WeAreDevelopers Logo WeAreDevelopers
Sign in
For You LIVE
World Congress 2022 • Jun 15, 2022

Organizational Change Through The Power Of Why - DevSecOps Enablement

Nazneen Rupawalla

Why does application security constantly stall deployments? Learn how explaining the business context and empowering developer champions transforms security from a late-stage bottleneck into a seamless agile workflow.

Pause
Mute Enter Fullscreen
#1 about 4 min

Identifying bottlenecks in traditional software security approaches

Discover why centralizing secure development responsibilities within an infosec team creates friction and limited scalability.

#2 about 3 min

Establishing a center of excellence and security champions

How building a security center of excellence and establishing an empowered champions program drives cultural change.

#3 about 2 min

Embedding security controls into project management tools

Map security requirements directly into existing developer workflows utilizing standard issue tracking boards.

#4 about 3 min

Contextualizing the why and how of security requirements

Providing real-world threat context and specific implementation guidance helps developers understand the value of secure coding.

#5 about 2 min

Pairing with teams for continuous threat modeling

Mentor security champions in identifying system vulnerabilities using established threat modeling methodologies during product kickoff.

#6 about 2 min

Integrating security scanning tools early in the pipeline

Implement standard security tooling directly into the build and deployment lifecycle to prevent vulnerabilities from reaching production.

#7 about 3 min

Automating compliance tracking with customized project dashboards

Utilize simple scripting and webhooks to generate team-specific project boards and visualize real-time security progress.

#8 about 3 min

Visualizing organizational risks through a maturity model

Aggregate team-level security data into an overarching framework to facilitate meaningful discussions with governance forums.

#9 about 3 min

Nominating accountable security champions to drive adoption

Why asking technical leads to actively select members builds stronger accountability than relying on pure volunteers.

#10 about 4 min

Structuring implementation timelines and threat modeling cadence

Determine the time investment required to establish proactive security processes and establish cadence for threat modeling.

Matching moments

2:57 min

Securing team and management buy-in for DevSecOps adoption

Moataz Nabil Moataz Nabil · LIVE

5:25 min

Shifting left and creating internal security champion programs

Vandana Verma Sehgal · LIVE

2:09 min

Shifting security left using the DevSecOps approach

Aarno Aukia · LIVE

4:58 min

Scaling security teams through developer advocates

Tanya Janca · World Congress 2021

48 sec

Scaling knowledge through security champions programs

Stefania Chaplin · World Congress 2022

6:32 min

Embracing DevSecOps and automating the software development lifecycle

Mathias Tausig · LIVE

More from World Congress 2022

What the heck do "declarative" and "reactive" actually mean? thumbnail
30:40
about 4 years ago

What the heck do "declarative" and "reactive" actually mean?

André Kovac

The Design and Evolution of C++ thumbnail
1:01:15
over 4 years ago

The Design and Evolution of C++

Bjarne Stroustrup

But, you're not Facebook thumbnail
31:12
over 4 years ago

But, you're not Facebook

Kristijan Ristovski

Communicate efficiently with Software Architecture Diagrams thumbnail
28:11
over 4 years ago

Communicate efficiently with Software Architecture Diagrams

Simon Lasselsberger

Get Ready for Jakarta EE 10! thumbnail
42:53
over 4 years ago

Get Ready for Jakarta EE 10!

Ivar Grimstad

Keep your code refactorable thumbnail
26:46
over 4 years ago

Keep your code refactorable

Gerrit Stapper

Upcoming sessions on this topic

Open session

Supply Chain Security for the Everyday Engineer

  • Pradumna Saraf

    Kestra Technologies

    Quality Assurance Engineer

Open session

How is SWE & EM roles are changing in the age of AI

  • Amol Sharma

    Stripe

    Engineering Manager

Open session

Beware of Strangers Bearing Code: Open Source Trust in the Agent Era

  • Vikram Vaswani

    Consultant

Open session

AI Is the Easy Part: Why Faster Engineers Don't Make Faster Businesses

  • Bharat Sharma

    Booking

    Senior Engineering Manager

Open session

We Deleted Our Observability Stack and Rebuilt It with OTEL: 12 Engineers to 4 at 20K+ clusters

  • Yash Sharma

    DigitalOcean

    Developer Advocate

Open session

From Prompt Engineering to Harness Engineering: Building Observable and Governed GenAI Systems

  • Lakshmi Devi Prakash

    JPMorgan Chase

    VP, Applied AI/ML Lead

Related videos

DevSecOps culture thumbnail
16:00
World Congress 2023 • almost 3 years ago

DevSecOps culture

Ali Yazdani

Secure Code Superstars: Empowering Developers and Surpassing Security Challenges Together thumbnail
23:34
World Congress 2022 • over 4 years ago

Secure Code Superstars: Empowering Developers and Surpassing Security Challenges Together

Stefania Chaplin

Building Security Champions thumbnail
48:02
World Congress 2021 • over 5 years ago

Building Security Champions

Tanya Janca

DevSecOps: Security in DevOps thumbnail
33:20
LIVE • about 6 years ago

DevSecOps: Security in DevOps

Aarno Aukia

You can’t hack what you can’t see thumbnail
29:34
LIVE • about 6 years ago

You can’t hack what you can’t see

Reto Kaeser

Security Pitfalls for Software Engineers thumbnail
27:32
World Congress 2023 • about 3 years ago

Security Pitfalls for Software Engineers

Jasmin Azemović

Related articles

From learning to earning

Jobs that call for the skills explored in this talk.