►
From YouTube: Lift off: how empowered developers are the launch pad for secure software - Universe 2022
Description
Presented by: Stephanie Moorhead, Babitha Singh, & Justin Trugman
As developers, we are often tasked with creating applications that are secure and compliant with industry standards. However, this can often be a daunting task, especially if we are not familiar with security tools. Join Steph Moorhead and two DevOps leaders from Caregility, Justin Trugman and Babitha Singh, to discuss how they implemented DevSecOps best practices into their development lifecycle, and empowered their developer teams to own security, improve productivity, and focus on doing their best work.
As always, feel free to leave us a comment below and don't forget to subscribe: http://bit.ly/subgithub
Thanks!
Connect with us.
Facebook: http://fb.com/github
Twitter: http://twitter.com/github
LinkedIn: http://linkedin.com/company/github
About GitHub
GitHub is the best place to share code with friends, co-workers, classmates, and complete strangers. Millions of people use GitHub to build amazing things together. For more info, go to http://github.com
A
A
Hi,
everyone
welcome
to
GitHub
Universe.
My
name
is
Steph
Moorhead
and
I.
Am
a
customer
marketing
manager
at
GitHub
and
I?
Have
the
pleasure
of
working
with
our
customers
day
in
and
day
out
to
share
their
stories?
I'm
excited
to
be
joined
today
by
two
talented
devops
leaders,
Justin
trugman
and
babita
Singh
from
caragility
caragility
is
a
virtual
Healthcare
platform
that
seeks
to
improve
how,
when
and
where
Healthcare
visits
take
place
with
an
easy
to
use
web
application
that
connects
patients
with
their
clinicians.
So
today
we
will
be
talking.
A
B
The
this
cultural
transformation
in
any
organization
is
very
essential,
because
the
developers
decade
or
so
ago
they
would
release
every
few
times
a
year,
but
now
there
is
more
need
to
deploy
software
very
frequently
to
production
and
so
that
security
integration
into
the
sdlc
pipeline
is
very,
very
important
and
similar
to
how
we
talk
about
continuous
integration
and
continuous
delivery.
We
need
to
have
a
thought
process.
It
is
a
continuous
security.
Also,
that's.
A
Great,
so
Justin
I
want
to
kick
it
over
to
you
now
to
speak
to
that
cultural
transformation
that
babita
just
mentioned
as
head
of
development
at
caragility.
You
understand
firsthand
how
particular
developers
can
be
about
their
tooling.
So
why
is
empowering
developers
to
use
the
tools
that
work
for
them
so
important
at
caragility.
C
So
if
developers
are
using
tools
that
are
not
working
well
for
them,
it
would
result
in
a
lot
of
frustration,
and
that
would
mean
developers
would
end
up
taking
shortcuts
to
work
around
the
the
tooling
and
in
the
ways
that
it's
not
working
for
them.
That
frustration
would
lower
the
team's
morale.
The
shortcuts
would
also
end
up
lowering
the
quality
of
work
that
the
team's
producing
and
all
of
those
things
that
affect
them
would
be
an
increased
risk
for
the
business
to
take
on
by
providing
developers
great
tooling
and
tools
that
works
for
them.
C
A
So
considering
devsec
Ops
at
care,
agility
is
specifically
it's
no
secret
that
the
healthcare
industry
requires
some
of
the
most
stringent
security
measures
in
order
to
protect
highly
personal
information,
which
is
patient
data,
so
bobita,
can
you
explain
why
it's
so
critical
for
your
organization
to
adhere
to
rigorous
security
requirements?
It.
B
Is
very
important
for
us
to
adhere
to
rigorous
security
requirements,
because
if
the
secrets
are
leaked,
then
the
hackers
can
get
into
our
databases,
compromise
patient
information
and
that
results
could
be
catastrophic,
so
casualty
being
in
a
virtual
Healthcare.
Business.
Protecting
patient
privacy
and
data
is
of
utmost
importance
for
us
and
while
we
all
know
that
no
application
can
ever
be
a
hundred
percent
free
of
security
flaws,
but
it's
very
important
for
all
the
organizations
to
think
that
you,
you
know:
how
do
we
minimize
the
risk
as
much
as
possible
and
in
the
healthcare
space?
B
Specifically,
there
are
HIPAA
rules
that
we
have
to
comply
by
and
if
the
organizations
fail
to
comply,
then
you
know
they
have
to
pay
Hefty
fine
and
also
there's
unnecessary
attention
which
will
lead
to
reputational
damage
and
also
business
losses.
So
it's
very
important
for
the
healthcare
specifically
to
take
security
very
seriously.
A
Absolutely
so,
as
I
mentioned
at
the
top
of
this
session,
devsecops
means
parties
who
are
part
of
the
application.
Development
life
cycle
should
be
just
as
accountable
for
the
security
of
the
operation
as
they
are
for
the
development
so
Justin.
How
did
you
know
when
it
was
time
to
empower
developers
to
take
security
into
their
own
hands
so.
C
Care
agility
is
a
fairly
young
company
being
around
for
a
little
over
three
years
and
when
we
first
started,
security
was
a
very
manual
and
time
consuming
process
and,
as
we
started
to
grow
very
rapidly
and
as
we
continue
to
grow,
the
manual
process
wasn't
filling
the
business
needs
and
we
hit
an
inflection
point
a
little
over
a
year
ago,
where
we
could
have
hired
high-level
security,
Engineers
or
information
security
officers.
But
we
found
that
these
types
of
roles
are
typically
too
far
away
from
the
product
to
make
a
meaningful
difference.
C
So
what
we
decided
to
do
was
empower
the
developers
to
own
security
and
we
figured
the
people
closest
to
the
problems
are
probably
better
suited
to
solving
them
and
by
empowering
our
developers
we
thought
we
could
more
efficiently
identify
triage
and
remediate
vulnerabilities
in
our
platform.
This
is
what
kind
of
Dev
sickops
is
all
about.
It's
about
having
the
culture,
the
processes,
the
tooling,
to
enable
these
self-organizing
development
teams
to
own
the
holistic
process
of
building
releasing
and
maintaining
software.
It's.
A
B
So
then,
our
teams
worked
very
closely
together
and
the
first
thing
that
we
did
is
we
enabled
the
CI
CD
workflows
using
GitHub
actions
that
comes
with
GitHub
Enterprise,
and
this
helped
us
to
automate
the
code
deployments
to
various
environments.
You
know
Dev
QA
Etc
and
that
really
helped
the
developers
to
deploy
code
faster
and
the
next
thing
that
we
were
looking
into.
Also.
We
had
the
third
party
audit
coming
up,
and
so
we
were
looking
at
GitHub.
Advanced
security
was
at
the
top
of
our
mind,
and
so
we
turned
on
that.
B
So
initially,
when
we
started
this
effort,
we
used
GitHub
enablement
library
and
that
helped
us
enable
this
code
scanning
secret
scanning
and
depend
about
across
all
of
the
120
plus
repositories
that
were
in
GitHub
Enterprise.
Using
this,
we
were
able
to
scan
faster
instead
of
you
know,
enabling
all
of
these
features
manually
in
each
of
those
repositories.
So
one
of
the
other
nice
features
that
Justin
and
I
like
are
GitHub.
B
Advanced
security
has
a
nice
dashboard
and
it
allows
us
to
give
us
that
visual
representation
of
all
high
medium
and
low
vulnerabilities
in
one
View,
and
that
was
really
good,
because
then
we
were
able
to
get
with
our
teams
and
prioritize.
How
do
we
remediate
each
one
of
those?
And
so
once
we
were
comfortable
with
all
of
these
alerts
and
the
remediation
process,
then
we
were
able
to
include
this
into
our
GitHub
workflow
that
could
run
continuously
for
all
of
the
repositories.
A
C
So
security
is
now
just
a
normal
part
of
our
development
process.
The
analysis
is
embedded
inside
of
our
pipelines
and
that
allows
us
to
do
like
what
beefa
was
saying
with
the
secret
scanning,
so
we're
identifying
if
there's
any
secrets
that
are
potentially
being
exposed
in
our
code
like
credential
and
things
like
that,
we
have
the
code
scanning
as
well,
so
it's
detecting
vulnerabilities
in
our
code
and
then
we
have
that
dependabot
tool
and
what
that
does
is
it
identifies
vulnerabilities
in
our
dependencies
and
it
allows
us
to
better
manage
our
dependencies.
C
So
it
automatically
fixes
some
dependencies
if
it
detects
a
vulnerability
and
when
it
can't
actually
fix
it
automatically.
It
will
then
suggest
to
the
developers
different
ways
that
they
could
fix
it.
That's
minimizing
risk
and
upgrading
or
changing
the
version
of
that
dependency
and
one
of
the
nice
things
about
that
is
that
since
it's
in
our
pipelines,
we're
over
meeting
vulnerabilities
before
a
PR
is
even
merged.
C
A
So
before
we
wrap
up
I'd
love
to
ask
one
final
question
for
individuals
or
teams
that
may
not
be
as
advanced
in
their
devsec,
Ops,
Journey
or
simply
don't
know
where
to
begin.
Do
you
have
any
words
of
advice
for
those
that
are
looking
to
get
started
with
implementing
security
into
their
development
life
cycle?
Yes,.
B
C
C
And
a
final
note
is
that
devsecops
is
about
continuous
Improvement.
Devsecop's
Journey
won't
happen
overnight.
Your
team
will
never
be
perfect,
and
you
know
the
only
way
to
really
improve
at
this
is
to
continuously
improve
by
empowering
your
teams
and
as
long
as
you're
doing
that
then
you're
moving
in
the
right
direction.
Great.
A
I
think
babita
put
it
best
when
she
said
that
security
is
really
the
responsibility
of
everybody
at
your
organization,
whether
you're,
a
small
startup
or
a
large
Enterprise,
it's
so
important
to
think
about
where
security
comes
into
your
development
life
cycle.
So
thank
you
both
for
sharing
your
insights
today.
We
appreciate
the
time
thank.