[Autogenerated] I want to walk you through the manifesto.
Let's look at the agile manifesto.
Firstly,
think of the manifesto for Def Sec apps as the type of
Northstar sort for guiding principle,
the agile manifesto has bean around for quite some time.
Let's have a look that if you go toe agile manifesto dot orig,
you can see the principles that agile software
development are based upon these air.
Very clear guiding principle.
They're not absolute rules,
but they're really telling you where you should be
emphasizing or folks in your efforts.
For example,
individuals and interactions are valued more than processes and tools.
Working softer is valued more than comprehensive documentation.
Customer collaboration is valued more than contract.
Negotiation on responding to change is valued more than following a plan.
It does quite clearly set out that the items on the left are
valued more than the items on the rice.
It doesn't mean that the items and right can never happen in
an agile software development environment.
It just means that true lessons learned a part of agile software development.
It has been found that items listed on the left hand side of the slide are
more valuable and more aligned with agile development.
Now let's jump over to the day of SEC ups equivalent.
If you go to Dave Sec upset or there is a manifesto
that is described on this side again, remember,
the manifesto is a type of Northstar or guiding principle.
If we scroll down, we will see the manifesto.
Items are very similar in their layout and construction
to the agile manifesto templates.
There are items under left which are valued more than items under right.
Let's have a look at this in more detail.
Now there are a larger number of items have comprised The Dev SEC ops manifesto,
nine items and old.
I have been identify this being significant to call out these
air valuing leaning and overall was saying no,
that's an important one because security and security
practitioners can be branded as the no Sayers,
the people who simply say no leaning in,
In other words,
contributing to the team and being part of the solution is
valued more than saying just simply, No,
you can't do something.
Data on security signs is valued over fear, uncertainty and doubt.
Well,
this is an obvious one for anyone working in the industry
using data to substantiate actions.
Andi remediation brands always trumps fear,
uncertainty and doubt,
or food as we call us open contribution and
collaboration over security only requirements.
Again,
this is about being transparent with the holistic view
of what you're trying to achieve.
Consumable security services with AP,
eyes over mandated security controls and paperwork.
This is critical to a Dev sec UPS environment.
Remember, I said, we want to embed security within the process,
hence reference to AP eyes on consumable security services.
No longer can we come with a clipboard just checking off a checklist.
Business driven security scores over just rubber
stamping security is pretty obvious.
Red and blue team exploit Testing is more valued than relying on
point in time scans or too radical vulnerabilities.
Again,
this is moving more towards active involvement rather than
point in time scans and giving a report card.
24 7 Proactive security monitoring is valued more than reacting
after being informed of an incident again moving or engagement to
be more real time on active shared threat intelligence over
keeping information to ourselves.
We've seen this for a long time for criminals,
share vulnerabilities and other information amongst their own peers.
So why don't we share tried intelligence to defend the systems?
Makes a lot of sense to me and finally,
compliance operations over the year for mentioned clippers and checklist.
We should be looking to build compliance in tour systems
rather than coming along later to see,
can we inspect compliance as part of the system?