Over a million developers have joined DZone.
{{announcement.body}}
{{announcement.title}}

DevSecOps: Action Is Your Safest Strategy

DZone's Guide to

DevSecOps: Action Is Your Safest Strategy

Don't just sit around hoping you won't get hacked. Follow the three steps outlined here and take proactive steps toward protecting your software.

· Security Zone ·
Free Resource

DON’T STRESS! Assess your OSS. Get your free code scanner from FlexeraFlexNet Code Aware scans Java, NuGet, and NPM packages.

There is a lot of investment in hope.

I hope we won’t get breached.

I hope our DevOps teams aren’t deploying thousands of vulnerable containers.

I hope our developers aren’t downloading millions of vulnerable open source components.

I hope our developers and security teams will figure out how to work together.

I hope we won’t be fined under the GDPR.

I hope the hackers don’t notice.

Yet the fact remains that hope will not reduce breaches. Hope does not safeguard your containers or components. Hope cannot achieve collaboration. Hope won’t prevent a fine. Hope is not a strategy.

Many organizations are considering their approach to DevSecOps. They are moving beyond hope to strategy. They are choosing action over indifference. They are taking the first step of their journey.

We can help. Not be selling you a tool. We’ll offer three free ways to start:

Picture this.

We all learn from others. We have now collected 20 DevSecOps reference architectures. They reveal the choices and priorities others have made ahead of you. Look at what they did. Choose to do something similar, or create your own path from a mix of their ideas. If your canvas is blank, use these to draw something.

Watch this.

The pioneers are the ones with the arrows in their backs. Another word for DevSecOps pioneers is practitioner. And many practitioners have navigated their journey successfully enough to share it. Over 15 practitioners shared the tale of their DevSecOps journey during All Day DevOps. Every session was recorded online. Every session is free. Start with this one from DJ Schleen at Aetna and then pick your next one.

Start there.

In a panel discussion I sat on yesterday as a prelude to DevSecOps Days at this year’s RSA conference, I heard some very practical advice (find the recording here). One of the other panelists, Stephanie Derdouri from Fannie Mae, advised our audience to start with one thing. Don’t pick a bunch of strategies and tactics. Just pick one painful, suboptimal, or annoying practice tied to security and improve that element within your DevOps practice. Pick only one. Start there.

Hope is not a strategy. Action is your only safe option. Take the first step.

Try FlexNet Code Aware Today! A free scan tool for developers. Scan Java, NuGet, and NPM packages for open source security and license compliance issues.

Topics:
devsecops ,infrastructure ,security

Published at DZone with permission of

Opinions expressed by DZone contributors are their own.

{{ parent.title || parent.header.title}}

{{ parent.tldr }}

{{ parent.urlSource.name }}