The shift from waterfall and long-increment development and delivery to accelerated approaches such as DevSecOps demands an agile yet disciplined approach to assuring cybersecurity. Current approaches focus on “big bang” assessments at major milestones which, for a product undergoing rapid, continual change, amounts to taking a snapshot of a door that is closed, reinforced, and triple bolted, and assuming all is well. But turn your back and the door is likely to be opened a few seconds later to let in an electrician or bring in some new furniture or an appliance. How can you know whether to trust the electrician, or the work they do, or the materials they use? Will connecting that new dishwasher blow a fuse? Is there a bug, maybe a powderpost beetle, living in that end table? Similarly, seconds after a security assessment is complete, a bug fix or software update comes along. Now what?

Continuous approaches to cybersecurity have been developed and piloted in DevSecOps environments, but these generally focus on only a subset of essential components and processes. Assuring cybersecurity requires an integrated strategy that incorporates agile processes, methods, and decision aids to address security of the whole product as it evolves through its life cycle. This webcast will present a strategy for cybersecurity engineering in DevSecOps environments.

What attendees will learn:

• the scope of a cybersecurity engineering strategy for DevSecOps
• the challenges of applying the strategy to integrate cybersecurity into DevSecOps
• the criticality of sharing information with direct and indirect stakeholders

Who should attend?

• software security engineers
• software developers
• DevOps engineers
• systems engineers
• program managers

About the Speakers

Dr. Carol Woody, a principal researcher for the CERT Division of the Software Engineering Institute at Carnegie Mellon University, is building capabilities and competencies for measuring, managing, and sustaining cybersecurity for highly complex software-intensive systems and supply chains. She has successfully implemented solutions in many domains including banking, mining, manufacturing, government, and finance. She coauthored the book Cyber Security Engineering: A Practical Approach for Systems and Software Assurance, published by Pearson Education as part of the SEI Series in Software Engineering. The CERT Cybersecurity Engineering and Software Assurance Professional Certificate, released in March 2018, is based on the research she led.