From Hype to Reality- The Broken State of DevSecOps and Its Maturity Model.pdf

The slides from the talk by Dustin Lehr and Eitan Worcel at the 2024 Global OWASP at SF

Despite the hype surrounding DevSecOps, the reality is starkly different: reported issues remain unresolved, SLAs are neglected, and the role of security champions is reduced to basic training sessions.

This talk examines the shortcomings of the current DevSecOps maturity model and its failure to drive substantial improvements in security practices. We will discuss the cultural shifts needed to instill a security-first mindset, emphasizing the importance of guiding teams effectively.

By empowering security champions with meaningful responsibilities and integrating advanced technologies for automated and proactive security measures, we can transform the theoretical promises of DevSecOps into a practical framework that genuinely addresses and fixes security vulnerabilities.

1. The Broken State of DevSecOps
and Its Maturity Model
From Hype to Reality:

2. Dustin Lehr
Dustinlehr
@DustinLehr1
2
13 Software Engineer, AppSec Leader at Staples and Fivetran
Co-founder / CPTO of Katilyst (Security Champions are The Way!)
Author of The Security Champion Program Success Guide
https://securitychampionsuccessguide.org/
Co-founded the Let's Talk Software Security global open discussion meetup
https://www.meetup.com/lets-talk-software-security/
3 Kids (5, 8, and 17!), and a wife… that’s enough!
Connect with me on LinkedIn ->
(it’s safe, trust me)

3. Eitan Worcel
Born and raised in Israel
Live in Massachusetts with my wife, three kids, and threetwo dogs :(
Retired long-distance runner
Over 20 years of experience in the software world
In the appsec space since 2007
Co-founder & CEO of Mobb
Worcel
@EWorcel
3
Connect also with me on LinkedIn ->
(well, if you trusted the other bald guy)

4. Agenda
-Introduction and Overview
-The Role of Security Champions
-Cultural Shifts Needed
-Leveraging Technology
4
No AI was used in the creation of this content.
https://responsibleaidisclosure.com/

5. 55
DevOps -Why, How, What?
What
Why
How
What-faster releases,improved quality,
and greater operational efficiency,
allowing companies to stay competitive
and agile in the market
Why-to help organizations deliver
software faster and more reliably
How-by fostering collaboration,
automation, and continuous feedback
across teams

6. 66
“IT’S THE ECONOMY,
STUPID”

7. 77
DevOps -Why, How, What?
What
Why
How
What-secure, high-quality software
delivered quickly and efficiently, reducing
vulnerabilities and improving compliance
while maintaining the agility of DevOps.
Why-to ensure that the software
delivered in the speed of DevOps is
secured
How-by shifting security left, using
automated security tools, and promoting
collaboration across development,
operations, and security teams.

8. 88
'It isn't that they can't see the
solution. It is that they can't see
the problem.’
Gilbert K. Chesterton

9. 99
DevOps -Why, How, What?
What
Why
How
What-secure, high-quality software
delivered quickly and efficiently, reducing
vulnerabilities and improving compliance
while maintaining the agility of DevOps.
Why-to ensure that the software
delivered in the speed of DevOps is
secured
How-by shifting security left, using
automated security tools, and promoting
collaboration across development,
operations, and security teams.

10. 10
Mindset Shift Needed
DevSecOps is NOT just about implementing security tools as part of your CI/CD pipeline.
Automation alonewill not save you, and neither will AI.
https://devops.com/repeat-warning-there-is-no-silver-bullet/

11. 11
Building the Foundationfor DevSecOps

12. 12
The Business Case ($) for Being Proactive

13. 13
Changes to developer habits, the deployment
process, etc.
This is about gaining the proper supportand
influenceto infuse the deployment process
with security steps.
A DevSecOps Transformation
Means CHANGE

14. 14
= HOW Change Catches On

15. 15
How to Start a Movement
https://www.youtube.com/watch?v=lbaemWIljeQ

16. 16

17. 17
Allies / Security Champions
Innovators and Early Adopters are needed to push your CHANGE forward.
It’s the first followersthat influence others.
People will listen to those they know more closely than YOU.

18. 18
Patience! It takes time to do it right
Make a strong business case to pursue actual leadership support-active engagement by senior
leaders
Make a strong business case to pursue actual leadership support-active engagement by senior
leaders
Obtain and maintain buy-in by asking people to weigh-in and then actively listening.
Make a strong business case to pursue actual leadership support-active engagement by senior
leaders
Obtain and maintain buy-in by asking people to weigh-in and then actively listening.
Constantly share small winsalong the way to build support and momentum.
Make a strong business case to pursue actual leadership support-active engagement by senior
leaders
Obtain and maintain buy-in by asking people to weigh-in and then actively listening.
Constantly share small winsalong the way to build support and momentum.
Don’t call the win early. Only when the changes are fully adopted across ALL of the dev population
should you claim success. Then, put controls in place to maintain the state.
Make a strong business case to pursue actual leadership support-active engagement by senior
leaders
Obtain and maintain buy-in by asking people to weigh-in and then actively listening.
Constantly share small winsalong the way to build support and momentum.
Don’t call the win early. Only when the changes are fully adopted across ALL of the dev population
should you claim success. Then, put controls in place to maintain the state.
Avoid negative social proof! Don’t highlight the shortcomings or you’ll enable the naysayers.

19. 19
Time to Build ONthe Foundation!

20. 2020
Leveraging Technology

21. 21
Pen Testing
SIEM
Incident and Response
DAST, IAST,
API Testing
SAST, SCA,
IaC scanning,
Secret Scanning
WAF, RASP
21
Security
Gates
Threat Modeling,
Secure policies
Secure Code Training
IDE Spell Check,
Scan on every
code change

22. 22
Pen Testing
SIEM
Incident and Response
DAST, IAST,
API Testing
SAST, SCA,
IaC scanning,
Secret Scanning
WAF, RASP
22
ASPM
Reachability
Exploitability
ADR
Security
Gates
Threat Modeling,
Secure policies
Secure Code Training
IDE Spell Check,
Scan on every
code change

23. 23
Pen Testing
SIEM
Incident and Response
DAST, IAST,
API Testing
SAST, SCA,
IaC scanning,
Secret Scanning
WAF, RASP
23
ASPM
Reachability
Exploitability
ADR
Security
Gates
Threat Modeling,
Secure policies
Secure Code Training
IDE Spell Check,
Scan on every
code change

24. 24

25. 25
Summary
•Remember DevOps was a journey. DevSecOps is too
•There are new technologies to help you
•But tech (and AI) on its own won’t save you, changes are needed
•Celebrate the wins

26. Dustin Lehr
Dustinlehr
@DustinLehr1
26
Eitan Worcel
Worcel
@EWorcel
Thank You
Questions?