[Autogenerated] I want to move on and try to answer the question for you.
Why, Dev.
SEC ups What makes the sec up so powerful,
and why are so many people interested in adopting it?
In order to answer this question,
we need to look at the software development evolution.
Let's have a look at the typical waterfall methodology,
which has been in use for decades.
Typically, this starts with requirements which rolling to a design code,
testing and maintenance phase is effectively water
falling from requirements all the way.
True to maintenance,
many software development organisations air now moving to a different
type of methodology which involves iterative sprint planning followed by
daily shorter term scrums or other types of short term deliveries in
what's called agile methodologies.
Comparing to two methodologies which waterfall,
we would typically start at a point in time and then invest a lot of
work in time until such point as we get value return for our effort
and investment with agile methodology.
Things were slightly different.
We start at a point in time, but we return increments of value,
smaller quantities of value more frequently.
This allows us to get a quicker return for the investment we have made.
We don't have to be waiting for a very long time to
get the return on investment.
Instead, Weaken be releasing value at multiple stages along the life cycle.
Now let's have a look how we can apply this same logic to information,
security and specifically look at the friction that currently
exists in the information security processes.
If we look at the typical security processes in any project life cycle,
we could align them very much to the waterfall methodology.
A security risk assessment followed by security plan,
cold review ___________ testing on regular orders.
All four were particular sequence and have prerequisites before they can
be completed very similar to the waterfall methodology.
So before we can get information security assurance,
we have to invest a lot of time,
effort and resources on wait for all these different stages to be completed.
This brings a number of different problems on.
To be quite frank,
these problems have been highlighted with the inability of
information security to keep up this pace.
That software development is moving at someone to friction that is
presented includes security being an afterthought,
securities sign off delays projects or That's the perception.
Thes two points can go together.
If security is not talked about up front,
it can no doubt delay projects Window nearing the release states
because issues are identified too late in the project.
Another major friction point is that security is a
once off point in time assessment.
There is no continuous security built in when we approach it
with a traditional waterfall methodology.
The cost of retesting can be very high on then.
Security gets known for being too slow and impeding the progress on
the pace of which companies need to deliver product.
Another major factor causing friction is that there is not enough skills
available to be securing the psalter development activities.
Security experts are in high demand and short supply.
The ratio of security experts to development experts is extremely low,
causing significant gaps in secure software development.
So if these air older problems that currently exist,
could we apply some of the Dev ops thinking to produce Dev Sec up on wood?
This address some of the problems were experiencing Dev and ops combining
to become develops are focused on one angle and that is producing working
software in a true develops environment.
The friction between development and operations teams have been removed by
integrating the two teams activities into a single life cycle.
Can we do the same for security on development to produce def sec ups?