Devsecops

Definition

Devsecops coverage in this archive spans 3 posts from Jul 2017 to Apr 2021 and frames devsecops as continuous risk reduction instead of one-time policy work. The strongest adjacent threads are security, devops, and ci/cd. Recurring title motifs include devsecops, practice, implement, and software.

What the archive argues

The strongest pattern is operational: security controls are effective only when they are embedded in delivery flow.
The consistent theme from 2017 to 2021 is disciplined execution over hype cycles.
This topic repeatedly intersects with security, devops, and ci/cd, so design choices here rarely stand alone.

Execution checklist

Map threats to concrete controls, then tie each control to an owner and an observable signal.
Start with the newest post to calibrate current constraints, then backtrack to older entries for first principles.
When boundary questions appear, cross-read security and devops before committing implementation details.

Common failure modes

Treating compliance checklists as a substitute for runtime detection and response.
Adding controls no one owns, tests, or rehearses under incident pressure.
Applying guidance from 2017 to 2021 without revisiting assumptions as context changed.

References

3 entries tagged “Devsecops”

DevSecOps in Practice: What I Actually Implement April 19, 2021 · 7 min The concrete pipeline configs, policy-as-code patterns, and runtime controls I set up to bake security into delivery. devsecops security devops

Your Software Supply Chain Is Probably a Mess January 11, 2021 · 8 min What SolarWinds taught us about supply chain security, and the concrete steps I've been implementing at enterprise scale. security supply-chain sbom

Stop Doing Security Reviews by Hand July 17, 2017 · 5 min Your manual security gate is a bottleneck pretending to be a process. Here's how I moved security checks into the pipeline at the fintech startup so we could ship fast without shipping stupid. security devops devsecops

All topics →