Shifting Focus to Make DevSecOps Successful - Janet Worthington - ASW #258

<p>What if all these recommendations to shift left were more about shifting focus? It's all too easy to become preoccupied with vulns, whether figuring out how to find them earlier in the SDLC or spending time fixing them within specific number of days. Successful DevSecOps approaches can be so much more than just vulns and so much more than just tools. Sure, tools are useful for identifying known vulns in dependencies and new vulns in code, but teams that emphasize people and culture will find it easier to shift their attention to the security of their product and creating secure designs.</p> <p>Segment Resources: Shift Everywhere is the bullet-train to secure software: <a rel="noopener" target="_blank" href= "https://www.forrester.com/blogs/shift-everywhere-is-the-bullet-train-to-secure-software/?ref_search=3502061_1696872306356"> https://www.forrester.com/blogs/shift-everywhere-is-the-bullet-train-to-secure-software/?ref<em>search=3502061</em>1696872306356</a> Forrester Software Composition Analysis (SCA) Wave: <a rel= "noopener" target="_blank" href= "https://www.forrester.com/report/the-forrester-wave-tm-software-composition-analysis-q2-2023/RES178483?ref_search=3502061_1696863504716"> https://www.forrester.com/report/the-forrester-wave-tm-software-composition-analysis-q2-2023/RES178483?ref<em>search=3502061</em>1696863504716</a> Forrester Static Analysis Security Testing (SAST) Wave: <a rel= "noopener" target="_blank" href= "https://www.forrester.com/report/the-forrester-wave-tm-static-application-security-testing-q3-2023/RES178489?scrollTo=FHqjnkXmzX"> https://www.forrester.com/report/the-forrester-wave-tm-static-application-security-testing-q3-2023/RES178489?scrollTo=FHqjnkXmzX</a></p> <p>Show Notes: <a rel="noopener" target="_blank" href= "https://securityweekly.com/asw-258">https://securityweekly.com/asw-258</a></p>