Is this it: Does DevOps development style decrease the security of software?

The talk asks whether adopting DevOps-style development makes software more or less secure. The speaker reviewed academic literature to identify the main security challenges teams face when working this way, and the postures and practices they use to meet them. Many of the listed challenges, such as pipeline security, cloud and microservice complexity, and balancing speed with security, turn out to be general software problems rather than ones specific to DevOps.

The middle of the talk maps the practices onto the four domains of a practitioner maturity framework: governance, intelligence, software development lifecycle touchpoints, and deployment. The academic findings are compared with a practitioner dataset built on the same framework, which shows only a few overlapping practices, such as securing host and network basics and performing security feature reviews. Comparing earlier and later editions of that dataset, the speaker finds that deployment-focused activity has dropped while governance and intelligence work has grown, which is read as progress toward shifting security left.

The speaker concludes that the evidence points toward improvement but is not conclusive, since the data is limited and may be dated. Remaining concerns include the growing number of privileged administrators in development environments and the near absence of training in the reviewed literature. The talk closes by suggesting that AI and low-code platforms may bring the next shift, possibly back toward the deployment side of the lifecycle.