Relating to DevSecOps

Send us Fan Mail

In this episode, Mike and Ken will dive deep into the world of ChatGPT and explore how it can be used to generate code for developers and operations teams. They'll discuss the benefits and drawbacks of relying on AI for security, and how it can be used to improve the security posture of your organization.

But that's not all - Mike and Ken will also explore the challenges that come with scripting examples such as terraform, AWS, Azure, and python scripting for data structures. They'll share their experiences and insights into how you can overcome these challenges and succeed in your secure development and operations journey.

So, buckle up and get ready for a high-energy, fast-paced episode that digs into how you might lean on ChatGPT for your DevSecOps Workloads... or maybe not!

Send us Fan Mail

In this episode, our hosts recap the Global OWASP AppSec Dublin conference and share insights into interesting talks about DevSecOps. They delve into the challenges and opportunities that come with securing modern applications in a dynamic and ever-changing landscape. The hosts also share their frustrations with application security vendors in the space and discuss potential solutions to overcome these challenges. Along the way, they also share their experiences in Dublin. Tune in for a candid and engaging conversation about DevSecOps, the future of application security, and the Irish experience.

To view the talks from Global OWASP AppSec Dublin check out their playlist here:
https://youtube.com/playlist?list=PLpr-xdpM8wG8479ud_l4W93WU5MP2bg78&si=EnSIkaIECMiOmarE 

Send us Fan Mail

Today's episode covers one of the most common problems for software development teams and their security partners. Application Inventory. App Inventory brings to mind different struggles and difficulties for teams and even Ken and Mike have a few different experiences in approach. The team breaks apart some differences between asset inventory, software constellations, service discovery, and api security.

If you want to meet and greet, come see us in Ireland at OWASP Global Dublin 2023!

Send us Fan Mail

Happy New Year! Another year of DevSecOps fun as we head into an unpredictable and volatile security market, Ken and Mike talk hiring and the struggle between having a ton of talented passionate junior talent and a security mission that requires experienced individuals with a limited budget. Inadequate staffing, the reality of security vs engineering budgets, bridging the talent gap with internships and an all call to organizations to fund security programs are all hot topics in the first episode of the new year.

If you're looking to think about some new approaches to hiring, or you're just curious about how to hire security staff without security staff to begin with, give us a listen

Send us Fan Mail

We hope all of the turkey comas have worn off! These holiday delays are almost over, and in the meantime here we are with the second part of how security verticals fit into the great sprawling world of DevSecOps! Mike and Ken discuss migration fro on prem to cloud and how this shift has had a tremendous effect on the perception of data security. It's become easier and easier to spin up data storage solutions in cloud and infrastructure as code, but it's lead to some common and repeated mistakes that rear their ugly heads. 

Now the responsibility of spinning up servers, managing credentials, encrypting data at rest and in transit falls on software engineering shoulders, and with that we're learning that some of those lessons DBAs learned ages ago are back with a vengeance. 

Send us Fan Mail

It's been tough getting together with the end of year madness, but we're back again after another unanticipated delay. In this episode, we take some time to cover how IAM fits into the greater idea and methodology of DevSecOps. We cover how we think of IAM in today's code driven world and go through some thoughts, opinions, and scenarios around IAM. In the next few episodes we'll be covering how other security verticals like data, incident response, and endpoint detection/response meet application and cloud security horizontals.

Videos are coming before end of year! Keep an eye on our youtube channel for live exercises

Don't judge Ken on his choice of Almond Joy as a superior Halloween candy

Send us Fan Mail

We are back from vacation! Pick up where you left off as we jump back into DevSecOps with threat modeling experiences, lessons, and perceptions we've seen in our day to day. After getting through a bit of a slow start, we revisit this topic all the way back from episode 3 where we got the hot takes on threat modeling from our resident devops and software engineering representatives Jamieson and Simon. Here we unpack a bit of how to get started in threat modeling, approaches we've seen that have worked and failed, and some general guidance on getting started. We had a blast getting back in the saddle and hope you enjoy the listen

Send us Fan Mail

One thing Mike and Ken have talked about at length at conferences, in board rooms, and in team chats is migrating workloads to the cloud security. Join them as they discuss the migrating patterns, how they vary between your favorite cloud service providers, and just where security fits into the whole mess. From on prem, refactoring, lift and shifted, native cloud workloads, or just someone else's computer, we have enough buzzwords to knock your socks off this time around

Send us Fan Mail

We are BACK! after a hiatus of vacations, illness, and family gatherings, but while we may have been absent we are at no shortage of words to say and hope you enjoy our conversation about Kubernetes and the variety of flavors cloud service providers have to offer. From EKS through GKE and AKS we cover security concerns and challenges we've seen in the last few months. We talk about why teams choose to implement one of the other and how you might think about locking down your own Kubernetes instances. Through that we try to keep the humor alive and our listeners engaged!

Send us Fan Mail

Mike and Ken take it back to the roots with a special anniversary episode on what is DevSecOps. Since we started this podcast we've had a lot of topics that fit the overall DevSecOps buzzsord, but in this episode we talk about some of the evolution DevSecOps has gone through, how it's perceived in the industry and market today and some hot takes on what's changed. The good, the bad, and the ugly. We leave it to you to decide, has DevSecOps lost it's marketing shine and buzzword status?