Vol. I
DevSecOps: Foundations & Transformation
Shift-left culture, the DevSecOps Maturity Model and security extensions to the DORA metrics
§ 01, De quoi il s'agit
In this volume I write up what moving 40+ Java apps to zero-touch at SWIFT taught me about getting security into a delivery culture rather than a checklist. The open DevSecOps Maturity Model, five levels across eight domains, is the assessment tool, and the DORA (DevOps Research & Assessment) delivery metrics are extended with security dimensions.
§ 02, Ce que je veux que le lecteur sache faire
- 01
Place a team on the maturity model and say what the next level costs.
- 02
Tell which failure mode a delivery organisation is in and name what keeps it there.
- 03
Measure delivery and security with one set of metrics and explain them to leadership.
§ 03, Le schéma auquel je reviens toujours
Défile sur le côté →
§ 04, Structure prévue
- Partie I
The systems problem
Why security as a checkpoint fails, and how to tell which failure mode a delivery organisation is in.
- Partie II
The DevSecOps Maturity Model
The open model as the assessment tool: its levels and domains, how a team is scored, and what moving up a level asks of it.
- Partie III
Metrics that move organisations
The DORA (DevOps Research & Assessment) delivery metrics extended with security dimensions, and how to use them with leadership.
- Partie IV
Culture engineering
Security champions, threat modelling as a team habit, and the change management that makes the first levels stick.
§ 05, Quand ce sera lisible