Relating to DevSecOps

Send us Fan Mail

In our quest to discuss and debate the usefulness of the Terraform CDK we take a pit stop at the Amazon CDK and Cloudformation. All of us have had varying experiences with the trials and tribulations of infrastructure as code, JSON, and YAML. We tease out why and when the CDK or Cloudformation route might be a better or complimentary choice to other platforms. We touch on some security concerns along the way and prep ourselves for the Terraform CDK use case from all 3 perspectives. We've had a pretty good time researching each other's points of view here, and hopefully you enjoy the listen! Thanks for all the support!

Send us Fan Mail

We've listened to your feedback and started diving into infrastructure as code starting with terraform, our experiences learning it for fun and for clients. The trials and tribulations of automation in Jamieson's lengthy DevOps career, and where to go to get started with terraform. We cover some of our personal frustrations living with terraform and the real world and discuss how learning something as fast paced as this can be challenging and different depending on whether your a consultant or corporate deploying things engineer. 

We're also moving to every two weeks and focusing on some more technical topics so we can give you some deeper dives into the material. Let us know what you think!

Send us Fan Mail

Simon gives his perspective on Cross-Site Scripting (XSS) and we dig into some of the common protections. We also cover different views between front and back end development and where the responsibility lies for teams facing this issue. We start to unpack the importance of the product, context, and user experience as it pertains to browser attacks.

Send us Fan Mail

Jenn Molyneaux joins the crew as the very first guest! ( https://bit.ly/3ctCLJu ). Jenn is a Senior SCRUM Master who brings her wealth of experience and patience to the table to help us all understand how we can work better together. We had a great time recording this one and are excited to start getting more opinions and views on the show. We talk about DevSecOps in Agile/SCRUM, how to handle security issues, how to develop relationships across teams and getting leadership buy-in for your projects. We also get Jenn's opinions on bugs vs vulns, which we all know is a hot topic.

Send us Fan Mail

Security and Engineering go head to head in a conversation about bugs vs vulnerabilities and where we think they should fall in the grand scheme of product development. Unfortunately we threw this one together at the last minute as we had to scramble due to some life events. Keep an eye out for our intended episode next week on Agile/Scrum with Jenn!

Send us Fan Mail

This episode we riff on some of the hotter topics we discussed during Episode 9 as we cover security misconfigurations, default misconfigurations, and the responsibility of application/infrastructure configs in an organization. We talk about how to best interact with other teams to ensure configurations are manageable, maintained, and in the right hands

Send us Fan Mail

In this episode we cover the OWASP Top 10, a popular security awareness document and how DevOps and Product Engineering are typically exposed to it. While it's made waves in the industry we discuss how to use and how not to use this document and give some opinions on categories that fall into the DevSecOps sphere of work. This isn't your typical "What is SQL Injection" episode, so give us a listen and hopefully you come out the other side with a new viewpoint on using the top 10 to help your organization. Also, Ken introduces this episode after a little too much coffee, so in case you're wondering - it does NOT start in 2x speed.

Send us Fan Mail

There are so many types of tests across DevSecOps and we try to cover as many as possible from SAST to Contract testing. Simon covers his dislike for test-driven development, Ken talks through writing security tests against requirements, and Jamieson brings automation testing to light with new toolsets and process developments. 

We all had some preconceived notions going into this, but it was an eye opening and long episode. We hope you enjoy!

Send us Fan Mail

In this episode we get back to tech in the DevOps centric topic of Service Mesh. Ken and Simon chat with Jamieson about concerns and first thoughts on service mesh in their respective experiences. If you're looking at spinning up service mesh within your organization or just want to learn more about it this episode gives highlights from different professional perspectives. We end with some ways to pitch this internally to get buy in from departments that may challenge your next push into service mesh.

Send us Fan Mail

In this episode we take another people centric approach with Simon Dollo as we explore the difference between developers and product engineers. We explore Simon's engineering history and work to identify more meaningful and effective ways of communicating with people writing code.