DevSecOps: Hope is Not a Strategy

There is a lot of investment in hope.

• I hope we won’t get breached.
• I hope our DevOps teams aren’t deploying thousands of vulnerable containers.
• I hope our developers aren’t downloading millions of vulnerable open source components.
• I hope our developers and security teams will figure out how to work together.
• I hope we won’t be fined under GDPR.
• I hope the hackers don’t notice.

Yet the fact remains that hope will not reduce breaches. Hope does not safeguard your containers or components. Hope cannot achieve collaboration. Hope won’t prevent a fine. Hope is not a strategy.

Many organizations are considering their approach to DevSecOps. They are moving beyond hope to strategy. They are choosing action over indifference. They are taking the first step of their journey.

Picture this.

We all learn from others. We have now collected 20 DevSecOps reference architectures. They reveal the choices and priorities others have made ahead of you. Look at what they did. Choose to do something similar, or create your own path from a mix of their ideas. If your canvas is blank, use these to draw something.

Watch this.

The pioneers are the ones with the arrows in their backs. Another word for DevSecOps pioneers is practitioner. And many practitioners have navigated their journey successfully enough to share it. Over 15 practitioners shared the tale of their DevSecOps journey during All Day DevOps. Every session was recorded and available here online. Every session is free. Start with this one from DJ Schleen and then pick your next one.

Start there.

Start with one thing. Don’t pick a bunch of strategies and tactics. Just pick one painful, suboptimal, or annoying practice tied to security and improve that element within your DevOps practice. Pick only one. Start there.

Hope is not a strategy. Action is your only safe option. Take the first step.

photo: Nita