Keynote Presentation Software Defined Security Governance John Steven

## Overview

John Stephen, Founding Principal of Edify Security and CTO at Zero North, presents a comprehensive framework for software-defined security governance in modern development environments. The keynote addresses how traditional application security practices have become misaligned with contemporary software delivery approaches, arguing that security must fundamentally evolve to remain effective as organizations embrace digital transformation.

## Digital Transformation's Five Pillars

Stephen identifies five interconnected waves reshaping development: (1) outsourcing of coding through open source and cloud platforms, (2) DevOps culture breaking down developer-operator boundaries, (3) automation emphasis in CI/CD pipelines, (4) microservices and containerized architectures, and (5) infrastructure-as-code enabling developer self-service. When combined, these create a "sea change" comparable to the shift from C/C++ to web development. Organizations are now self-servicing IT provisioning—EC2 instances, RDS databases, authentication frameworks—at scales that outpace traditional security governance models.

## The Governance Gap

A critical gap emerges between development's self-service capabilities and security's ability to govern. Development executives are deploying "pipeline-as-a-service" where teams instantly provision entire delivery platforms with built-in testing and quality checks. Meanwhile, security remains focused on integrating three to five scanning tools into CI/CD—a generational mismatch. This creates cascading challenges: developers can self-service infrastructure, containers, and cloud configurations faster than security can scan them; traditional vulnerability discovery tools find only a percentage of issues; and no single security product achieves comprehensive coverage across all technology stacks.

## Modern Framework Advantages and Gaps

Modern web frameworks (Django, Flask, Go, etc.) provide built-in security primitives—contextually aware output encoding, adaptive password hashing, authentication and authorization frameworks—reducing injection and XSS vulnerabilities. However, infrastructure-as-code tooling (Terraform, Ansible, Helm, Kubernetes) lacks robust security scanning comparable to source code analysis. Laurie Williams' research found infrastructure-as-code comprises 6-11% of public repositories with 29% monthly churn, yet commercial scanning tools rarely support these technologies. This represents a critical vulnerability discovery gap.

## From Shift-Left to Shift-Left-Right-Center

Stephen argues that traditional "shift left" approaches are obsolete given that modern software behavior emerges during orchestration, deployment, and runtime. Security must combine telemetry from three sources: IDE/build time (left), artifact repositories and orchestration (center), and production behavior (right). The center—containers, cloud configurations, and infrastructure orchestration—is where security initiatives are currently weakest. Effective programs must correlate findings across all three phases and attribute them to developers or teams.

## Policy-as-Code and Governance-as-Config

Instead of traditional gates and policy documents, security must evolve to governance-as-config—defining policies in the same configuration format as infrastructure. This enables:

- **Security Blueprints**: Hardened, verified snippets developers can reuse (solving cut-and-paste replication of both secure and insecure patterns) - **Drift Detection**: Real-time alerting when deployed infrastructure deviates from approved blueprints - **Guardrails**: Proactive, config-driven enforcement of security standards - **Guard Rails vs. Gates**: Rather than blocking builds, guard rails enable self-service security compliance

Organizations like concourse labs are pioneering technology-independent policy languages, converting abstract security policies ("encrypt storage") into cloud-specific implementations (S3, RDS, etc.).

## Recommended Technical Approach

Stephen recommends a layered strategy:

1. **Modern Frameworks**: Migrate to languages and frameworks embedding security defaults 2. **Dependency Analysis**: Use Dependabot and OWASP Dependency-Track for composition analysis 3. **Configuration Scanning**: Leverage open source tools (Semgrep, SonarQube) to verify secure defaults in code 4. **Infrastructure Scanning**: Employ cloud-specific and multi-cloud tools (AWS Well-Architected tool, Scout) for cloud and infrastructure-as-code configuration 5. **Security Champions**: Enroll developers in self-governance and policy authorship 6. **Continuous Telemetry**: Replace point-in-time scan-and-report with event-driven, attributed findings

## Key Challenges Going Forward

- **Attribution**: Linking findings from infrastructure-as-code, containers, and runtime back to responsible developers - **Measurement**: Transitioning from annual/quarterly reporting to continuous feedback loops while maintaining board-level visibility - **Tool Coherence**: Gartner projects 10-30 tools needed for cloud environments; correlating and prioritizing findings is critical - **Policy Enforcement vs. Enablement**: Balancing governance requirements with DevOps velocity; gates become obstacles without guardrails

## Takeaways

Security's future depends on meeting developers at scale through configuration-driven, self-service security controls rather than blocking gates. Organizations must focus on the "center" (orchestration, containers, cloud configuration) where technology gaps are largest. Governance and policy must become executable, version-controlled code. Telemetry must be continuously attributed across build, deploy, and runtime phases. Most critically, rather than resisting development's self-service imperative, security should enable it through hardened blueprints and automated guardrails, thereby embedding security into the developer experience itself.