DeveloperWeek 2023

Mike Hogan, CEO, Carbonetes

Description
DevSecOps, like medicine, suffers from a philosophical division between symptomatic presentation and a holistic or systemic approach. Like western medicine, traditional DevSecOps has focused on a collection of distinct threats that are treated in isolation. However, there are benefits to a holistic or systemic model, where the various threats are evaluated in context, resulting in better policies, prioritization, and auto-remediation. This presentation compares and contrasts both models.

Takeaways
1. Threats cannot be evaluated in isolation, deployment parameters can compound or reduce risk.
2. The holistic approach provides a true risk profile
3. Both asset management and security policies require a systemic approach to security.

#DevSecOps #ContainerSecurity #ShiftLeft #SoftwareAssetManagement #OpenSource