Tag: RSA

  • Debugging is Broken – Here’s How To Fix It

    Debugging is Broken – Here’s How To Fix It

    Let’s face it, debugging is broken.

    Whether you wholeheartedly agree or vehemently disagree with that statement, I think we can all agree that debugging, at the very least, has room for improvement. In fact, the way software developers debug their code hasn’t changed much. Of course, there are now a wide array of observability and monitoring tools available to make a developer’s life easier, but when we look at the process developers typically follow when debugging code, it’s stayed relatively unchanged over the years.

    Having the right tools available definitely improved the overall debugging experience, but they’re not the only factor. Internal organizational processes are equally as important, and should be adapted to make developers’ lives as smooth and stress-free as possible while still maintaining the proper levels of organizational security and compliance. Inefficient or highly restrictive processes, while great for the compliance team, can adversely affect the velocity of getting to the bottom of issues quickly. The right solution is typically a combination of adapting those processes to fit the company culture, along with a combination of tools that allow for compliance with industry standards and best practices.

    How Developers Debug Code

    When you talk to developers today about how they debug their applications, the process is typically not all that different than it was many years ago. The standard approach to debugging is still through the use of logging frameworks. Of course, teams are taking advantage of things like application performance management (APM) tools and other tools in the monitoring and observability space, but when you look at the primary method of debugging issues that require developers to dive into the code, logging is typically the main approach.

    The process typically looks something like this:

     

    debugging process

    When a defect is found, developers will first go to the log files on the production or pre-production servers in the environment where they are debugging. If they can’t find information in the logs to help them get to the root cause of the issue, they go back to their code and add additional log lines, finally sending their code through the process shown above. For highly advanced organizations, the process can take minutes or hours, but more often than not, this process drags on for days – or even weeks. It becomes especially time-consuming when the defect developers are trying to find and remediate is in production. In these cases, the cost to the business can be staggering; there’s got to be a better and more efficient approach to debugging.

    Where Tools Can Help

    While new and shiny tools don’t always solve all debugging problems, they can often ease some of the pain developers face and, in the process, make their lives a little bit easier. Debugging, observability and monitoring tools can get developers the data they need to solve problems faster than the more traditional method of digging through logs and using trial and error.

    The place many organizations start when considering diagnostic tools is with APM. These types of tools focus specifically on monitoring and management of the application availability, and can help to collect metrics and other relevant application information that can aid in pinpointing infrastructure issues. Most often, these tools are not actually used by developers themselves, but rather operations or production support teams to ensure availability and performance thresholds of applications.

    Another critical category of telemetry are tracing tools, which can help developers better understand how requests flow through multiple tiers of applications and even help identify error rates and latency. There are many vendors selling this category of tools, but there are also open source options which allow developers to integrate tracing into their applications via a vendor-neutral approach.

    After diagnosing an issue with an APM solution, there is often a handoff to development to remediate the issue. When developers need to debug, they often use their local IDEs or, even better, a remote debugging solution. Remote debuggers are used directly by developers to simplify debugging of applications in remote environments. These tools helps developers get to the bottom of customer issues faster by giving them direct access to the underlying application data in a safe and secure way while the application is running without stopping it or having to redeploy it. A major benefit of remote debuggers is that they can give developers the data they need from production environments without compromising security or requiring developers to have direct access to sensitive environments. While remote debuggers and other debugging tools are not a silver bullet, they can be a critical component that empowers developers to better address critical issues.

    Fixing Organizational Problems

    If solving customer issues is taking longer than expected or is potentially hurting your brand, it’s critical to sit down with your development team and use a data-driven approach to identify where the problems lie. Do a deep dive into your issue tracking or ITSM system to identify trends or recurring issues within particular application components. Development teams can often become so overwhelmed tackling issues and building out new features that valuable information in these internal systems can go untapped. Customer issues and defects should be reviewed periodically to assess things like business impact, cost to fix and alignment with the product roadmap. There is valuable information that can help focus the team’s effort on time-saving activities as well as improving the product, making for happier customers.

    Another area to look at is your software delivery process. Are there bottlenecks in your delivery pipeline that could be made easier or more efficient but have been overlooked? The speed and efficiency of your software delivery pipeline has a direct impact on developers’ ability to debug effectively and can contribute to a broken or slow debugging process. Developers should have the ability to push code into new environments as quickly as possible to remove slowdowns from too much context switching. This means automating as much of the delivery pipeline as possible, removing unnecessary manual deployment approvals and shifting left as many activities as possible.

    When it comes to empowering developers and fixing broken debugging processes, organizations should focus on fixing organizational bottlenecks as well as equipping developers with tools that can save them time and improve their daily workflows. Focusing on these areas can increase development team velocity and eliminate costly day-to-day slowdowns which add up over time and negatively impact productivity. With a few key changes, debugging can be a much more manageable and predictable process.

  • Christopher Krebs to Keynote in Live Fireside Chat/Q&A Session at DevOps Connect: DevSecOps at RSA Conference 2021

    Christopher Krebs to Keynote in Live Fireside Chat/Q&A Session at DevOps Connect: DevSecOps at RSA Conference 2021

    Former Director of Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA) to headline free one-day event

    Boca Raton, FL, April 26, 2021 — MediaOps, the place to tell your story in the most powerful way, today announced that Former Director of the Department of Homeland’s Cybersecurity and Infrastructure Security Agency, Christopher Krebs, will be its keynote speaker at DevOps Connect: DevSecOps, a free one-day virtual event to take place on Friday, May 19, during the week of RSA Conference 2021. For the keynote session, Krebs will participate in a live fireside chat with MediaOps Founder and Editor-in-Chief Alan Shimel, which will also include questions fielded from attendees.

    “I am excited to have Chris headline our DevOps Connect: DevSecOps security event at RSA Conference this year. His experience in both the public and private sector of managing risk to businesses and government agencies, enabling them to defend themselves against cyber and physical threats is impressive. Chris probably knows as much about election security and working in a public-private partnership to safeguard our critical infrastructure as anyone. I look forward to an engaging discussion with him,” said Shimel.

    Krebs is a founding partner of the Krebs Stamos Group, and previously served as the first director of the federal Cybersecurity and Infrastructure Security Agency (CISA) for two years. Before serving as CISA Director, Krebs served in various roles at the Department of Homeland Security (DHS), responsible for a range of cybersecurity, critical infrastructure and national resilience issues. Prior to his time at DHS, he directed U.S. cybersecurity policy for Microsoft and advised industry and government clients on complex cybersecurity and business risk matters while serving in positions with Obsidian Analysis and Dutko Consulting. Finally, he also served in the George W. Bush Administration, advising DHS leadership on domestic and international risk management and public-private partnership initiatives.

    Krebs holds a Bachelor’s degree in environmental sciences from the University of Virginia and a J.D. from the Antonin Scalia Law School at George Mason University.

    For the sixth year in a row, DevOps Connect: DevSecOps is again part of the RSA Conference. Each year, MediaOps puts together a line-up of internationally recognized speakers to bring security and DevOps professionals the best in peer-to-peer knowledge exchange. In addition to keynote speaker Christopher Krebs, this year’s event features a powerhouse lineup of 30 cyber DevSecOps experts.

    Additional Resources

    About MediaOps

    MediaOps, the place to tell your story in the most powerful way, is an omniversal media company covering IT industries and practices that are re-shaping the world of technology, including DevOps, Cloud-Native, Cybersecurity and Digital Transformation. Through a convergence of new media distribution platforms, we deliver the experiential stories IT professionals need to gain fresh insights and learn new skills. For marketing partners, MediaOps delivers unparalleled access to inform and engage with a highly involved IT community, for thought leadership, demand generation and specialized campaigns. MediaOps is not only the most trusted name in technology media, but the most loved as well.

    ###

    Contact

    Rebecca Auguste

    rebecca@mediaops.com

    (561) 430-3347

  • DevSecOps @ RSA Conference 2017

    DevSecOps @ RSA Conference 2017

    One again this year, devopsy.kinsta.cloud, Sonatype and RSA Conference are teaming up to bring a Security/DevOps day of learning and networking to RSA Conference 2017 in San Francisco on February 13, 2017.  The event is DevSecOps @ RSA Conference 2017. Building on the previous two years of great events, this yearsevent promises to be even better. Some of the confirmed speakers are below and you can see for yourself what an amazing array of sessions there are. The best part is attending all of the RSA DevSecOps events are free.

    DevSecOps Sessions

    The line up for DevSecOps includes DevOps and DevSecOps pioneers, John Willis, Damon Edwards, Jez Humble, Dr. Nicole Forsgren, J. Paul Reed, Josh Corman, Shannon Lietz and more. Check out the site page for full details on speakers and topics.

    Attending the full day event (10am to 4pm) is free, but you need to register with RSA Conference. If you are already attending RSA, you need to modify your registration to indicate you are attending DevSecOps (or Rugged DevOps). If you are not already registered you can do so and receive a free expo pass to RSA Conference, which will allow you to register and attend the DevSecOps conference. You can use the code: 1U7DEVOPSXP and register here.

    DevOps Wine-ing (No Whining) Party

    In addition to the full day of amazing speakers, we will host the annual DevOps Wine-ing (no whining) cocktail party, immediately following the sessions. You need to be registered separately for the Wine-ing event. There is a link to the eventbrite registration here.

    The wine-ing event is from 4:30 to 6:30 and should once again be a great time for the security and DevOps tribes to intermingle. A tip of the hat to Josh Corman who is speaking at DevSecOps for starting the DevOps Wine-ing party 4 years ago.

    Security @ the Speed of DevOps Lunch ‘n Learn

    On the following day, Tuesday we will host a lunch-n-learn on the “Security at the Speed of DevOps” report we are co-producing with the Cloud Security Alliance. We will have a panel including George and some leading DevSecOps and Cloud Security experts discussing the findings over lunch at Jillians. Again this event is free but you need to register for it here.

    The report is being written by George Hulme and is based on a survey co-produced and distributed by devopsy.kinsta.cloud and the Cloud Security Alliance. You can participate in the survey (we need your help here, so please do) by taking a few minutes at https://www.surveymonkey.com/r/RSACSADEVOPS. Feel free to tell your friends about it as well.

    security at the speed of devops

    We will be distributing copies of the report at RSA Conference, as well as digitally via devopsy.kinsta.cloud. We will also be distributing several other surprise giveaways at the event as well.

    Yes, this years RSA Conference will feature lots of DevSecOps and you can partake in all of it for free. Of course this wouldn’t be possible without the help of a great bunch of sponsors who have stepped up this year to support the events. In addition to RSA Conference, Sonatype and devopsy.kinsta.cloud, sponsors for the event are:

    Gold Sponsors

    CA Technologies, HPE, White Hat Security, Veracode, Cloud Passage, New Context and Illumio

    Silver Sponsors

    Signal Sciences, Twistlock

    See you on the 13th in San Francisco!

     

    — Alan Shimel

  • DevOps Connect: Rugged DevOps @ RSA Conference

    DevOps Connect: Rugged DevOps @ RSA Conference

    Once again this year devopsy.kinsta.cloud along with Sonatype, The Nexus Community, Gene Kim, Josh Corman and Mark Miller are producing DevOps Connect: Rugged DevOps @ RSA Conference.

    The full day event takes place at the Moscone Center on the Monday of RSA Week, February 29 (it only comes once every 4 years), 2016. After the day packed full of sessions there will be a cocktail reception* as well.  *Cocktail reception requires separate registration.

    Last years event had over 700 people in attendance and featured a great lineup of speakers. This year’s lineup is even better we think. It features leaders from both the DevOps and security communities with some great practitioner accounts of how DevOps helps security and how security helps DevOps.

    Thanks to the generosity of our friends at RSA Conference, we have a larger room this year to accommodate more people.  Anyone with any type of RSA pass is welcome.

    What’s that, you don’t have an RSA pass? No problem. Use code 1U6DEVXPO when you register and save $100 off of an RSA full Expo pass. This should make your pass free if you register right away or only $25 if you register later.

    With your RSA Expo pass not only do you have a ticket to to DevOps Connect: Rugged DevOps event, but you have a ticket to a full week of attending the RSA Expo floors. Sounds good to me. You can head over to REGISTER here. But don’t wait, there are less than 30 days to RSA!

    Also you can get a lot more info about the speakers, abstracts, backgrounds etc. on the DevOps Connect: Rugged DevOps website.

    So don’t wait. Register today as seating is limited and on a first come, first serve basis.  Looking forward to seeing you at DevOps Connect: Rugged DevOps!

    Here is a quick look at the full agenda:

    • 8:30 AM – 8:50 AM |Doors Open
    • 8:50 AM – 9:00 AM |Welcome & Overview | Alan Shimel, Mark Miller
    • 9:00 AM – 9:20 AM |Chocolate and Peanut Butter (or some such) | Josh Corman, John Willis
    • 9:20 AM – 9:40 AM |What’s Hiding Under Your DevOps Rocks? | Jez Humble
    • 9:40 AM – 10:00 AM |The State of DevOps Data Science | Nicole Forsgren
    • 10:00 AM – 10:40 AM |The Darker Side of DevOps and Security | Bruce Potter
    • 10:20 AM – 10:40 AM |Break
    • 10:40 AM – 11:00 AM |2016 in Review: Failures in Public Safety and Privacy | Kim Zetter
    • 11:00 AM – 11:20 AM |Seven Habits of Rugged DevOps | Amy DeMartine
    • 11:20 AM – 11:40 AM |Applying DevOps principles to address dynamic changes in Cybersecurity | Aaron Volkman, Hasan Yasar
    • 11:40 AM – 12:10 PM |Panel: “DevOps Engagement: Politics, People and Process” | Goerlich/Thrasher/Corrierre/Wang
    • 12:10 PM – 1:20 PM |Lunch Break
    • 1:20 PM – 1:40 PM |The Journey to DevSecOps | Shannon Lietz
    • 1:40 PM – 2:00 PM |Rugged DevOps: Compliance at Velocity | Justin Arbuckle
    • 2:00 PM – 2:20 PM |Building Security Controls Around Attack Models, Not Gut Feel | Stephan Chenette
    • 2:20 PM – 2:40 PM |Release Engineering’s Role in Rugged DevOps | J. Paul Reed
    • 2:40 PM – 3:00 PM |Silver Linings for Miles: DevOps for Building Secure Solutions | Andrew Becherer, Zane Lackey
    • 3:00 PM – 3:20 PM |Break
    • 3:20 PM – 3:40 PM |Security Wargames | Sam Guckenhiemer
    • 3:40 PM – 4:00 PM |Bridging Security and DevOps using an Attack Driven Approach | Earnest Mueller, James Wickett
    • 4:00 PM – 4:20 PM |Architectures, Design Patterns, and Coding for Rugged DevOps at Scale | Rich Mogull
    • 4:20 PM – 4:50 PM |The R.O.A.D. to Rugged DevOps for a Major Airline | Dan Glass
    • 4:50 PM – 5:00 PM |Final Thoughts | Alan Shimel, Mark Miller

    Also a special thank you to  our sponsors:

    HPE, Illumio, Cloud Passage, Evident.io, CA Technologies, TwistLock and RSA Conference!

    twistlock cloudpassage evidentio hp illumio calogo-300x120

     

  • DevOps Spring Tour 2015: Keeping Cool with ICE

    DevOps Spring Tour 2015: Keeping Cool with ICE

    One thing I love about conferences is finding out what other people are doing in industry and getting exposure to new ideas. I like to get external feedback on my work because I find it to be helpful. Here’s some highlights from where I’ve been and what I’ve heard so far in 2015, including Alterconf, RSA, A Data Presentation Course with Edward Tufte, and DevOpsDays NYC.

    AlterConf

    My first stop was Alterconf in Atlanta this year. I try to support local events and knew I would gain a lot of perspective from the presenters that I probably wouldn’t find elsewhere. There was a lot of discussion about age bias and discrimination for both younger and older people as we all move through those stages during our lives. Starting a culture of continuous learning early in life was a consistently supported goal among the presenters and attendees.

    My other take away from alterconf is people may or may not be comfortable representing or discussing the different groups they belong to with anyone. Introverts can have a very difficult time talking tech at an event, for instance.  Several speakers at the conference made note of the fact that we will occasionally step on each other’s toes due to what are ultimately misunderstandings and we should be quick to apologize, provide space, and try not to get too upset when someone makes a mistake or appears uncomfortable. I was encouraged to see the consensus lean towards discretely and respectfully bringing any issues up if necessary instead of public exposing someone. Even snapping at a manager in a meeting over a wisecrack about a father ‘babysitting’ his own kids does more harm than good. You shouldn’t stomp on anyone with both feet over failed build either. Having a calmer conversation with a smaller audience if possible was the advice I heard repeatedly throughout the day.

    We’ve been having more conversations around anxiety and burn out as a community and talking a lot about comfort, learning, and danger zones. I’m going to openly admit I was more nervous than usual going into alterconf as a white cisgendered heterosexual male. It may have had something to do with the fact that I didn’t know what cisgendered meant before the event. The anxiety quickly passed after I found my seat and realized there were plenty of people there just like me. At a minimum all of us were passionate about technology. It was a very open and welcoming space and I gained a lot of perspective that I wouldn’t have otherwise. There are 5 more sessions scheduled this year if you may be interested in gaining some perspective from a broader range of people that are also passionate about tech.

    DevOps Connect @ RSA

    DevOps Connect @ RSA was a uniquely awesome experience. I met a lot of security folks coming into the DevOps space for the very first time which was encouraging to see. I also got an up close look at the security industry and why they need to gain some insight from a DevOps perspective. The expo floor was the most commercialized one I’ve ever seen at an event. It reminded me of a midway at a state fair. I wouldn’t have been shocked if someone had called me in for a go at the ring toss. Most of the sales pitches sounded like magic beans to me, bolted on for instant risk mitigation.

    The one vendor that separated themselves as an exception to this was Tufin. Tufin’s security orchestration suite is a comprehensive solution for network security management providing visibility, change tracking, analysis and auditing for firewall policies, network devices and cloud platforms. It also provides automatic firewall change management and application connectivity management. It assures a tight security posture, rapid service delivery and regulatory compliance across all enterprise platforms.

    I haven’t taken it for a spin myself, but Tufin definitely impressed me with their demo and orchestrated approach to the problems security is currently facing.

    Certification was also a consistent topic of conversations at RSA. I think there’s a lot of misunderstanding in this space between arbitrary compliance and compliance that legitimately mitigates risk or provides a return on invested time and energy. This sentiment echoed through Secretary Jeh Johnson’s keynote, as he announced the opening of a satellite cyber security office in Silicon Valley and an invitation to cooperate with concerns surrounding encryption.

    Data Visualizaiton Workshop with Dr. Tufte

    My next stop was Boston for a data visualization workshop with Dr. Edward Tufte. When I told him I was a devOps engineer working on dashboards in an enterprise environment I could tell he was curious but may have not heard the word devOps before. The person I was speaking with before Dr. Tufte came by mentioned a health care system that still faxed data between offices and the problems it caused with younger employees that had never used a fax machine before. It was obvious to Dr. Tufte that they should switch it to a web based system, and the frustration with compliance and risk concerns that prevent that change from happening were not lost on him. For lack of better words and opportunity, I offered this as the type of problem devOps is currently trying to solve. The perspective I gained from the session that followed was from an experienced professional that can fully appreciate the current state of the art. I believe I appreciate it now more than ever, for which I’m thankful.

    DevOpsDays NYC

    The topic of discussion was ICE, or Inclusion, Complexity, and Empathy, based on a post by Dave Zwieback from earlier this year. The talks focused on how to try to cooperate better between teams both at home and abroad and suggestions on how to handle departments that are more territorial in addition to dealing with our own stress levels.

    Attendees seemed particularly grateful towards John Willis and Justin Lintz for talking about burn out and anxiety in our industry among heavier topics. If you’re inclined to start a conversation about these types of health issues in your community then you probably should. I try to shut up and listen as much as possible, and that’s often helps more than one would think. If you have a venue to show John’s video before an open spaces event all you have to do is book the room and be available. Creating an opportunity to discuss these issues is a huge step forward in my opinion.

    But wait! There’s More! I’m giving an Automating Enterprise Security Talk at Gluecon outside of Denver later this month. I spoke about this at devOps Connect @ RSA but I always update my content between talks as I get more feedback from folks. If you happen to be at Gluecon this year we should have a conversation over coffee, a beer, or a meal. From my experience a chat tends to be more fun in person than online, as I for one get tired of staring at screens all day.

  • DevOps Security Talks At RSA USA 2015 Conference

    DevOps Security Talks At RSA USA 2015 Conference

    DevOps and security. Its a muddled mix of waters made even more confusing by the wet ink still on the concept of DevOps. There is no denying the popularity of DevOps and there is a lot of talk on how the DevOps movement functions alongside security teams.

    The annual USA RSA conference is just around the corner and its worth noting a handful of DevOps focused talks deserving of your attention.

    I am anticipating a lot of common themes around integrating DevOps and Security regarding tools, processes and culture. Given the history of these speakers, you can probably anticipate many of them to be on the bandwagon of security and DevOps folks better learn to work together and learn from each other or be prepared to find a new job.

    If I missed a talk that specifically covers the nexus of DevOps and Security at RSA USA this year, please leave a comment and I’ll be sure to get it included.

     

  • DEVOPS CONNECT: SECOPS EDITION SPOTLIGHTS THE INTERSECTION OF DEVOPS AND INFORMATION SECURITY

    A daylong event highlighting the rapid of ascent of DevOps and its intersection with information security on April 20 – 24, at the Moscone Center in San Francisco

    Boca Raton, FL – January 14, 2015  – devopsy.kinsta.cloud, where the world meets DevOps, today announced DevOps Connect: SecOps Edition, a daylong event highlighting the rapid of ascent of DevOps and its intersection with information security. DevOps Connect: SecOps Edition will take place the Monday of RSA Conference 2015, April 20 – 24, at the Moscone Center in San Francisco.

    The keynote and co-chairs for the DevOps Connect program are author and DevOps pioneer Gene Kim of IT Revolution Press and Joshua Corman, CTO of Sonatype and co-founder of RuggedSoftware.org and IamTheCavalry.org. Gene and Joshua first introduced “Rugged DevOps” at RSA 2012 and have been building collaborations and bridges between those worlds ever since.

    In addition to the keynote, the daylong event will feature panels, discussions and sessions that highlight the advent of DevOps in high-performing IT organizations and how the information security community is interacting in it. A formal call for speakers will be announced shortly.

    “DevOps is one of the fastest rising trends in technology with a tremendous impact on the information security landscape,” said Linda Gray, general manager, RSA Conference. “We are excited to hear the direction and insights speakers such as Gene Kim and Josh Corman will bring to this event and to our RSAC attendees.”

    “The interest of the security community in DevOps has been growing rapidly for a few year now, as evidenced by some of the earlier panels and events we have held that received enthusiastic support,” said Mark Miller, leader of TheNexus Community Project. “We are happy to assist in bringing this important opportunity for learning and sharing to RSA Conference.”

    The event is free to all RSA Conference 2015 attendees who pre-register for it at the time of RSA Conference registration, up to 600 people. So early registration is encouraged, as it is expected to fill up quickly. Following the sessions the second annual DevOps wining happy hour will be open to event attendees.

    The Call for Papers to apply to speak at the event is now open. Submissions can be made at: https://devopsy.kinsta.cloud/features/cfp-devops-connect-devopssec-rsa-conference-now-open/

    About devopsy.kinsta.cloud

    devopsy.kinsta.cloud is where the world meets DevOps. devopsy.kinsta.cloud is the largest source of original DevOps related content, community support and other DevOps information helping DevOps community members the world over.  DevOps Connect are a series of DevOps conferences being held the world over to further DevOps leaning and understanding.

    Media Contact:

    Alan Shimel

    ashimmy@devops.com

    (516) 857-7409

  • CFP for DevOps Connect: DevOpsSec @RSA Conference is now open

    CFP for DevOps Connect: DevOpsSec @RSA Conference is now open

     

    300x250_Connect_ad2The world comes to talk security at RSA Conference. Every year in San Francisco the RSA Conference is the biggest information themed security conference in the world. This year there is a new addition to RSA Conference. DevOps Connect: DevOpsSec will be held on the Monday of RSA week at the Moscone Center. Attendance is free and open to all RSAC registered attendees. But you must pre-register at the time of registration.

    The keynote and co-chairs for the DevOps Connect program are author and DevOps pioneer Gene Kim of IT Revolution Press and Joshua Corman, CTO of Sonatype and Co-Founder of RuggedSoftware.org and IamTheCavalry.org Gene and Joshua first introduced “Rugged DevOps” at RSAC 2012 and have been building collaborations and bridges between those worlds ever since.

    Additionally, Mark Miller and TheNEXUS are co-producing this show along with devopsy.kinsta.cloud and of course with the sponsorship of RSA Conference.

    “DevOps is one of the fastest rising trends in technology with a tremendous impact on the information security landscape,” said Linda Gray, General Manager, RSA Conference. “We are excited to hear the direction and insights speakers such as Gene Kim and Josh Corman will bring to this event and to our RSAC attendees.”

    The call for papers is now open to speak at this event. The link for the CFP is: http://ow.ly/I27jQ . If you would like to speak at this event, head over now and submit your proposal. Josh and Gene have given a lot of thought in designing the CFP in terms of what the agenda for the conference will be, so please read it carefully before submitting.

    What are they looking for? Here is the pre-amble to the CFP which should help give you a good idea:

    DevOpsSec 2015: Call for Speakers

    Whether we like it or not, DevOps is upon us. The DevOps Enterprise Summit in October 2013 showed us that it’s not just for Internet startups, but it’s for large complex, and highly regulated organizations such as Disney, Capital One, Macy’s, GE, Nordstrom, Target, U.S. Citizenship and Immigration Services at DHS, and many more.

    DevOps and “continuous everything” is profoundly changing the entire software industry. Our goal is to show how the fittest in InfoSec are adapting (and how we all must adapt). The purpose of the DevOps Connect: Security Edition is to assemble the best practitioners who are forging how InfoSec integrates into DevOps, to grow the tribe, and to build relationships and collaborations with DevOps leaders and luminaries outside of the security “Echo Chamber”.

    Gene and Josh first introduced “Rugged DevOps” to RSAC 2012 and have been building collaborations and bridges between those worlds ever since. For 2015, we’ve asked them to host this day-long conference with the following goals:

    • bring the best and brightest of the DevOps and InfoSec communities together
    • share and codify effective patterns and practices, for mutual growth and benefit
    • for new-comers, demystify the DevOps foundational concepts that every InfoSec practitioner needs to know
    • capture the failures and toughest problems facing our industry, and mobilize to solve them

    We are looking for speakers to discuss the unique challenges of adopting DevOps in the enterprise, and the ways to overcome them. Specific topics we’re looking for include, but are not restricted to:

    • How did you get senior management buy-in, what did you do, and how did you quantify the business value?
    • How did you overcome objections inside the organization?
    • How did you design and implement effective controls to mitigate security risks?
    • Which business area (and application) did you start with, why, and what did you do?
    • What were the top challenges, and how did you overcome them?
    • What were your top mistakes, and what advice would you give as a result?
    • In-progress stories (and even nightmares) are welcome!

    Other submission guidelines:

    • Talk slots will be 30 minutes, of which a few minutes should be reserved for Q&A.
    • Attendees must be able to use the bulk of the presentation’s lessons without buying or using a particular tool or service.
    • While we love consultants and vendors (they’re some of our favorite people!), we are looking for stories from the organizations adopting these practices. We are prioritizing practitioner presentations (or joint ones with their game changing consultant/vendors).
    • You can submit up to three talks for the conference. No spamming.
    • Each submission should end with a slide communicating three things:
      1) A specific challenge you could use help with (people, process, or technology).
      2) A specific offer of how you could help other attendees (people, process, or technology).
      3) If you could wave a magic wand and get any change you want from the DevOps and “continuous everything” toolchains you depend upon, what would it be and why?

    The closing date for submissions is midnight Pacific time, February 15, 2015.

    SUBMISSIONS DEADLINE: MIDNIGHT PACIFIC TIME, FEBRUARY 15, 2015
    LINK:REGISTRATION FORM

    Thanks for your interest in DevOps Connect: Security Edition and we look forward to reading your proposal!

    Thank you!
    Josh Corman, Gene Kim

     

  • Busting The 4 Biggest DevOps Security Myths

    Busting The 4 Biggest DevOps Security Myths

    Last month when the IT security world convened in San Francisco for the annual RSA confab, a number of security experts tackled DevOps in talks that covered the crossover between continuous improvement and risk management. Among them was a lively panel mythbusting some of the most prevalent misconceptions about DevOps held by the security community.

    Moderated by Dwayne Melancon of Tripwire, the panel was made up of Josh Corman, CTO of Sonatype, Nick Galbreath, vice president of engineering at IPONWEB, Gene Kim, author of The Phoenix Project, and David Mortman chief security architect and distinguished engineer for Dell Enstratius, all of them security professionals and very active DevOps evangelists. The banter backed-and-forthed between the participants, with four myths bubbling to the surface as particular highlights from the discussion.

    Myth #1: DevOps Pace Will Leave Security In The Dust

    One of the most prevalent myths about DevOps within the security community is that the rapid deploys of the approach will throw all risk management precautions to the wind and leave security practices behind as a result. Quite the contrary, panelists argued. They believe that DevOps patterns make it more possible than ever to bake security practices into IT processes more than before, when it is frequently bolted on “at the end of the caboose,” as Galbreath puts it.

    “You’re not throwing out your current security system,” he said. “What you’re doing is removing a lot of the junk work that eats up so much time and keeps people underwater. You’re really enabling different teams to all improve security together.”

    As Corman explained, security people say all the time that complexity is the enemy of security.

    “It also happens to be the enemy of stability,” he said. “That is the reason DevOps people come willingly with open arms to the security community.”

    Not to mention, Kim added, “because you can’t be highly available and have stuff coming continuously through the pipeline if it is not secure.

    Myth #2: DevOps Destroys Compliance And Control Frameworks

    This myth came up during the audience Q&A portion of the panel, where one audience member from the financial industry wondered at how possible it would be to institute DevOps in a highly regulated industry. According to Mortman, as seemingly chaotic and fast-and-furious as the DevOps pace can seem to the uninitiated, it is actually far more process-oriented than people realize.

    “People say ‘Oh, there’s no process to this.’ But it is actually very process oriented,” he said. “It’s just not very bureaucracy-oriented. There’s not a lot of paperwork. In its very guts, it is very service-oriented and very delivery-oriented.”

    As he puts it, every compliance framework in the planet says you need to log, audit and approve changes. But none of them stipulate a workflow where each change has to be approved one at a time.

    “The workflow can be ‘Please approve the following list of actions that I can do without notifying you first,’” he explained, “and as long as you have an audit trail showing that that has been done properly, I have yet to meet an auditor who will not buy into that.”

    Myth #3: DevOps Gives Developers Too Much Power

    Many dyed-in-the-wool security pros fear DevOps because they believe it is a cowboy environment that gives developers too much power.

    “I’ll be honest, when i first started observing DevOps patterns, developers doing their own deploys seemed immoral to me; irresponsible, reckless, just shouldn’t be done,” Kim said. “No sane person would want to be associated with that, right?”

    The thing was, after Kim dove in and also did a benchmark study with Tripwire several years ago across 4,000 organizations, he found that when comparing groups where ops did the deploys to those where developers shepherded code through deploys, change success rates and mean time to repair were not adversely affected, and in fact, “it is often considered indispensible that developers take code all the way through the deployment pipeline and you know they are getting great outcomes.”

    And from a security controls perspective, the truth is that in a DevOps situation developers “are not logging individually into each server and SSH’ing the code up, untarring it and installing it,” Mortman said. Instead these actions are being done by automated systems.

    “They’re actually going to give you much better timestamps, much more accuracy, and more consistent results and visibility than a manual process being done by someone in ops,” Mortman said. “So, actually, you’re getting better change management out of that system than you are in other situations.”

    Myth #4: DevOps Cuts Important Testing

    One discussion point also brought up during audience Q&A was the possibility that DevOps would somehow excise important testing functionality from the IT process. The panel quickly put that one to bed.

    “You can do bad testing in any model,” Corman said. “If DevOps starts eliminating any kind of testing, its a bad DevOps program. I think that’s orthogonal to some of the benefits or opportunities of DevOps.”

    Kim pointed to Google as an example of how testing fits into the DevOps methodology.

    “So, Google does about 5,500 code commits per day, they have about 15,000 software engineers, and 75 million hours of testing is run each day,” he said. “You can’t get that massive amount of deployment frequencies without a tremendous amount of testing.”