[Autogenerated] wanting you may have realized by now is that
implementing a successful Dev Sec UPS process is not a fast,
an immediate task.
It's more like a Martian and a sprint.
One of the techniques I really like to apply when implementing a
program for change is to look at it in stages.
Firstly,
you need to invest significant amounts of effort to
make change in your organisation.
What a very commonly overlooked aspect of implementing
sustained change is to ensure that you allow time Andi
monitoring to lock in the progress.
Very often.
Progress can be lost over time by people falling back into previous
practices and not sustaining your new improved practice.
Always follow any improvements by period of embedding to
ensure that your new practice is sustained and becomes part of
the culture off your organization.
There are models to help you with looking at the progress,
all of your initiative over time,
these air called maturity models and aim to map how
developed or mature your processes.
There are many different maturity models applicable to
different areas of our industry.
I have called out to hear the 1st 1 being the day of SEC ups
maturity model from the day of SEC UPS Foundation,
and you can go on look at the detail of these
specifically if they take your interest.
I am not prescribing one over the other or,
indeed, that you have to use any of these models.
But I do recommend aligning yourself to some maturity model,
even if it is a custom models to suit your organization.
By way of example, on this model, there are five different tiers,
or levels ranging from insanity all the way.
True to continues,
the's different levels are rated over a number of different categories.
In this model, it's culture skills program or outcomes and security priorities.
You can get more specific details on this model at
the link at the end of the slide.
Another model I like is the Old West Def SEC Ops Maturity Model
discovers far more granular detail in terms of measuring your
development and maturity in various different areas.
I have summarized these into build and deployment culture and organisation.
You notice culture comes up quite a lot for Dev Sec ABS as it
is very much a cultural change information garnering patch
management and testing verification.
This model has four different levels which rate the understanding of
security practices from basic true to advance.
So it's quite easy In terms of measuring the different
aspects off this maturity model,
you can find out more about the whole Last Dev SEC ups
majority model at the link below.
Whatever you decide, I do suggest you identify one that you're comfortable with.
There is no hard and fast rule that you must allowing to anyone
specific model select the model that suits you.