Fortifying DevOps: Unveiling Security Activities and Maturity Models for Resilient Software Development

The talk opens by clearing up common confusion about DevOps, cloud, and the software development lifecycle. The speaker argues that core security principles stay the same whether a team uses waterfall or agile, while the way controls are applied changes. The walkthrough then follows the pipeline from preparation and pre-commit coding through integration, delivery, deployment and operations, pairing each phase with the security tasks that fit it, such as IDE plugins, local scanning, and pipeline-based static analysis.

The middle section compares existing DevSecOps maturity frameworks from GitLab, OWASP and a commercial vendor, and explains why the speaker found them unsatisfying. The alternative is a homegrown five-level scale for each security activity, running from not done, to manual, to automated with offline reports, to alerting on new findings, to failing builds on quality gates. Teams score their applicable activities against targets, and the results roll up into portfolio-level charts for management. Supply chain risk gets focused attention, especially the difference between vulnerable and malicious components, the lack of a standard way to identify malicious packages, and the need to secure the platform, project, pipeline and application layers of CI/CD.

The closing part briefly applies the same lifecycle thinking to AI systems, with threats such as backdoored pre-trained models. It then explains software bills of materials in CycloneDX and SPDX formats as a transparency measure for customers, and suggests digitally signing them alongside binaries. The practical takeaway is to measure maturity per project and to treat build pipelines and dependencies as part of the security scope.