DevOpsDays Krakow 2020 - Jakub Sendor - To boldly go where no one has gone before

### Overview In this DevOpsDays Krakow 2020 presentation, Jakub (Kuba) Sendor examines the evolution of DevSecOps from traditional software development models and outlines actionable steps for organizations transitioning to a secure development culture. Drawing on his experience at SAP and Yelp, Sendor emphasizes that DevSecOps is an organic evolution of agile and DevOps practices. Rather than relying on fear, uncertainty, and doubt (FUD), teams should build security around data, collaboration, and incremental automation across the entire software development lifecycle.

### Key Topics - **Evolution of Software Security**: The transition from waterfall models—where security was an afterthought handled late during verification or maintenance—to Microsoft's Secure Software Development Lifecycle (SDL), Agile, DevOps, and ultimately DevSecOps. - **The DevSecOps Manifesto**: Grounding security practices in data and security science rather than fear, uncertainty, and doubt. - **The Six Pillars of DevSecOps**: Reviewing the Cloud Security Alliance's six core pillars: Collective Responsibility, Collaboration and Integration, Pragmatic Implementation, Bridging Compliance and Development, Automation, and Measurement/Monitoring. - **A Four-Step Journey to Adoption**: A pragmatic roadmap focusing on starting small and iterating fast, being inclusive, selecting the right tools, and continuous measurement with course correction.

### Technical Details - **Historical Approaches & SDLC**: The shift from shipping post-release service packs on floppy disks or CDs toward integrating threat modeling, static code analysis, and fuzz testing during development, followed by incident response. - **Games & Threat Modeling**: Utilizing gamification and structured exercises to educate teams, including the Elevation of Privilege card game (based on Adam Shostack's threat modeling book), OWASP Cornucopia, and Backdoors & Breaches. - **Security Culture Initiatives**: Establishing Security Champions to serve as liaisons or bootstrap initial security efforts, and participating in awareness campaigns like Facebook's Hacktober or European Cybersecurity Month. - **Tooling Implementations**: Bootstrapping Security Information and Event Management (SIEM) and threat detection using open source and commercial tooling. Examples include Elasticsearch paired with Kibana and Yelp's open-source ElastAlert for monitoring anomalous login attempts, Zeek (formerly Bro) for network security monitoring, Splunk for threat hunting, and CrowdStrike. - **Metrics & KPIs**: Tracking concrete measurements such as deployment frequency, test coverage, tracked/patched vulnerabilities, number of incidents, and mean time to respond (MTTR).

### Takeaways Sendor stresses that security must be framed as a business enabler rather than an organizational blocker. Organizations do not need radical disruptions to implement DevSecOps; rather, they should start small with foundational resources like the OWASP Top 10, promote cross-team responsibility beyond engineers to finance and product, automate where possible, and regularly use retrospectives and metrics to adapt and improve security posture.