
from
engineering
teams.
We
also
have
security,
Champions
group,
but
yeah
a
big
part.
There
is
the
constant
collaboration
without
communicating
with
engineers
and
working
together
with
them.
We
wouldn't
be
able
to
overcome
these
challenges.
A
That's
amazing,
Andre
I
mean
you
know
when
we
started,
you
know:
selling
GitHub,
Advanced
security
or
building
out
this
capability.
One
of
the
common
themes
that
we
used
to
hear
from
a
lot
of
customers
is
this
concept
of,
like
the
the
dev
SEC
divide,
where
you
had
development
teams
and
security
teams,
and
there
was
constant
friction
and
I
think
the
the
key
theme
that
I'm
picking
up
between
you
know
the
conversation
that
Pascal
and
I
had
and
what
you're
sharing
here
is.
A
You
know
developers
need
to
be
a
part
of
this
journey
of
securing
the
software.
It's
not
a
sort
of
like
here's.
A
set
of
tools
like
go.
Do
it's
like
hey,
we
think
you're,
improving
this
environment.
We
want
you
to
be
a
part
of
this
process
and
I
think
that's
really
inspirational
to
hear
that
you
know
that
mindset
and
then
the
subsequent
results
of
of
taking
that
mindset.
You
know
so
so.
Thank
you
for
that.
A
So
Rob.
Now
you
have
a
very
different
perspective
because
you're
kind
of
from
the
outside,
looking
in,
but
then
also
being
like
the
Whisperer.
If
we
would
say
like
the
security,
whisper,
Within,
These
organization,
so
from
your
perspective,
I'd
love
to
kind
of
understand.
You
know
the
top
challenges
that
you
see
across
your
customers
and
then
how
you're
helping
them
kind
of
work
through
that
as
they
try
and
secure
their
software.
D
Now
now,
for
me,
it
always
starts
with
awareness,
both
the
management
side
and
from
engineers,
and
how
can
you
reach
that
Gap
in
between
I've
seen
companies
that
say
we
now
need
to
be
more
secure?
Well,
that's
nice!
It's
not
something
you
do
with
the
Press
of
a
button,
so
you
really
need
to
invest
something
there
and
even
worse
management
then
says
we
need
to
be
more
secure
and
the
developers
have
no
idea
how
to
do
this
so
bridging
that
Gap.
D
So
that
starts
for
me
with
awareness,
but
that
it
usually
comes
back
to
that
mindset
of.
We
still
need
to
teach
people.
We
are
building
applications
and
it's
very
easily
to
make
them
vulnerable
to
certain
things
and
I
always
say
we
still
need
to
educate
people
on
the
oauth's
top
10.
For
us,
it's
a
given
thing.
D
We
know
about
it
for
years,
but
I
still
encounter
companies
where
Engineers
have
no
clue
how
it
works,
because
it
often
is
not
a
part
of
the
education
curriculum
that
they
had
to
become
an
engineer
so
bridging
that
Gap.
It
starts
with
that
awareness,
then,
and
as
soon
as
they
are
aware,
you
can
talk
about
mindset
and
how
can
we
get
there
and
then
bridging
that
Gap?
Somehow,
between
management
and
the
execution,
which
is
at
the
engineer
side,
how
can
we
become
more
secure?
What
does
it
mean
to
become
more
secure?
D
Does
that
mean
we're
more
in
control
right?
Usually
you
see
that
that
customers,
that
especially
in
well-regulated
Industries
and
they
have
all
these
Auditors
coming
by
and
what
you
then
see,
is
and
something
we're
very
good
at
as
humans
is
the
order
comes
by
so
we're
getting
more
and
more
and
more
secure
and
the
audit
will
leave
we're
getting
more
less
and
less
secure
and
that
cycle
to
continue
either
over
years,
so
trying
to
break
that
with
mindset
of
we
need
to
ingrain
this
in
everything
we
do.
D
One
of
the
most
effective
things
that
I've
seen
companies
do
is
really
say
10
of
our
time.
We
really
want
to
invest
in
technical
debt
and
that
10
is
really
very
a
high
standard
that
they
try
to
make
sure
first
before
they
focus
on
features
alone.
So
you
really
need
to
carve
out
that
that
part
of
the
time
that
the
engineers
have
to
really
spend
on
security
topics
as
well.
A
No,
it's
excellent
and
I
mean
for
the
people
who
are
listening
at
home,
Rob,
where
you
know
we
had
log4j
like
today.
If
you
look
at
it,
they
say
like
80
of
web
application.
Data
breaches
are
caused
by
credential
leakages
right.
So
it's
a
very
simple
concept:
there's
a
plain
text
password,
that's
publicly
facing
or
like
exposed,
and
so
we
see
like
really
strong
boardroom
visibility
in
a
topic
like
that,
you
know
when
you
have
that
kind
of
top-down
motion
happening
in
a
business.
A
D
D
D
Then
you
show
secret
scanning
and
how
that
works.
And
then
you
start
talking
about
push
protection,
but
it's
weird.
This
stuff
is
now
so
good
that
with
the
technology
that
we
have,
that
I'm
regularly
just
pasting
my
personal
access
token
into
issues
now
these
days
just
to
demo
people
of
how
easy
this
is
and
how
easily
it
works,
especially
me
for
coming
from
a
community
side.
This
stuff
is
enabled
by
default
for
public
repositories,
so
especially
in
the
open
source
community.
D
It's
a
no-brainer
to
have
these
things
enabled
as
well.
So
that's
usually
the
flow
that
we
have
there,
especially
for
companies.
Have
that
conversation.
Have
those
workshops
enable
explain
to
people?
This
is
why
we're
doing
this
as
well,
and
we
really
we
really
want
to
prevent
ourselves
and
our
companies
from
becoming
in
the
news,
because
we
have
lead
RS3,
bucket,
API
key,
for
example.
We
all
know
that
is
the
dumbest
thing
to
do,
but
it
is
super
easy
to
get
to
that
point.
A
Excellent,
thank
you.
Thank
you.
Rob
so
I
mean
I
I
love
how
you
touch
on
that
partnership
and
kind
of
like
working
through
and
and
educating
the
developers
and
helping
them
understand
the
value
of
of
what's
coming
in
Andra,
there
was
actually
a
question
from
the
panel
which
was
around
you
know.
What's
your
recommendation
to
model
security
Champions,
and
it
would
be
interesting
to
understand
that,
from
a
perspective
of
like
centralized
teams
and
distributed
teams
and
and
maybe
Pascal
you
can
follow
after
Andra,
because
I
know,
you
also
have
a
similar
concept.
B
Sure,
thank
you.
That's
actually
a
really
good
question
and
something
I've
been
trying
to
improve
over
the
last
three
years,
or
so
you
know
creating
security,
Champions
programs
in
various
roles,
I
think
a
distributed
team
of
Champions
seems
to
to
work
the
best,
so
we
have
about
40
of
them
in
checkout.
Right
now
and
in
a
in
a
setting
like
this,
you
always
have
people
that
are
really
passionate
about
security
and
want
to
be
there
and
come
up
with
ideas
and
initiatives
on
their
own
of
what
to
improve.
B
They
come
up
with
things
that
are
going
wrong
in
their
code
and
they
you
know
they
ask
for
advice
on
how
to
fix
them,
how
to
roll
out
various
tools.
But
you
also
have
the
people
who
have
kind
of
been
volunteles
to
be
there,
which
creates
a
very
interesting
Dynamic,
so
a
distributed
team,
and
maybe
something
like
security
Champions
maturity
model
would
help.
B
B
A
D
D
Can
we
bring
in
one
of
those
Champions
to
help
you
with
these
temporarily
add
them
to
the
team
for
a
month
a
day
in
a
week,
for
example,
just
to
give
that
more
momentum,
and
that
can
really
help
as
well,
because
recently
I
enabled
a
dependablet
on
1100
repositories,
and
then
you
see,
for
example,
people
not
acting
on
it
for
a
month,
so
you
need
to
have
a
conversation
again
of
what
is
holding
you
back.
Did
we
not
introduce
things
right
enough?
Do
we
lack
time?
D
A
Pascal
I
want
to
add
a
flavor
to
this
question,
because
there
was
something
interesting
that
came
in
just
after
this,
so
you,
the
security
Champions
is,
is
important,
but
the
other
part
was
and
I
think
this
and
I
think
you
can
tie
this
together.
Based
on
the
pride
chats
that
we
had.
Is
you
know
someone
in
the
chat
kind
of
said?
Like
hey,
you
know
you
I,
have
all
these
development
Tools
in
my
ecosystem,
I'm
trying
to
transform
that
ecosystem,
and
so
the
question
is
like
you
know,
so.
A
Changing
development
mindset
to
think
from
a
perspective
of
security
from
from
the
design
point
of
view
can
be
a
big
challenge.
What
are
the
practices
that
you
suggest
creating
this
culture
change
starting
from
design
and
not
just
relying
on
automated
processes,
and
this
really
resonates
with
the
conversation
that
we
had
a
few
days
ago,
so
I
wanted
you
to
maybe
bring
those
two
together
as
part
of
our
conversation
here.
A
C
C
What
we
have
learned
with
this
centralized
approach
is
from
a
friend,
I
know,
there's
African,
saying
if
you
want
to
go
fast,
go
alone.
If
you
want
to
go
far,
go
together
so
and
for
what
we
see
there
is
we
have
this
centralized
expert
approach
with
this
platform
team,
where
we
say
like
things
for
for
co-pilot
or
for
code
spaces,
new
things
that
that
you
announce
it
later
and
and
X
the
same
thing?
We
we
have
playgrounds
there
and
right
and
people
really
work
on
this
stuff
and
then
on
the
next
thing.
C
Okay,
we
have
room
to
try
this
as
a
first
development
team
that,
let's
start
this
together
and
then
they
do
it.
And
if
you
see
that
it
works
especially
code
spaces
is
a
very
good
example
where
you
see:
okay,
look.
There
are
a
lot
of
efficiency
in
this,
but
on
the
other
side,
developers
are
a
bit
that
then
I
can't
work
in
this
code,
and
that
is
what
I've
done
for
all
my
life
or
for
a
big
part
of
this,
and
then
you
can
really
see.
Okay,
let's
try
this
out
with
one
team.
C
Then
this
team
come
back
and
the
league
developers
come
back
and
talk
about
their
experiences
and
then
you
can
spread
it
and
I
think
it's
also
another
approach.
If
other
lead
developers
hear
it
from
the
appeal
lead
developers
that
it's
working
instead
of
the
centralized
organization
that
then
say:
okay,
we
have
to
do
it
so
I
think
it's
also
about
processes
and
and
a
very
effective
approach
to
it
that,
on
the
one
side
stresses
that
you
really
do
it
and,
on
the
other
side,
give
the
freedom
to
really
work
together.
On
this.
A
B
Trip
so
we
are
so
I
think
the
correct
phrases
are
tier
one
PCI
service
provider.
So,
as
the
name
suggests,
the
main
regulatory
body
that
we
have
to
respond
to
is
the
PCI
and
PCI
people.
So
that
standard
is
a
really
important
one
to
us.
We
have
many
others
as
well,
and
we
also
have
a
few
very
specific
requirements
internally.
So
we
try
to
keep
the
code
we
produce
really
really
secure
in
terms
of
how
GitHub
helps,
at
least
from
my
perspective,
from
application
security.
A
Well,
that's
excellent,
so
I
mean
having
that
visibility
and
and
being
there
is
every
step
of
the
developer.
Workflow
is,
is
really
you
know
really
great
to
hear.
You
mentioned
a
few
things,
but
I'm
curious.
You
hadn't
mentioned
software
bill
of
materials.
Is
that
something
that's
important
at
checkout
today
or
from
from
like
the
regulatory
standards
that
you
have
to
adhere
to.
B
I
think
it
is
yeah,
that's
something
I'm
currently
working
on
so
trying
to
introduce
the
panda
Bots
such
that
it's
not
a
very
scary
thing
to
look
at.
It's
obviously
going
to
be
very
noisy,
so
just
as
Rob
said,
it's
a
journey
to
make
these
things
clear
and
to
create
the
awareness
around
dependencies
and
what
response
are
and
how
to
tackle
security
issues.
There.
D
I'm,
not
necessarily
in
a
regulatory
industry
but
I
do
help
customers
with
that
and
for
me,
usually,
the
focus
starts
with
it's
nice
that
we
have
those
audits
as
well,
but
we
need
to
mainly
show
to
those
Auditors
that
were
in
control
of
things
so
bringing
it
back
to
dashboards
of.
Where
are
we
right
now
in
our
process?
Where
are
our
dark
spots?
D
Where
can
we
help
and
then
the
finding
back
the
teams
of
where
do
we
need
the
most
help
or
more
accessibility
just
to
show
that
you're
in
control
of
these
things
and,
as
we
said
a
couple
times
now,
it's
a
journey,
so
you
need
to
take
people
along
to
the
journey
of
saying
hey.
We
want
to
improve
we're
not
there.
Yet.
This
is
The
Stance
right
now,
and
these
are
our
most
critical
applications
that
we
have
running.
D
Something
like
that
so
usually
for
me:
I,
go
going
down
Route,
focusing
and
make
sure
that
we
are
in
control
and
helping
from
there
and
one
of
the
main
things
there,
usually
as
far
as
indeed
secret
scanning,
because
then
you
can
at
least
say
we're
in
control
of
that
part,
and
we've
tried
our
best
to
prevent
Secrets
being
laid
down
into
the
public,
because
that
is
used
in
what
you
see
in
the
news
as
well.
That's
where
the
main
attack
Factor
starts
because
it's
too
easy.
A
In
the
conversations
that
you
have
with
customers,
is
there
like,
if
we
were
to
say
like?
Are
they
like
two
or
three
elements
that
A
playbook
for
getting
you
know
security
baked
into
the
development
process?
Is
that
like
something
that
you
could
share
with
the
audience
like
if
they
would
like
try
and
think
about
this.
D
Yeah
I
think
I
can
it
starts
with
awareness
so
having
those
sessions
internally
share.
What
is
the
problem
even
that
we're
trying
to
fix,
because
sometimes
you
don't
even
have
that
I've
seen
plenty
of
teams
even
struggling
of
keeping
their
dependencies
up
to
date,
usually
you're
relied
on
a
senior
every
once
in
a
while
things.
Maybe
we
should
upgrade,
but
that
can
then
be
painful.
D
If
you
don't
do
it
often
enough,
it's
all
Devil's
Mantra
again,
if
it
hurts
to
do
it
more
often,
and
we
need
to
to
guide
those
teams
in
there
as
well
saying
this
is
something
we
need
to
do.
We've
all
read
the
news:
we've
talked
about
log4j
we've
seen
solar
energy.
We
want
to
prevent
our
company
from
becoming
the
next
headline
in
there,
and
that
is
where
we
have
these
tools.
D
So
that
is
the
awareness
part
then
having
the
workshops
of
actually
enabling
that,
on
their
repositories,
to
see
what
the
impact
actually
is
depending
on
what
you
have
in
there,
it
can
be
almost
no
impact
to
a
lot
of
impact
and
discuss
with
them
best
practices
of.
How
can
you
make
sure
that
it's
not
too
noisy
that
you
can
have
a
gradual
rollout
to
the
team
and
at
least
make
the
decision
of
rolling
it
out
something
of
a
team
decision
and
then
you'll
see
there
are
more?
D
Mature
teams
are
already
there
and
they
can
enable
just
everything
in
a
week,
but
more
some
other
teams
just
need
to
do
this
more
granularly
and
do
that,
together
with
those
Champions
I
would
say,
those
will
probably
be
your
biggest
proponents
that
can
help
you
get
the
message
over
across,
because
that
is
indeed
their
repairs.
I
can
usually
say
that
as
a
consultant,
because
I'm
coming
from
external
and
then
sometimes
you
get
that
pushback
of
saying
yeah,
yeah
sure
you're,
the
consultant,
we
hired
you
for
this,
but
I'm
dealing
it
differently.
D
If
you
can
bring
that
to
peers
and
usually
the
the
people
with
the
biggest
mouth
saying,
this
will
not
work
it's
way
too
noisy.
You
can
really
turn
them
around
and
saying
you
are
not
a
Champions
and
bring
it
over
to
your
side
that
usually
really
works,
because
they
have
the
knowledge
to
say
the
reason
why
things
aren't
working.
D
So
those
are
usually
the
steps
of
awareness
bringing
that
to
the
teams
and
trying
to
get
your
biggest
opponents
on
board
and
make
them
your
champions
and
then
start
tracking
the
journey
see
where
you
are,
because
it's
nice
to
say
we
need
to
bring
more
secure,
but
it
also
comes
with.
What
does
that
mean?
How
can
we
measure
that
and
go
from
there.
A
Yeah,
that's
great
I
mean
I,
you
know,
as
we
think
about
like
when
I
was
a
developer,
you
know,
and
we,
when
we
tried
to
bring
about
change,
change
is
good
and
change
is
an
opportunity
for
leadership.
So
if
you're
a
developer
and
you're
trying
to
bring
change
but
improve
how
your
company
builds
software
being
a
leader
and
and
bringing
this
back
to
the
teams,
I
think
is
a
great
opportunity
to
develop
yourself.
So
I
think
that's.
A
You
know
an
interesting
tidbit
that
I
picked
out
from
what
you
were
saying
there
among
those
three
steps
and
Pascal
how
about
for
yourself
because
I
know
like
Regulatory
Compliance,
isn't
a
key
part
of
the
business,
but
it
is
like
you
know
more
broadly.
So
if
you
could
talk
to
us
about
about
that,
yeah.
C
Correct
the
the
product
sold
by
our
financial
advisors
are
predominantly
from
Partners
in
the
financial
sector,
namely
insurances
or
Banks,
and
regulations
from
these
industries
generally
affect
us
only
indirectly
or
relate
to
the
more
content
related
and
functional
advice.
The
respect
like
for
some,
for
example,
in
the
form
of
prescribed,
broader
steps
or
ensuring
that
certain
packages
sheets
are
read
or
signatures
are
obtained
and
stuff
like
this
and
for
the
core
business
of
our
company
as
a
pure
sales
company.
C
There
are
only
a
few
regulatory
requirements
that
relate
directly
and
explicitly
to
us
and
play
a
role
force
in
technology,
not
understanding
this
background.
The
issue
of
data
privacy
and
general
I.T
security
is,
of
course,
an
immensely
important
topic
for
our
around
8
million
private
customers
and
as
a
service
provider
for
our
financial
advisors.
We
are
more
or
less
the
guardian
of
the
confidentiality
of
the
personal
data
entrusted
to
them
and
by
them
to
us.
C
So
it's
up
to
us
to
always
incorporate
the
best
solutions
to
keep
the
interested
data
safe
and
keep
Auditors
happy
so
where
GitHub
features
help
us.
There
is
regarding
like
a
full
traceability
of
code
adjustments
with
appropriate
documentation
and
as
well
as
ensuring
for
ice
principles
for
for
such
changes
that
are
more
on
the
general,
very
low
part
and,
in
the
same
context,
we're
big
fans
of
secret
scanning
and
push
protection
which
help
our
team
avoid
accidentally
leaking
credentials.
What
has
already
been,
except
so
yeah
but
same
thing,.
A
A
C
C
Things
like
have
testing
things,
a
test
case,
usage
and
stuff
like
unit
test
stuff
and
and
really
see
that
we
get
an
overarching
objective
on
these
things
and
then
a
line
and
and
talk
about
how
each
team
comes
to
play
in
in
this
thing,
and
then
we
measure
this
on
a
on
a
quarterly
basis.
But
in
the
end
we
come
together
on
a
happier
basis
and
and
see
where
we
are
but
I
think
it's
also
on
this
yeah
I
would
say
full
motivation
that
that
we
more
or
less
talk
about
look.
C
C
So
you
can
really
see
in
the
end
of
the
year
that
every
team,
as
as
part
of
this
whole
Resort,
really
pushed
the
level,
and
you
have
then
like
20,
optimization
and
stuff
like
this
and
other.
Otherwise,
at
least
from
my
perspective,
you
wouldn't
have
identified
this
really
approach
that
is
significantly,
but
for
each
team,
perhaps
not
in
the
way
that
it
can
be
really
experienced.
A
D
Yeah
sort
of
times
back
to
what
Pascal
said:
number
one
share
the
data
with
them,
because
they're
part
of
the
solution
don't
see
them
as
problem
they're
part
of
the
solution
of
getting
to
a
better
state,
just
be
open
and
honest
about
it,
but
usually
focus
on
the
team
itself
and
not
necessarily
compare
it
into
other
teams.
For
example.
This
is
where
you
are
right
now.
I
think
you
want
to
improve.
Probably
you
agree
and
then
go
from
there
and
make
the
ones
who
are
making
the
biggest
strides
there.
D
Part
of
the
knowledge
sharing
internally
make
them
part
of
those
championships
as
well,
and
we're
usually
try
to
do
it.
Companies
is
make
sure
that
you
have
regular
knowledge
sharing
sessions
and
bring
those
folks
into
that
as
well.
Saying
hey,
you
have
gotten
this
work.
Can
you
share
where
you
started?
Can
you
say
how
we
are
right
now?
What
were
your
biggest
takeaways?
D
How
did
you
improve
on
this
setup
because
then
they
can
get
that
ball
rolling
internally,
so
it's
a
snowflake
and
it
goes
out
then,
and
becomes
bigger
and
bigger,
make
them
part
of
it,
and
you
can
see
that
in
the
chat
even
people
are
really
already
looking
for.
I
won't
have
a
bad
saying,
I'm
doing
some
best
practices
for
following
security,
for
example,
I
already
answered
somebody
to
have
a
look,
for
example,
at
the
open
source
security
foundation
and
the
work
that
they
are
doing
for
open
source
there.
D
They
have
a
badge,
for
example,
that
says
I,
do
have
aesthetic
application
security
scan
tool
installed.
In
my
repository,
we
do
things
with
pull
requests,
for
example,
have
a
internal
set
of
standards
of
saying
this
is
the
way
we
want
to
work
and
start
measuring
your
teams
and
your
repositories
against
that
as
well,
and
that
way
you
can
give
them
a
big
carrot,
which
is
the
badge
that
it
came
right
that
they
can
wear
with
prior
with
pride.
Indeed,.
A
Yeah,
that's
excellent.
Rob
I
mean
there
are
even
some
areas
that
we're
looking
at
here
at
GitHub,
around
even
actions
workflows
and
like
trying
to
provide
some
guidance
on
you
know.
Do
these
actions
workflows
that
are
in
the
community,
have
like
a
secret
scanning
tool,
a
software
composition,
analysis
tool
or
a
SAS
tool
enabled,
and
that
helps
organizations
like
yourself,
reuse,
these
workflows
inside
your
organization,
with
more
confidence
and
maybe
Andre
just
to
close
us
out
on
this
topic.
Your
thoughts
here
on
on
how
to
motivate.
A
That's
excellent
so
empowering
your
thought,
leaders
and
celebrating
thought
leadership.
That's
excellent!
Okay!
So
let's
go
to
the
next
topic,
because
I
know
we
are
starting
to
come
close
on
time
too
so,
and
I
think
this
one
is
probably
near
and
dear
to
a
lot
of
the
people
in
the
audiences.
Based
on
what
the
survey
said
so
developer
productivity
is
top
of
Mind
as
we
navigate
changing
macroeconomic
factors
and
organizations
are
attempting
to
maximize
the
value
they
bring
to
the
market
Rob.
Maybe
you
can
kind
of
lead
us
through
the
this
question
here.
D
Yeah,
it
goes
back
to
the
realization
realization
of
we
need
to
be
secure
and
compliant
all
the
time
and
I,
don't
not
only
when
the
auditor
will
be
coming
by
in
the
next
two
months,
so
it
needs
to
be
in
their
developer
flow
because
they're,
the
people
who
can
actually
fix
these
things
so
include
them
into
the
solution
there
as
well.
They
can
help
with
these
these
things
and
approve
them,
and
you
do
that
by
focusing
relentlessly
on
the
developer
experience
how
you
work
as
a
team.
D
Can
you
work
asynchronously
in
a
good
way?
What
is
the
moment
in
time
that
we
can
run
the
most
time
expensive,
Security
checks,
for
example?
Do
we
really
need
to
run
everything
we
have
on
push
and
prevent
you
of
doing
something?
Or
can
we
wait
until
you're
ready
and
you
say,
I
want
to
grab
something
to
drink
in
between?
We
know
that
people
are
working
more
and
more
from
home,
so
they
really
want
to
focus
on
getting
things
done
as
well
and
figuring
out
what
works
best
in
their
flow.
So
for
me
the
pull
request.
D
Experience
is
really
one
of
the
biggest
ones,
because
that
is
the
moment
in
time
where
you
say,
I'm,
sort
of
done,
I
want
to
have
a
review
from
somebody
else,
just
to
make
sure
that
I'm
not
doing
weird
things
in
here,
and
that
is
the
place
where
you
have
plenty
of
time.
So
focusing
really
on
the
developer.
Experience
of
where
can
we
inject
these
small
things
that
we
can
add
to
them
and
what
will
be
the
result
of
that
similar
to
what
we
said
before?
D
So
if
you
turn
it
around
and
gradually
go
in
that
direction
and
say
yes
in
six
months,
we
will
enable
push
protection
on
everything,
but
we
are
going
to
start
first
with
having
the
conversation,
making
sure
that
we
can
do
these
things
and
sort
of
also
did
a
shift
left
movement
that
we
have
on
the
devops
side.
Of
course,
how
early
can
we
do
certain
things,
but
you
cannot
shift
left
all
the
way
there
needs
to
be
a
common
place
where
you
say
this
is
where
it
makes
sense
to
do
certain
things.
A
Yeah
I
I
love
that
so
one
of
my
my
favorite
sayings
is
you
know
how
do
you
eat
eat
a
cake
and
it's
well
depending
on.
If
it's
one
of
my
children,
it
should
be
piece
by
piece
right
and
I
think
you
know
exactly
to
your
point.
It's
just
piece
by
piece
working
through
that
process
and
and
then
slowly
getting
in
there.
So
so
that
was
that
was
awesome
Andra.
How
about
yourself.
B
The
best
thing
that
I've
encountered
so
far
is
you
know
the
number
of
Integrations.
So
when
you
want
to
scan
when
you
want
to
have
all
those
results
in
one
place
that
security
tab
with
you
know
the
drop
down
of
all
the
tools
where
you
can
see
your
scan
results.
That's
amazing,
so
yeah
enabling
them
to
not
need
us
as
much
as
you
know
in
other
companies.
A
Yeah,
no
that's
great
I
mean
so
just
prioritizing
the
developer.
Experience
having
that
single
pane
of
glass
I
mean
there's
a
data
point
that
I
had
read
about
before,
where
it
says
like
every
time
you
pull
a
developer
out
of
the
productive
workflow
and
send
them
somewhere
else
so
like
go
to
this
tool
or
that
tool
to
go
and
understand
what's
happening,
it
takes
them,
something
like
23
minutes
to
get
back
into
that
Peak
productive
mindset.
So
if
you
can
bring
information
where
they
are,
then
this
is
really
empowering
for
them.
A
Right
and-
and
we've
been
through
this
journey
already,
because
when
I
was
a
developer
20
years
ago,
it
was
like
failed,
builds
right
and
you
would
like
kick
off
the
build
and
then,
like
a
week
later,
someone
would
run
all
the
bills
and
go.
Oh,
the
Bill's
broken
right.
How
do
we
get
that
like
to
you
faster
as
part
of
your
workflow?
So
that's
how
CI
CD
started
and
then
it
was
testing
and
and
now
it's
security,
but
it's
keeping
it
all
in
the
same
pane
of
glass.
So
that's
that's
amazing
and.
D
Especially
with
the
way
that
we
work
right
now,
we
work
from
home,
usually
at
least
most
of
the
time.
I
do
this
from
a
home
these
days
and
I
want
to
be
in
control
of
my
own
calendar
there
of
when
am
I
doing
certain
things
productively
and
I
block
an
hour
off,
or
something
and
I
want
to
focus
on
something
there,
and
please
don't
interrupt
me
during
that
time,
because
I'm
really
deep
into
the
matter.
If
you
pull
me
out
of
it,
it
will
take
me
a
lot
of
time
to
get
back.
C
Yeah
I
I
know
these
things,
especially
also
when
I
started.
There
was
a
lot
of
workload
for
all
developers
and
the
teams
about
permissions
and
approval
from
from
teammates
and
stuff
like
this,
where
you
wanted
to
have
some
stuff,
and
that
was
also
so
tiring
and
and
as
Andres
have
so
for
us
in
general.
C
C
So,
but,
as
you
already
said,
the
context
starts
there,
where
individual
developers
are
often
so
packed
with
work
on
projects
that
is
often
challenging
or
even
impossible
to
take
into
account
all
the
aspects
required
to
develop
outstanding
software
regarding
various
Technologies
languages
Frameworks,
as
well
as
the
usual
mix
of
all
these
together
so
and
coming
from
there.
It's
all
about
simplifying
the
work
of
our
development
teams,
but
by
defragment
you,
you
said
it
before,
like
really
by
defragment
the
provided
tool
landscape
and
make
the
usage
as
intuitive
as
possible
and
Android.
C
You
also
also
mention
it.
We
also
started
as
Health
Service
portal
for
for
our
developers,
where,
in
the
in
the
beginning,
like
a
lot
of
the,
the
common
managers
were
totally
shocked
because
developers
could
ask
for
for
cloud
resources
without
any
approval
or
permission
and
stuff
like
this,
and
but
on
the
other
side.
C
In
order
to
really
relieve
the
developers
of
this
part
of
work
and
what
we
see
now
being
all
in
on
GitHub.
Maybe
it
makes
it
way
easier
for
all
developers
because
they
don't
need
to
switch
tools
as
rocks
there
and
and
can
instead
focus
on
really
delivering
value
and
they
have
one
platform
and
one
UI
where
they
can
find
almost
everything
like
the
source
code,
the
workflows,
the
issues
all
in
one
place
and
undistracted
by
routine
costs.
C
So
yeah
that's
really
cool
for
us
and
as
an
example
like
when
I
remind
myself
by
by
moving
completely
from
Jenkins
together,
we
reduced
our
application
life
cycle
management,
then
to
zero
and
we're
able,
as
I
already
managed
to
Union,
to
really
create
a
new
full-time
position,
focusing
on
driving
New
Opportunities
new
opportunities
with
github's
automation.
So
perhaps
two
features
that
our
teams
really
love
and
is
for
one
is
GitHub
actions.
C
So
we
give
up
actions
our
platform
team
built
and
automated
reusable
workflows
that
can
be
used
across
various
teams
and
reusable
Workforce,
give
them
a
standard
way
of
working
that
they
can
easily
manage
like
by
pushing
their
artifacts
repository
and
donuts.
It's
all
in
one
place,
and
now
the
platform
team
can
focus
entirely
on
the
overall
deployment
and
testing
workflows
without
having
to
deal
with
the
implementation
details
of
the
various
programming
languages
and
kubernetes
apis.
So
this
also
creates
other
development
teams
from
needing
to
build
their
own
workflows,
individual
individually
and
saving
better
develops.
C
First
time,
like
speaking
in
numbers,
what
I've
prepared
is
in
in
total.
This
reduce
the
setup
process
for
workflows
from
four
hours
to
five
minutes
or
roughly
by
98.
So
overall,
we
estimate
this
has
saved
us
around
225
days
in
wait
time
since
implementing
these
reusable
workflows
that
that's
really
a
cool
thing
for
us.
That's.
A
Amazing
I
just
want
to
highlight
that
point:
reusable
workflows
has
helped
your
business
cut
down,
something
that
was
taking
four
hours
down
to
five
minutes,
a
98
Improvement
in
productivity,
which
in
in
a
time
like
this,
where
we're
trying
to
get
more
out
of
like
you,
know
everyone
and
help
people
be
more
productive.
That's
that's
an
amazing
statistic.
So
congratulations
on
that,
and
and
thank
you
for
sharing
everything.
D
Else
goes
back
to
focusing
on
the
developer
workflow
because
they
want
to
have
fast
feedback.
That's
what
we
learned
in
the
whole
devops
movement
over
the
years.
Fast
feedback
is
the
part
where
it
matters
and
everywhere
you
can
make
it
faster
that
can
really
help.
So
that
is
one
of
the
the
big
wins
there
as
well.
D
One
thing
that
also
came
to
mind
in
our
time,
but
I
still
wanted
to
add
that
point
is
that
I
really
appreciate
the
way
that
GitHub
looks
at
these
things,
because
they
are
usually
Engineers
themselves
as
well,
where
you
start
building
these
things
and
they
focus
a
lot
on
noise
reduction
in
there
we've
seen
so
many
times
that
somebody
comes
in
with
a
security
tool.
Let's
enable
that,
and
now
you
have
700
findings
to
handle,
that's
not
to
get
corporate
buy-in
from
anyone.
A
A
What
you
thought
of
the
session
in
case
you
have
to
drop
off,
but
what
I'd
like
to
do
is
just
come
back
to
our
panel
now
and
if
there
was
one
thing
that
you
could
have
the
audience
walk
away
from
today
from
the
session
and
they
could
bring
to
their
business.
What
would
that
be,
and
maybe
Andre,
if
you
can
kick
us
off
on
this
on
this
closing,
please
sure.
B
Thank
you,
so
my
one
key
takeaway
is
that
you
know
with
github's
help
we
can
see
how
easily
we
can
integrate
security
tooling
right
now,
so
it's
increasingly
easy
to
integrate
everything,
but
the
constant
communication
and
feedback
from
engineering
teams
is
the
crucial
bit
that
is
needed
to
create
a
security
mindset
in
the
business.
So
we're
not
here
as
a
security
team
to
say
no
we're
here
to
work
with
all
of
our
engineers.
D
From
each
that
focus
on
realizing
security
cannot
be
an
afterthought
anymore.
You
cannot
centralize
that
somewhere
and
say
you
need
to
make
sure
that
we're
as
a
company
are
more
secure,
bring
that
back
to
developers.
They
are
the
people
who
can
actually
fix
these
things
and
even
find
them
sometimes
because
we
are
doing
complicated
things
most
of
the
time
as
well,
and
so
that
is
why
I
really
like
to
focus
on
the
developer.
D
C
Yeah
but
two
links
so,
on
the
one
hand,
the
consistent
implementation
of
of
this
Central
service
approach
to
relieve
the
development
teams
of
tasks
like
General
Security
tasks,
as
I
mentioned,
with
the
reusable
workflows
and
on
the
other
side.
What
what
I
always
see
is,
in
numerous
cases
that
to
value
a
good
organizational
design
and
the
decisive
buy-in
from
Top
management
in
my
is
crucial
to
the
comprehensive
success
of
such
optimization
measures
and
in
order
also
to
assert
the
project
or
the
Endeavor
against
resistance
from
all
parts
of
the
company.
C
A
A
I
picked
up
some
great
phrases
that
I'm
going
to
use
in
my
presentations
later
as
well,
and
I
also
love
how
you
prioritize
bringing
security
and
development
teams
together
and
just
you
know,
taking
this
incremental
step,
so
I
really
really
appreciative
of
of
the
time
and
knowledge
sharing
that
you've
done
big.
Thank
you
to
our
audience
out
there.
Thank
you
for
participating.
I
know,
we've
run
a
little
bit
over,
so
if
you're
still
there.
A
It's
great
and
again,
if
you
have
any
feedback
to
share
we'd
love
to
hear
it
we're
here
for
you,
these
sessions
are
meant
to
help.
You
know
help
you
all
bring
leadership
and
thoughts
to
your
businesses.
So
thank
you
all
very
much
again.
It's
been
my
pleasure
to
host
this
session
and
and
thank
you
once
again
to
our
panelists
have
a
wonderful
day.