Relating to DevSecOps

Send us Fan Mail

We know, we know! It's been too long between episodes, but we had some speaking engagements, conferences, and general life going into November and here we are.

In this episode we cover unit testing, what it means to security vs what it means to engineers and some learning along the way as we dig into what makes a good unit test. All to often security engineers are telling development teams they need to write security unit tests, but they don't say how or what to write. We go through definitions, potential examples, and a bit of debate on this riveting nerd out of an episode of R2DSO.

Send us Fan Mail

In this episode we squeeze one more git topic out with an attack through a PR. Based on a recent article posted on https://cloudseclist.com/ we thought it fit the series pretty well and put a nice capstone on everything.  You can read the article we reference yourself at https://goteleport.com/blog/hack-via-pull-request/ 

This episode is full of hot takes and rambling, but we thought we ended in a good place even if we went through a few roundabout analogies to get there. Learn more about how security relates to building a house, robbing a bank, and fixing your kitchen sink.

Send us Fan Mail

Bad puns end this series with branching strategies and git. We start with Simon's preferred approach from a product engineering strategy for branching and why it works for him. Then we talk about some of the common issues that occur due to strategies that are not optimized for the organization running them. Some of these include over engineering, cultural frustrations, re-work, and security bugs! Join us for the capstone of the git series in 2021, hope you enjoy the listen

Send us Fan Mail

In this episode we cover a few technical topics, but primarily how to get started with getting security into your git pipeline through git hooks, pre-commit strategies, secrets analysis, and scan automation. We also cover some best practices that help engineers and developers stay security minded throughout their time in the repository. We hope you have as much fun listening as we did recording!

Send us Fan Mail

We head into an unknown number of episodes around git. In this episode we introduce git and common security concerns to folks who may be unfamiliar with either. Git is an essential skill for security practitioners and engineers and sometimes we're just winging it when it comes to doing things right (or at least our opinion of right). We cover differences between rebase and merge, common commands that become problems down the road, and some problems we've face in our careers with using, evaluating, and analyzing code in a repo.

Send us Fan Mail

In this episode we chat blueprints, security patterns, reference architectures, and plans. Basically what we've seen in terms of the left hand side of the SDLC in establishing requirements early. This topic came about after reading the recent AWS Security reference architecture and grappling with implementation. We get pretty metaphor and analogy heavy in this one with some examples that may or may not make sense. Ultimately, these things work! We've seen them in the real world in a variety of samples, and hopefully you'll use them too

AWS Security Reference Architecture

• https://aws.amazon.com/blogs/security/aws-security-reference-architecture-a-guide-to-designing-with-aws-security-services/

Developer Take on Using Reference Architectures

• https://ab-lumos.medium.com/embedding-security-into-sdlc-using-reference-architectures-for-developers-29403c00fb3d

Send us Fan Mail

In this somewhat makeshift, low-power episode recorded during the NYC power grid strain we do our best at getting inventive with recording techniques. Topic of the day is does DevSecOps really work? We discuss some of our failures, frustrations, and successes with DevSecOps. We also cover things you can do to succeed with DevSecOps techniques. 

While it may seem like fighting an uphill battle in security automation and all of these fancy modern security practices, we share some stories and methods to make sure these things stick.

Send us Fan Mail

Episode number 28 moves us back to a more people focused topic as we dive into technical vs non-technical management, leadership, management styles, how we've approached managers and management in our careers, and general hot takes on leadership and management in the DevSecOps world. Opinion heavy in this one and while this isn't management advice, hopefully it sparks some ideas and avenues of thought for our listeners.

Referenced in this episode:
Extreme Ownership:
https://echelonfront.com/extreme-ownership/

The first 90 Days:
https://www.amazon.com/First-90-Days-Strategies-Expanded/dp/1422188612 

Software Lead Weekly Reading List:
https://softwareleadweekly.com/

Send us Fan Mail

In this react video of a podcast we have a look at a recent blog post on whether the QA, DBA, and BA jobs are going away in favor of more consolidated roles in development such as the full stack engineer and cloud services like abstracted databases. 

Simon baits Ken into a reaction since security is excluded, but eventually conclusions and comparisons are drawn to the security industry and  just how important these role functions are in today's modern workloads. Thanks to Simon for bringing the bait and to the author for putting these thoughts together and highlighting just how similar the people and communication challenges are across the technology aisles.

Credit where credit is due! Read the article yourself for some perspective and insight:
https://towardsdatascience.com/has-devops-killed-the-ba-qa-dba-roles-fbc187abdde 

If you'd like to hear us rant more throw us some feedback, if you'd like us to rant less throw us some feedback. Thanks again for tuning in!  

Send us Fan Mail

After such a fun conversation last week, we bring Mike back in to discuss applying security at build time and what we can do with infrastructure as code through linting and early analysis. We break down the difference between Linting, Policy as Code, and SaaS and talk about how each of these might fit into your workloads. Plus! As a security practitioner, what you can do to move the ball forward in automated testing and security in your CI/CD pipelines. We got it back down to 30-ish minutes and hope you enjoy the listen. Join us for a conversation from GREP to Hashicorp Sentinel