DevSecOps Leadership Forum: 500 Innovators Learning From Shared Experiences

May 14, 2020
By Matt Howard

5 minute read time

A week ago, we hosted the North American DevSecOps Leadership Forum. It was an online event and an amazing experience in which we assembled 500+ software development, application security, and IT operations professionals to share experiences and learn from one another.

The purpose of this post is to provide a quick recap of the day. For starters, I want to share context in regards to participating companies and professionals, and how they rated themselves with respect to DevSecOps maturity.

Participating Companies

Participating Roles

Level of DevSecOps Maturity

World Class Speakers and Panelists

At Sonatype, we have developed deep roots within the global software engineering and application security communities, and we are grateful to the world class speakers who shared their experiences at DLF 2020.

• Bryan Batty, Director of Product and Infrastructure, kicked off the program, sharing his application security journey at Bloomberg. Prior to his tenure, there were no open source governance policies. With the introduction of the right tools and a cultural shift, he's seen transformative success. However, there were many challenges along the way. Batty stated, "Security was often viewed as an impediment to innovation by the development team. Developers were frequently resistant to new tools and were not interested in making significant changes." Batty discussed how he worked to collaborate with developers, build trust, and slowly refine culture.

• Financial Services Panel: This discussion featured Robb Keayes, VP, DevOps Coaching Lead, Nomura, Howard Zeemer, Staff Engineer, OTA Team Lead at LendingTree, and Sladjana Jovanovic, VP, Enterprise Payments and Technology, TD Bank. The panelists addressed how banks and financial service firms compete and win in today's world through software innovation.

  • Sladjana Jovanovic shared that TD Bank is "in the business of building trust with our customers. To be trustworthy, we need to be resilient. If I dissect "resiliency," it means security and operational stability." In the context of COVID-19, Sladjana is proud of the resilience displayed across TD Bank.

  • Next, Robb Keayes said financial services firms are all "undergoing a significant transformation." With regard to DevSecOps, Keayes shared how value streams can be applied with common goals to show people across the organization what good outcomes look like.

  • Howard Zeemer from Lending Tree reflected on his experience empowering developers to embrace new security tools. "Developers often feel like security tools in the pipeline will slow them down. That's why the best security tools are viewed by developers as helping them deliver faster. The prevalence of public data breaches has made developers more aware that security is critical."

• Joe Friedrichsen, Managing Director of Infrastructure and Operations, BCBS of RI, provided an operations perspective on digital transformation. To begin his session, Friedrichsen stated his "journey has been primarily about people, some process, and a little technology." The people are critical, so you have to focus on user experience. DevSecOps is really hard, and he finds it's always easier to solve hard problems when you have a relentless focus on user experience.

• Panel: The Stockdale Paradox featured Garrison Hu, Head of AppSec, T-Mobile, James Dean, Manager of Deliver Automation Services, BCBS TN, and Rob Aragao, Chief Security Strategist, MicroFocus. The Stockdale Paradox states that when faced with a difficult challenge, it is wise to balance realism (brutal honesty about circumstances) with optimism (unwavering belief that success is inevitable). So how does this paradox apply to a DevSecOps journey?

• Garrison Hu stressed that most people want to do the right thing, but often times developers don't have time to take on additional security work. Therefore, it is important to implement tools that can help developers do security work automatically.

• James Dean agreed that it takes a lot of effort and time to ensure your code is secure. It needs to be in the developers' faces, so they can educate themselves as they're working. Dean worked with his team to shift security tools further left into the SLDC.

• Rob Aragao sees many organizations struggling to integrate security into the developer workflow. Tools can definitely help, but you also need to align people and process. Robb also emphasized the importance of reviewing a software bill of materials (SBOM) so organizations can fully understand what’s in their applications.

• Mike Wilkes, CISO, ASCAP, "Sleeping Securely During a COVID-19 Induced Coma" addressed how corporations and modern IT departments should think about securing their enterprise during a medically induced coma. A work presents what challenges at home posture? Do we release software differently than before?

  • Wilkes believes that many organizations had become complacent before COVID-19. Now is a great time to ramp up security efforts, shift left, and invest in automation security within your CI/CD pipeline. Teach your teams how to find flags. If you don't have an additional budget, find out how to better maximize your tools.

• Changing culture is hard, but you won't get there unless you have the awareness to know something is wrong. If you don't focus on awareness, acceptance, and action, you won't be a good leader within your organization.

That's a wrap. DLF 2020 is complete. Thank you again to our amazing speakers and everyone who participated.

Written by Matt Howard
Matt is a proven executive and entrepreneur with over 20 years experience developing high-growth software companies, at Sonatype, he leads corporate marketing, strategic partnering, and demand generation initiatives.