Vol. I
DevSecOps: Foundations & Transformation
Shift-left culture, the DevSecOps Maturity Model and security extensions to the DORA metrics
§ 01, What it's about
In this volume I write up what moving 40+ Java apps to zero-touch at SWIFT taught me about getting security into a delivery culture rather than a checklist. The open DevSecOps Maturity Model, five levels across eight domains, is the assessment tool, and the DORA (DevOps Research & Assessment) delivery metrics are extended with security dimensions.
§ 02, What I want the reader to be able to do
- 01
Place a team on the maturity model and say what the next level costs.
- 02
Tell which failure mode a delivery organisation is in and name what keeps it there.
- 03
Measure delivery and security with one set of metrics and explain them to leadership.
§ 03, The diagram I keep coming back to
Scrolls sideways →
§ 04, Planned structure
- Part I
The systems problem
Why security as a checkpoint fails, and how to tell which failure mode a delivery organisation is in.
- Part II
The DevSecOps Maturity Model
The open model as the assessment tool: its levels and domains, how a team is scored, and what moving up a level asks of it.
- Part III
Metrics that move organisations
The DORA (DevOps Research & Assessment) delivery metrics extended with security dimensions, and how to use them with leadership.
- Part IV
Culture engineering
Security champions, threat modelling as a team habit, and the change management that makes the first levels stick.
§ 05, When it's readable