►
From YouTube: Shipping secure software within the dev flow with Holcim, Celsius, and Solidify | GitHub InFocus
Description
What happens when you prioritize security as much as speed? Join our panel of industry experts to hear about how they use GitHub Advanced Security to help their developers build securely from their first line of code.
Kicking off our discussion will be our host Niroshan Rajadurai, Sr. Director Global Security Sales at GitHub, joined by Daniel Fernandez, IT Security Officer at Holcim, Shiran Kleiderman, CISO, at Celsius, and Sanjin Medic, Head Of Development at Solidify. Attendees will get the chance to share not only some of the challenges they’re facing today, but also some of their innovative solutions.
As always, feel free to leave us a comment below and don't forget to subscribe: http://bit.ly/subgithub
Thanks!
Connect with us.
Facebook: http://fb.com/github
Twitter: http://twitter.com/github
LinkedIn: http://linkedin.com/company/github
About GitHub
GitHub is the best place to share code with friends, co-workers, classmates, and complete strangers. Millions of people use GitHub to build amazing things together. For more info, go to http://github.com
A
I'll
be
your
host
today,
my
name
is
niroshan,
raja
duray,
and
I
lead
the
business
side
of
our
security
technology
here
at
github,
I've
been
at
github
for
3.5
years
now
and
I
joined
as
part
of
the
acquisition
of
stemel,
which
was
the
company
that
developed
our
awesome
semantic
code
analysis
engine
codeql,
so
I'm
excited
to
be
helping.
Our
customers
put
the
sec
in
their
devsec
ops
programs,
a
few
housekeeping
topics
for
us
to
go
through.
If
you
have
any
questions,
please
put
them
into
the
chat.
A
We've
got
both
john
and
matthew,
diligently,
keeping
an
eye
on
your
questions
and
we'll
try
and
answer
them
directly
in
the
chat
and
for
some
of
the
more
broader
ones,
we'll
try
and
answer
them
at
the
end
of
this
session
today,
we'll
and
we'll
try
and
bring
them
in
we'll
be
running
a
few
polls
as
well.
We'd
really
like
to
learn
more
about
all
of
you.
A
You
drive
successful,
devsicops
programs,
so
with
that
I'd
like
to
start
by
introducing
our
guest
today
to
begin
with,
we
have
daniel
fernandez
from
wholesome,
where
daniel
is
the
I.t
security
officer.
Welcome
daniel
it's
a
pleasure
to
have
you
on
our
panel
today.
Would
you
like
to
introduce
yourself
and
your
company.
A
B
A
D
Thank
you.
Thank
you
for
having
me
sharon
based
in
tel
aviv,
israel
chief
security
officer
has
stated
celsius
is
a
crypto
platform,
a
financial
platform
for
lending,
an
urn
very
similar
to
banking
operations
in
the
in
the
regular
world.
Just
with
crypto
with
various
types
of
coins,
you
can
see
the
various
services
and
features
that
that
we
provide
here
through
a
mobile,
app
web
app
apis
and
such
it's
a
global
operation,
80
50,
850
people
plus,
and
it's
all
about
security
and
trust.
D
A
A
A
A
A
A
Thank
you
all
for
sharing
those
perspectives
of
where
you're
from
and
what
you're
doing.
So.
That's
that's
very
useful
for
as
we
talk
through
this.
So
the
next
thing
that
I
want
to
start
doing
now
is
start
actually
getting
into
the
question.
So,
let's
start
with
the
first
question
for
the
panel,
you
know
for
the
three
of
you
that
are
on
the
call.
What
was
the
reason
for
your
company's
devsecops
journey,
perhaps
daniel?
You
could
kick
us
off
here.
C
So
really,
this
started
very
very
slowly.
At
some
day
years
ago,
somebody
look
at
the
requirement
to
modernize
ourselves
and
our
applications.
As
we
are
a
industrial
company,
we
need
to
give
service
to
the
business
and
we
started
the
digital
transformation
process
by
embracing
the
agile
and
devsecops
methods
are
an
agility
thing
is
that
we
saw
mainly
that
we
needed
to
cut
big
applications
into
small
micro
services
to
enhance
the
service.
A
That's
amazing,
I
mean
that's,
that's
a
very
interesting
story.
You
know
for
a
customer,
that's
kind
of
gone
through
the
traditional
kind
of
maybe
bricks
and
mortar
to
you
know
to
more
software
to
more
agile
software
journey.
It's
I'm
sure
a
lot
of
the
people
on
the
the
call
can
relate.
Maybe
sanjay.
Would
you
like
to
go
next
then,
from
a
solidifying
perspective,
like
you
know
your
journey.
B
Sure
so
we've
been
in
devops
here
for
quite
a
long
time.
We
have
seen
a
huge
benefits
of
doing
that
early
on
and
with
these
devsecops
now
coming
on
or
like
starting
to
get
some
foothold
companies.
What
we're
seeing
is
actually
natural
next
step
in
maturity
of
software
development
practices
based
on
the
threat
landscape
we
have
today
and
needed
for
better
quality
and
faster
deliveries,
and
so
on.
D
Yeah,
so
we're
a
financial
institution.
At
the
end
of
the
day,
we
deal
with
user
data
user
funds
and
in
parallel
we're
in
the
growing
crypto
sector.
So
everything
is
about
user
adoption,
trust
protecting
data
in
funds
and
with
the
growth
of
crypto
and
specifically,
the
growth
of
celsius.
You
need
to
scale
all
the
operations
you
need
to
have
all
the
security
pillars
in
place.
Secure
development,
life
cycles,
secure
devops
and
all
the
topics
that
we're
going
to
talk
about.
D
A
Excellent,
so
so
that's
very
interesting,
so
you
know
really
interesting
set
of
backgrounds
that
you've
all
come
from.
We
hear,
like
you,
know
rapidly
growing
startups
to
microservices
to
transformation
of
you
know,
legacy
business
to
new
business.
It's
really
exciting
and
you
know
thinking
about
the
develop
as
well.
So
let's
go
to
our
next
question
then,
and
I'll
just
bring
this
up,
so
we
can
see
it.
A
So
the
next
one
is,
you
know,
as
we
think
about
this
whole
experience.
You
know,
part
of
the
journey
starts
to
introduce
changes
to
how
developers
are
working
today.
So
how
do
you
get
developers
engaged
with
devsec
ops
transformation?
I
have
sanjin,
maybe
you
can
lead
us
here
and
then
we
can
work
work
around.
B
Yeah,
thank
you.
So
what
I've
seen
is
actually
using
metrics
have
helped
me
a
lot
on
boarding
companies
and
and
teams
to
do
suck-ups
for
many
developers.
It's
important
it's
important
for
them
to
deliver
good
and
quality
software,
and
they
they
really
took
take
pride
of
that
and
simply
just
putting
code
in
focus
higher
in
enterprises
will
like
spark
in
in
many
and
will
be
able
to.
That
will
be
one
one
way
to
actually
get
developers
engaged.
B
A
D
Yeah,
so
so
with
us
from
the
beginning
and
during
the
operations
and
everything
everything
is
connected
to
leading
by
example,
meaning
showing
findings
working
with
the
developers
so
showing
findings
through
penetration
testing
code
scanning
with
github
solutions
and
features.
So,
first
of
all
showing
concrete
exploitable,
you
could
say
or
findings
by
severity.
D
So
once
you
take
your
practice
out
of
the
excel
and
you
show
it
live,
and
you
specific
vulnerabilities
in
the
code
or
in
the
mobile
app
or
in
the
apis,
and
such
people
relate
to
that-
and
that's
very
concrete,
so
leading
by
example,
showing
findings
and
in
parallel
working
with
the
developers
and
with
the
devops
personnel
and
such
in
their
environment.
Maybe
not
changing
their
workflows.
Yeah,
you
understand
their
habitat.
You
understand
how
they're
used
to
working
so
not
forcing
tools
that
change
their
their
flow
and
their
daily
routine.
D
That's
key
to
understand
their
habitat,
understand
their
environment
and
then
integrate
the
solutions
in
their
ecosystem
again
in
the
awsc
icd
pipeline
and
their
jira,
their
remediation,
cues
and
stuff,
like
that,
so
not
forcing
things
not
taking
not
taking
things
out
of
their
routine
again.
People
like
routine
people,
have
their
habits
and
that's
the
way
to
engage
them,
and
you
know
create
the
create
the
remediation
and
the
healthy
process
that
you
want.
A
That's
excellent,
I
mean
it's.
We
very
often
hear
of
like
the
silent
perspective
of
security
and
development
teams,
so
it's
so
fascinating
to
hear
as
a
security
organization
the
work
that
you're
putting
towards
coming
to
where
the
developer
is
and
collaborating
and
where
they
are.
I
think,
that's
you
know
very,
very
thought,
leading
and
very
encouraging
to
see.
So
thank
you
for
sharing
that
daniel.
How
about
yourself
from
wholesome's
perspective.
C
So
well
I
mean
fully
in
line
with
what
my
compilers
are
saying
and
after
all,
empathy
with
the
developer
is
one
of
the
first
step
to
getting
them
to
know
what
they
are
doing
wrong
or
what
they
need
to
change.
In
my
case,
I
have
a
background
in
computer
science
and
I
love
to
develop
in
my
own
past
when
I
was
studying
and
right
now.
C
I
understand
the
mind
of
a
developer,
but
also,
I
understand,
also
their
lacks,
and
I
and
I
fully
agree
with
going
the
journey
with
them
and
explaining
everything
to
them,
because
the
change
has
to
go
slowly
and
with
them
not
overwhelmed
with
a
lot
of
controls
and
requirements
and
left
them
the
documentation
to
read
on
okay.
Here
is
your
book
of
requirements.
C
You
concern
now
on
compliance.
No,
that's
not
the
best
approach.
You
need
to
motivate
them
with
boards
with
gamification
as
sanji
told
us
myself
after
we
have
this
discussion
these
days.
I
am
studying
now
gamification
how
to
enhance
this
even
better,
but
one
of
the
topics
I
also
do
with
github
security
advance,
for
example,
is
automating
and
preventing
things
from
the
start.
I'm
at
some
point
not
allowing
specific
type
of
errors
to
go
into
a
repository
or
whatever.
There
is
a
minimum
partial
control
that
you
need
to
set
up
where
okay.
C
B
C
That's
one
of
the
things
to
motivate
the
developers,
so
please
this
is
one
thing
that
is
sold
that
we
just
should
not
have
this,
and
this
is
due
to
the
chaos
that
developers
have
so
many
different
backgrounds
and
teams
that
that's
what
gene
has
told
us.
One
of
them
are
very
experts
that
know
everything
about
the
technology,
the
software,
all
the
stack
from
the
cpus
they're,
using
the
memory
how
the
threads
are
interacting
with
applications.
C
A
A
So
so
that's
that's
really
amazing
insights
there.
So
thank
you
for
that.
Let's
jump
to
the
next
question,
so
the
next
one
was
should
we
have
a
poll
before
we
go
to
the
next
question,
so
we're
really
keen
to
understand
from
the
audience
now.
How
do
you
all
feel
about
your
devsecops
transformation?
How
confident
do
you
feel
about
it?.
A
Can
we
get
it
up
on
the
screen
john
and
then
we
can
talk
about
what
he
is.
So
this
is
really
really
fascinating,
and
I
wasn't
expecting
to
see
this
in
this
session
today.
So
over
75
percent
of
the
people
on
the
session
today
feel,
like
their
current
programs,
are
kind
of.
You
know
mediocre
to
not
confident.
B
I
I
would
say
a
lot
of
companies
sit
with
a
lot
of
legacy
and
kind
of
that.
That
could
be
a
result
of
this
poll.
I
mean
you
have
old
code,
maybe
delivered
for
15
years
ago
or
10
years
ago,
and
so
on,
and
it's
really
hard
to
be
too
confident
about
that
code,
especially
when
you
don't
have
processes
in
place.
C
I
would
add
that
a
lot
of
things
are
on
the
pressure
that
developers
have
sometimes
with
just
make
something
that
works
and
when
it
works,
it's
already
done,
and
there
is
a
lot
of
pressure
on
them
on
the
timeline.
Usually,
there
is
not
much
time
for
developers
to
have
the
adequate
thoughtfulness
on
the
code.
That
is
one
of
the
pain
points
that
I
see
in
lots
of
places.
D
Yeah
I'd
add
that
when
you
define
dedicated
resources
and
teams
and
the
teams
don't
need
to
be
big
and
the
resources
you
know
could
be
single
or
amount
of
people,
even
one
or
two,
and
you
have
resources
from
the
governance
perspective.
But,
more
importantly,
from
the
implementation
perspective,
and
specifically,
we
have
an
application
security
team,
which
we
call
the
blue
team
yeah.
D
We
understand
everything,
has
resource
constraints
and
at
times
it's
hard
to
hire
talent,
but
having
a
good
structure
of
governance
and
then
implementation,
product
security
and,
like
I
said,
leading
by
example,
while
coding
that
can
give
confidence
and
also
the
developers
understand
that
the
organization
is
investing
in
this
transformation.
In
this
topic,.
A
I'd
actually
love
to
see
in
the
public
chat.
You
know
maybe
reasons
why
your
thoughts
why
people
feel,
like
you
know
their
confidence
level,
is
mediocre
or
not
confident
so
we'd
love
to
see
that
in
the
chat-
and
maybe
we
can
pick
out
some
things
to
talk
about
at
the
end
as
well.
So
so
thank
you
there,
okay!
So
now
we're
ready
for
our
next
question.
So
let's
bring
this
up
here,
so
you
can
all
see
it
so
thinking
broadly
about
devsecops
transformations,
could
you
all
share
with
us?
A
D
Yeah,
so,
at
the
end
of
the
day,
the
goal
is
to
ship
software
and
products
and
services
as
fast
as
possible,
and
specifically
in
a
sector
like
ours,
the
crypto
sector,
in
which
there
are
a
lot
of
companies
fighting
you
could
say
for
clients
and
wanting
to
to
run
forward.
So,
first
of
all,
you
need
to
integrate
security
in
a
way
that
there
are
no
delays
or
blockers,
as
you
say
in
the
term,
the
development
terms
and
such
so
that's
the.
D
C
D
That's
one
part
and
with
automation,
yeah
and
with
the
partnerships
and
and
us
accompanying
the
the
developers
yeah
at
the
end
of
the
day,
we
don't
introduce
any
blockers
or
delays
and
such
so
that's
that's
one
thing.
The
second
thing,
as
stated,
this
is
probably
one
of
the
most
important
things,
even
in.
D
Is
to
be
focused,
meaning
with
various
solutions,
cyber
security
solutions
again
from
dynamic
and
static
and
sim
related
products
and
api
security
and
endpoint
security.
At
the
end
of
the
day,
these
these
products
and
services
introduce
a
lot
of
alerts,
yeah
yeah,
with
a
garbage
truck
all
these
alerts,
nothing
will
come
out
of
it.
So
focus
is
key
in
refining
the
findings,
the
alerts
and
only
focusing
on
the
critical
high
medium
and
defining
logical
slas.
D
Not
just
dumping
every
alert
possible
every
finding
possible,
so
it's
pinpointing
the
ones
that
are
relevant
and
also
adding
the
relevant
context,
because
at
times,
security
solutions
can
pinpoint
something
as
critical
or
high.
But
in
reality,
there's
no
way
to
exploit
it
for
various
reasons,
because
you're
in
a
faraday
cage
or
you're,
not
in
a
physical
data
center
or
you're
you're
using
a
different
cloud
or
the
setting
the
user
setting
and
how
you
work
is
just
different
so
context
for
the
the
findings
for
the
alerts
and
the
handful
of
findings.
A
C
Well,
lots
of
interesting
point
by
by
children
on
my
side.
This
is
one
of
the
topics
I
have
is
a
contract
with
the
third
parties.
Usually
in
different
companies
depends,
but
if
you
have
inside
developers,
you
can
handle
them
fully
on
your
own,
but
if
you
have
third-party
developers,
which
is
a
common
use,
I
have,
for
example,
an
issue
here
in
spain.
C
So
after
all,
you
can
have
you
have
to
set
requirements,
give
them
some
requirement
sessions,
but
not
at
training
sessions
and
specifically
focus
on
the
contracts
that
you
may
want
to
implement
with
them.
So
at
least
they
are
aware
that
they
are
entitled
to
fix
critical
vulnerabilities
that
are
focused,
of
course,
not
just
random
vulnerabilities
everything
on
the
context,
but
they
need
to
be
aware
that
they
need
to
fix
the
code
they
are
developing
because,
after
all,
they
are
the
ones
building
the
house
and
in
the
house
locks
doors.
C
I
want
a
house
with
doors,
please
with
closer
doors
if
possible.
So
that's
one
of
the
pain
points
that
we
have
acting
with
third
parties,
that
they
somehow
at
the
past
could
have
a
strange
contract
that
is
not
fully
fully
customized
and
you
need
to
list
with
the
legal
team
to
fix
them
and
make
them
aware
of
okay.
These
are
your
requirements
as
a
company.
It
works
with
me
because
that's
one
of
their
pain
points.
B
What
I've
seen
is
on
a
team
level
just
starting
up.
It
could
be
hard
to
actually
find
correct
tools
set
up
processes
in
correct
manner,
but
you
can
always
take
help
with
that.
Another
part
when
you
have
processing
in
place,
and
you
start
kind
of
scanning
the
code.
What
I
usually
have
seen
is
the
exact
thing.
What
chiron
also
told
you
get
the
situation
when
you
get
this
huge
log
of
warnings
and
errors,
and
everything
and
one
of
the
the
problems
and
challenges
is
actually
for
new
team.
B
So
so
those
are
the
two
tasks
on
the
team
level
and
if
we
look
up
on
organizational
level
and
especially
in
bigger
organization,
then
you
have
this
part
of
transformation.
You
don't
want
to
be
in
a
situation
when
you
have
10
percent
of
your
teams
in
devsecops
and
maybe
90
or
60
of
the
teams
doing
legacy
stuff.
B
So
in
those
in
those
teams,
I
see
transformation,
another
problem
area
that
that
needs
some
focus
and
in
those
organizations
the
I.t
security
department,
needs
to
step
in
and
be
more
crisp,
the
more
they
need
to
be
more
kind
of
direct
and
not
be
so
come
down
a
bit
and
just
talk
about
a
bit
hands-on.
What
needs
to
be
done
and
on
light
weight
level
on
what
level.
So
those
are
some
some
points.
What
I've
seen
and
everything
this
is
adjusted
and
bridged
over,
and
I
think
the
results
speak
for
the
cells.
A
Excellent,
but
that's
very
interesting,
so
I
mean
obviously
as
you
as
you
talk
about
the
challenges
of
those
bigger
organizations
where
you
have
some
on
and
some
not
and
trying
to
make
it
easy
for
them
kind
of
ways
back
to
the
points
that
daniel
and
strong
were
making
about
focus-
and
you
know
just
that
area,
so
I
I
think
that's
really
interesting
to
bring
that
all
together
there.
Thank
you.
A
So,
let's
jump
to
our
next
question,
which
I
think
is
also
very
interesting,
which
is
you
know
it's
great-
that
we
talk
about
these
wonderful
concepts
and
things
that
we
want
to
do.
But
you
know
what
are
the
metrics?
You
should
be
using
to
measure
your
devsec
ops
deployment,
maybe
daniel.
You
can
kick
us
off
here
from
your
perspective
and
you
know
what
metrics
have
worked
for
for
holston.
C
Well,
basically,
as
we're
using
now
a
github
called
the
scanner
and
also
secretary
scanner,
one
of
the
key
metrics
I'm
looking
is
that
nobody
else
tries
to
put
up
any
secret
on
github
list
is
one
of
my
key
metrics,
but
on
top
of
that
there
is
quality
metrics
that
we
also
check
sometimes
depends
on
different
teams
and
the
maturity
of
the
team.
But
basically
how
much
time
do
you
spend
coding
in
a
secure
way
versus
not
calling
the
secure
way,
something
that
at
some
point
we
try
too
much
and
with
different
tips?
C
You
can
do
it,
but
basically,
as
a
core
concept
is
okay,
what
is
the
high
level
of
vulnerabilities
that
really
are
creating
an
exposure
that
could
later
in
a
penetration
test?
Be
the
exploit?
That's
one
of
the
key
metrics.
I
follow
to
go
with
the
team
and
explain
to
them.
Okay,
you
see
by
doing
this
before,
we
would
have
prevented
the
penetration
test
of
checking
this
and
all
the
time
spent
by
you
fixing
afterwards.
A
Yeah,
that's
an
interesting
point.
That's
actually
something
that
we
very
often
have
a
conversation
with
customers
about.
You
know
this
concept
of
pen,
testing
versus
code
scanning
and
the
concept
of
shifting
left
and
getting
that
information
earlier.
So
it's
really
exciting
that
you've
got
that
measurement
in
place
because
it
really
is
tangible.
I
think
the
data
point
is
like
it
costs
like
100
times
more
to
fix
an
issue
at
the
stage
when
you're
doing
pen
testing
than
when
it's
at
the
developer's
desk
at
the
time
that
they
write
it.
A
B
Yeah,
I
think
this
is
important
to
the
metrics
to
actually
look
at
the
metrics,
because
one
experience
that
we
have
is
you
have
good
engineering
teams.
They
are
usually
good
at
security
as
well,
so
they
know
the
tools,
they
know
the
practices,
they
know
everything
and
they
understand
it,
and
they
just
need
to
do
get
things
done,
and
by
measuring
kind
of
code
code
quality
like
security
code,
scans
and
and
secret
scanning.
B
B
How
are
you
looking
with
commits
how
working
with
commits
how
big
code
changes
are
doing?
Do
you
have
a
duality
principle
with
pull
requests?
Do
you
have
code
owners?
How
how
many
of
your
builds
are
automatically
deployed?
How
many
bills
are
actually
passing
through
a
lot
of
those
statistics?
When
you
start
over
overlapping
it,
you
will
get
some
better
picture
of
how
actually
team
performs
in
in
like
in
holistically.
B
So,
in
a
lot
of
the
cases
we
do
kind
of
tooling,
we
create
a
special
reports
based
on
kind
of
what
other
tools
the
company
is
using.
So
there
is
a
lot
for
github
a
slot
from
git,
but
maybe
you
want
to
look
at
tickets
as
well
and
or
some
other
tools,
depending
on
where
you're
deploying
if
you're
deploying
to
azure
or
some
other
cloud
vendor.
D
One
of
the
key
metrics
that
that's
interesting
for
us
is
time
to
remediation,
meaning
once
you
have
a
finding
and
it's
a
high
finding
or
medium
critical
or
whatever
the
severity.
How
long
until
that's
remediated
yeah,
how
long
till
it's
not
in
the
queue
anymore
yeah.
So
that's
that's
something
that's
interesting
and
important,
and
you
want
to
verify
that
time
to
remediation
the
sla,
then
the
numbers
and
and
the
flow
and
the
response
yeah
are
relevant.
D
D
That's
the
native
again
scenario
attribute
that
that
we're
talking
about
here
is
pushing
the
findings
to
the
developers,
environments,
the
jira
queue,
for
example,
or,
if
there's
a
finding
blocking
it
before
it's
pushed
to
the
repository
or
to
the
testing
staging
production
and
such
so
using
the
automation
there
and
staying
in
the
environment
focus
opening
the
relevant
tickets
in
jira.
Automated
and
not.
A
So
that's
really
interesting
that
you
spoke
about
the
mean
time
to
remediate,
because
this
is
actually
something
that
we
often
talk
to
customers
about
too,
and
if
you've
ever
read
the
vera
code
state
of
software
security
report.
It's
a
great
report,
lots
of
like
useful
statistics
to
benchmark
yourself
against
and
the
the
ones
that
I
really
like
in
there
is
they
talk
about
remediation
rates,
and
so
they
say
like
a
typical
security
vulnerability.
Today,
when
it's
identified,
only
15
of
those
vulnerabilities
are
remediated
after
seven
days.
A
They
then
go
on
to
say
that
you
know,
typically
after
90
days
after
three
months,
only
about
45
of
these
vulnerabilities
get
remediated.
And
then
you
have
like
the
whole
long
tail
problem
that
it
doesn't
really
get
much
get
much
better
than
that
and
fundamentally
you're
starting
to
accrue
security
debt.
So
it's
you
know,
as
you
think,
about
where
you
are
in
an
organization
like.
I
think
those
are
like
interesting
starting
points.
A
So
you
know,
and
then
it's
thinking
about
where
it
makes
sense
to
go
in,
and
you
know
we've
done
some
research
about.
You
know
getting
information
in
the
pull
request
and
how
does
you
know
how
does
that
work,
and
that
comes
back
to
your
point,
you're
on
about
focus
right
in
the
pull
request,
getting
specific
information
to
the
developer,
about
the
problems
they're
introducing
and
you
know
making
it
actionable
as
well
like.
A
A
A
A
A
B
Yeah,
so
what
I've
seen
is
like
in
this
devops
journey
a
shift
left
journey.
We
have
focused
on
building
on
deploying
maybe
running
some
unit
tests,
but
with
dev
supports
we're,
starting
with
scanning
code,
analysis,
analysis,
analyzing
code
and
trying
to
actually
figure
out
what
we
deliver.
Is
it
good
enough?
Can
we
make
it
better?
B
I
think
it's
much
better
than
just
kind
of
input
what
you're
putting
in
so
it's
a
one
plus
one
equals
three
situation
when
you
actually
got
a
lot
of
benefit
for
then
good
great
benefits
and
one
one
thing
that
I've
seen
everywhere
is
actually
time
to
market
gets
shorter
in
large
organization.
You
get
more
sense
of
security,
and-
and
this
will
enable
you
to
actually
deploy
faster
and
shorter
down
the
cycles,
smaller
teams,
they
can
deliver
every
second
weeks
in
by
big
organization.
B
D
The
whole
release
process
is
good
people.
People
are
satisfied
at
the
end
of
the
day,
that's
important,
and-
and
on
top
of
that-
and
I
see
this
all
the
time-
and
I
assume
everyone
sees
it
here
when
people
learn
about
cyber
security
and
new
types
of
technologies,
yeah
and
then
they
they're
expanding
their
toolbox.
So
today,
maybe
they're,
developing
node.js
or
something
and
maybe
they're
inspiring
to
be
cyber
security,
engineers
or
elite
security
in
the
organization,
so
giving
them
more
and
more
tools
and
expanding
their
tech
stack
and
security
knowledge.
D
C
So
wait:
one
of
the
successes
is
the
the
sadness
of
my
penetration
testers
directly.
They
are
sad
as
now
they
are
saying
no,
but
now
I'm
not
going
to
find
anything
here,
literally
what
they
are
telling
me
now,
I'm
going
to
have
to
work
on
another
topics.
Instead
of
these
things,
you
are
making
my
life
harder,
which
is
one
of
the
key
successes
of
devsecops.
C
I
mean
the
idea
is
that
the
red
team
has
to
focus
their
resources
on
time
on
other,
more
specifically
things,
and
we
have
set
the
time
to
market
really
from
the
past,
where
you
were
doing
only
a
penetration
test
at
the
end
of
the
development
phase,
and
then
you
have
to
fix
everything
and
everybody
is
stressed
about
the
go
life
because
we
have
a
goal
life
and
we
want
to
go
to
the
internet.
Suddenly
there
is
a
vulnerability
there,
which
is
very
basic.
That
would
have
been
five
minutes.
That's
really
not
happening
now.
C
At
least
most
of
them
are
getting
fixed
in
the
development
phase
at
the
shift
level
processes.
So,
yes,
that
is
one
of
the
key
successes
that
I
can
see
and
the
other
one
is
the
developers
are
getting
engaged.
There
is
a
like
gravity,
mass
of
awareness
of
security
that
we
are
saying
and
they
on
their
own,
are
asking
for
training.
They
are
engaged
and
they
are
getting
to
know
now.
What
a
vulnerability
is,
what
they
are
building
and
it's
really
key
that
they
their
their
blindfold
is
off.
A
That's
amazing,
so
this
probably
leads
me
to
a
couple
of
interesting
questions
which
actually
came
from
the
panel
or
from
the
or
from
the
audience
as
well.
One
is
like
you
know.
Recruitment
is
a
big
challenge
in
this
space.
You
know
the
question
here
is.
Like
you
know,
ian
has
said
you
know:
I've
interviewed
hundreds
of
developers
for
a
number
of
roles.
Most
don't
even
know
what
osp
is
that's
endemic
in
the
industry.
A
D
D
To
just
train
and
and
empower
them
and
and
teach
them
more
and
more
security,
so
we
do
a
lot
of
training,
secure
development,
life
cycle
presentations
and
videos
about
owasp,
and
we
produce
the
one
pagers
about
the
top
10
vulnerabilities
and
exploits
like
every
year
and
such
and
also
show
example.
Findings
like
I
said
so,
with
a
lot
of
with
a
lot
of
training,
yeah
people
that
have
drive
and
passion
and
are
good,
technically
they'll
they'll
adopt
security
yeah
because
they
understand
that
it's
just
inherent
in
various
technologies.
D
A
Excellent,
so
when
you
talk
about
training,
I
mean:
is
this
content
that
you're
building
yourself?
Are
you
using
a
tool
like
you
know?
If
I
was
in
an
organization,
I
have
this
challenge
like
how
do
I
need
to
go,
buy
something
today
or
there's
some
things
I
can
do
today
to
get
started
on
that
journey.
D
So
mix
we
use
an
external
vendor
for
training,
videos
and
various
quizzes,
and
in
parallel
we
write
one
pagers.
We
create
quizzes
even
on
slack,
for
example,
we'll
post,
we'll
post
a
poll
like
you
posted
here
throughout
the
day.
Here
are
a
few
questions
and
choose
the
correct
answer:
abcd
at
times
we
do
these
things,
so
people
are
engaged
in
even
at
the
level
if
it's
on
slack
or
through
email.
D
We
have
our
news
bot
security
news
spot
so,
whether
relevant
news
pieces
again,
it's
a
essentially
an
rss
feed,
but
a
curated
rss,
rss
feed
I'll
post
news
content
in
the
various
channels,
and
some
people,
of
course
you
know,
are
interested
in
it.
Some
are
less
so
it's
a
mix
of
using
vendors
for
videos
for
things
that
are
more
professional
visually
design,
wise
and
tracking
yeah.
D
You
want
to
track
who
completed
the
quizzes,
who
completed
the
videos
and
such
and
then
stuff
that
we
do
one
pagers
quizzes,
the
news
box
and
and
stuff
like
that
fishing
training.
Of
course,
fishing
simulation.
We
do
a
lot.
So
it's
a
mix
of
external
vendors
and
also
things
that
we
just
create
ourselves.
A
B
Yeah,
exactly
and-
and
this
makes
me
a
bit
sad
because
I'm
involved
with
almost
so
and
but
I've
seen
tendencies
in
this.
So
what
what
we're
seeing
right
now
is
that
there
is
a
great
date
for
developers
and
we
are
starting
to
get
developers
that
don't
does
does
not
have
a
kind
of
background
in
engineering
they,
as
daniel
mentioned
that
maybe
have
background
in
finance
or
some
other
area.
They
kind
of
start
programming
themselves.
B
So
in
that
case,
I
try
to
use
tooling
as
much
as
possible
and
try
to
have
dedicated
kind
of
teams
that
can
reach
out
and
help
out.
So
we
need
to
educate
as
much
as
possible
people
as
possible,
but
there
will
be
always
a
gap
and
we
need
to
bridge
that
with
tooling
and
maybe
expert
teams
that
can
come
in
and
help
out
when
when
needed.
B
C
So
thinking
on,
I
mean,
if
I'm
in
an
interview-
and
I
have
a
developer-
not
knowing
a
wasp.
The
key
thing
that
we
have
spoken
is
what
is
the
attitude?
In
my
case
I
mean
the
attitude
is
the
first
step
if
he
is
willing
to
learn
and
he
has
the
capability.
That's
the
key
point
to
see
when
you
are
getting
developers
into
the
organizations
and
as
training
is
part
of
we
are
speaking
of
one
of
the
critical
points
will
have
to
have
a
development
career
in
the
training
session.
So
you
have
okay.
C
This
is
the
mandatory
training
you're
going
to
have
on
these
development
codes
on
this
year.
Let's
say
each
month,
you
have
this
type
of
training.
With
this
with
the
capabilities
you
have,
I
mean,
if
you
have
a
finance
user
that
doesn't
know
and
cannot
get
into
the
depth.
Maybe
you
need
to
get
an
expert
in
security
development
for
that
team.
That's
one
of
the
approaches
also
having
a
security
champion
on
either
of
the
chief
of
the
development
team.
C
So
at
least
you
have
more
developers
that
are
focused
on
the
operations,
not
so
much
of
security
and
then
the
internal
expert
that
is
really
helping
them
or
doing
the
secure
code
after
they
developed.
You
are
kind
of
delegating
into
one
team
member.
Therefore,
but
at
least
you
have
the
security
champion.
That
is
also
raising
awareness
of
that
divide
and
conquer.
A
Excellent,
I
love
it
great.
That's
awesome.
Before
I
go
to
more
questions,
maybe
we
can
do
just
a
round
of
like
closing
thoughts
from
the
three
of
you
like
what
would
be
three
things
that
you
would
want
people
who
are
listening
to
this
presentation
today
to
take
away
from
this
session.
Maybe
sanjin.
If
you
kick
us
off,
yeah.
B
B
Another
thing
that
I
would
like
to
see
is
actually
caring
about
the
cold
and
and
on
higher
up
in
organizations,
because
this
is
the
actually
recipe
and
for
the
end
result.
What
you're,
having
like
features,
and
so
so
yeah
use
the
metrics
to
identify
teams
that
are
good
or,
and
then
you
can
actually
let
them
create
processes
also.
C
So,
basically,
it's
much
better
to
prevent
than
fix
later
it's
one
of
the
key
topics,
so
even
if
it's
sometimes
troublesome
for
the
developers
and
takes
a
little
bit
more
of
time
to
orderly
check
the
code,
that's
for
sure
a
return
of
investment
in
time
for
the
company.
At
the
end,
it's
going
to
be
for
sure
the
best
option
to
fix
first
and
not
fix
later
and
by
that
use,
devsecops
tools
or
automation
where
you
can.
D
D
And
showing
that
you
understand
the
findings,
you
understand
what's
relevant
yeah
and
not
giving
wordpress
findings
when
they're
talking
about
amazon,
ec2
instances,
for
example,
so
leading
by
example.
That's
one.
The
second
we
said,
focus
yeah,
let's
choose
the
the
relevant
five,
the
relevant
ten
yeah
findings
that
are
relevant
end
alerts
throughout
the
secure
development
life
cycle
and
not
dumping
an
excel
of.
B
D
That
won't
be
remediated
in
in
a
normal
time
period.
Yeah
and
the
third
thing,
like
we
said
keeping
it
native
in
their
environment,
not
changing
workflow,
not
changing
habits,
yeah,
leaving
it
in
jira
the
whole
automation,
remediation,
orchestration,
yeah
in
their
environment
and
not
out
of
band,
not
in
a
different
environment
or
in
a
new
flow
that
just
people
aren't
aren't
used
to
again
developers.
D
A
Yeah
excellent,
so
we
were
actually
scarring
away
in
the
background
trying
to
capture
your
thoughts,
and
so
maybe,
if
I
just
put
it
up
on
the
slide
for
everyone
as
well.
I
mean-
maybe
just
to
summarize
the
summary
that
you
know
the
three
of
you
have
given
kind
of
four
key
things
there
like
embrace
the
developer
developer
environment.
You've
got
to
be
where
they
are
to
get
engagement,
to
get
the
remediations
that
you
want
lead
by
example.
Don't
dump
you
know,
demonstrate
work
through
it's
a
partnership.
A
A
So,
let's
take
a
look
at
some
additional
questions
that
we
have
here.
So
there
was
a
question
that
came
earlier
on
the
presentation
it
was
about
like
how
soon
is
too
soon
or
how
soon
is
too
late
to
start
devsec.
Ops
like
if
you're
a
tiny
startup,
should
you
be
embracing
this
on
day
one
or
is
it
something
that
you
should
kind
of
leave
until
you
know
like
a
year
or
a
year
and
a
half
or
two
years
into
your
journey
sharon?
D
Yeah
so
like
daniel
said-
and
this
is,
this
is
related
to
prevention
and,
more
importantly,
building
the
foundations
correctly.
So
even
if
you're,
a
small,
startup
and
you're
building
it
alone
or
using
maybe
third-party
contractors
and
such
it's
important
to
build
the
foundational
security
pieces
from
the
start.
Otherwise,
you're
going
to
fix
a
lot.
C
D
Or
you
won't
be
able
to
scale,
and
we
understand
we
know
that
a
lot
of
the
core
technologies
today
they
have
security
built
in
already.
So
you
just
need
to
read
the
appendix
or
you
know,
read
some
of
the
documentation
and
a
lot
is
within
the
deployment
yeah
relatively
off
the
shelf
yeah
right
away.
So
better.
D
C
So
I
mean
fully
everything
I
mean
depends
on
the
criticality.
Of
course
I
mean
if
you
are
not
going
to
develop
some
crazy
things
that
is
going
to
be
really
exposed
to
a
hacker
or
whatever
I
mean
depends
also,
but
for
sure,
starting
with
even
a
mock-up
of
this
cops
that
you
agreed
to
take
the
con.
It's
like
a
like
the
attitude,
I'm
not
going
to
have
time.
C
Okay,
I
have
the
code,
I
cannot
check
it.
I
go
with
it
because
I
have
to
go
fast
and
my
business
is
going
to
die
in
two
days.
If
I
do
not
develop
this,
so
I
I
need
to
ignore
security
that
could
happen
in
some
startup,
not
the
best
option.
I
would
hope
that
that
doesn't
happen,
but,
okay,
I
accept
the
risk,
but
at
least
I
am
accepting
the
risk.
I
know
there
is
a
risk.
C
B
A
A
I've
definitely
learned
a
lot
of
things
about
this,
so
I
really
appreciate
you
know
the
the
open
conversations
that
we
had
for
all
of
you
that
are
out
there
we'd
love
to
know
what
you
thought
about
the
session
as
well.
So
you
can
scan
that
qr
code
we'd
love
to
hear
your
feedback
on
on
how
this
session
went
and
areas
where
we
could
think
we
can
improve
or
things
that
you
really
enjoyed.
A
A
Okay,
and
so
just
as
an
fyi
for
all
of
you
that
are
on
the
session
and
want
to
know
what's
coming
up
next,
we've
got
the
how
to
help
developers
prioritize
security
in
software
development
and
that
session
is
running
from
3
p.m,
to
4
p.m,
cet,
and
it's
with
elio
and
nick
who
are
like
you
know,
wonderful
presenters.
I've
sat
on
a
lot
of
presentations
with
them,
so
if
you
have
the
chance,
definitely
try
and
catch
that,
but
otherwise,
thank
you
all
hope.