John Worrall, ZeroNorth CEO, expands on the "why" of DevSecOps, focusing on the business benefit, gain and measurement of what we seek to accomplish through DevSecOps. John advocates we concentrate on the process and data enabling us to assess risk, prioritize the most beneficial security work. Learn more about ZeroNorth athttps://www.zeronorth.io.

Maximizing The Benefits of DevSecOps, ZeroNorth

In this episode, Matt Tesauro hosts Greg Anderson and Cody Maffucci to talk about OWASP DefectDojo.  DefectDojo is an OWASP flagship project that aims to be the single source of truth for AppSec or Product Security teams.  It provides a single pane of glass for security programs and can import and normalize over 150 different security tools. I thought that the OWASP podcast might just cover an OWASP project now and then so here we go.

Show Links:
- https://www.defectdojo.org/
- Github organization: https://github.com/defectdojo
- Github main repo: https://github.com/DefectDojo/django-DefectDojo
- Pubic Demo info: https://github.com/DefectDojo/django-DefectDojo#demo 
- Data models (part of the project docs) https://defectdojo.github.io/django-DefectDojo/usage/models/

OWASP Podcast

Getting Lean and Mean in the DefectDojo

This is the Engineering Culture Podcast, from the people behind InfoQ.com and the QCon conferences.

In this podcast Shane Hastie, Lead Editor for Culture & Methods spoke to Adam Kentosh about the ongoing challenges organisations face in their DevOps DevSecOps and digital transformation journeys.

Read a transcript of this interview: https://bit.ly/3zSd3OW

Subscribe to the Software Architects’ Newsletter for your monthly guide to the essential news and experience from industry peers on emerging patterns and technologies:
https://www.infoq.com/software-architects-newsletter 

Upcoming Events:

QCon San Francisco (November 18-22, 2024)
Get practical inspiration and best practices on emerging software trends directly from senior software developers at early adopter companies.
https://qconsf.com/ 

QCon London (April 7-9, 2025)
Discover new ideas and insights from senior practitioners driving change and innovation in software development.
https://qconlondon.com/ 

Save the date: InfoQ Dev Summit Boston (June 9-10, 2025)
Actionable insights on today’s critical dev priorities.


The InfoQ Podcasts: 
Weekly inspiration to drive innovation and build great teams from senior software leaders. Listen to all our podcasts and read interview transcripts:

- The InfoQ Podcast https://www.infoq.com/podcasts/ 
- Engineering Culture Podcast by InfoQ https://www.infoq.com/podcasts/#engineering_culture 
- Generally AI: https://www.infoq.com/generally-ai-podcast/ 

Follow InfoQ:
- Mastodon: https://techhub.social/@infoq 
- Twitter: twitter.com/InfoQ
- LinkedIn: www.linkedin.com/company/infoq
- Facebook: bit.ly/2jmlyG8
- Instagram: @infoqdotcom
- Youtube: www.youtube.com/infoq

Write for InfoQ:
Learn and share the changes and innovations in professional software development.
- Join a community of experts.
- Increase your visibility.
- Grow your career.
https://www.infoq.com/write-for-infoq

InfoQ Podcast

Transcript

The Ongoing Challenges of DevSecOps Transformation and Improving Developer Experience

Some production issues caused this one to slip to December so the intro is a bit off but this is still a great episode. So, learn some lessons on creating secure code from one of my favorite guests: Tanya Janca. It was hard to keep this one to its current length as Tanya is such a great person to talk to for any reason. Enjoy and happy holidays!

Show Links:

Get your copy of Alice and Bob Learn Secure Coding! (and more):
https://shehackspurple.ca/books/
Also the newsletter so that you can join the free online streams:
https://newsletter.shehackspurple.ca/

owasp podcast

ep2024-12 Tanya Janca: Happy Holidays are Secure Code

In episode 43 of Generationship, Rachel explores the frontier of AI-driven cybersecurity with John Amaral, co-founder of Root.io. Together they unpack the promise and challenges of agentic systems that detect, patch, and remediate vulnerabilities automatically. This installment offers a mix of technical deep dives, AI optimism, and a vision of security that works more like an immune system than a fire alarm.

Subscribe

Generationship - Ep. #43, Security Woven In with John Amaral

In episode 22 of Open Source Ready, Brian and John sit down with Benji Kalman, co-founder of Root, to explore the intersection of AI, software development, and security. They unpack "vibe coding," its impact on API proliferation, and the hidden costs of increased technical debt. Learn why a security vulnerability is just a bug with a purpose, and discover how AI agents can be used not just to write code, but to automatically find and remediate vulnerabilities in open-source containers.

Open Source Ready - Ep. #22, AI and Container Security with Benji Kalman of Root

Does cloud, DevSecOps and network security all go together? They have to in the real world. We sit down with Harry Sverdlove, CTO founder of Edgewise Networks and discuss this very topic as well as top three tips from Harry. Have a listen

DevOps Chat

Cloud, DevSecOps and Network Security, All Together?

Why would you allow open source usage in your company. What are the compelling reasons to take the risk. In this discussion, I talk with Topo Pal and Derek Weeks about the industry perception of open source and what's really happening behind the curtain at large enterprises. Topo had just finished his keynote presentation at DevOps Enterprise Summit 2018 and I wanted to dive a little deeper into some of the things he talked about. 

About Topo Pal
Dr. Topo Pal is Senior Director & Sr. Engineering Fellow
Capital One. His main areas of expertise are in DevOps/DevOpsSec/ Rugged DevOps and Continuous Integration, Continuous Delivery.  Topo is also interested in Natural Language Processing, Information Extraction, Architecture Strategy, Application Architecture and Integration Architecture.

About Derek Weeks
Derek E. Weeks, Vice President, Sonatype. Derek is a huge advocate of applying proven supply chain management principles into DevOps practices to improve efficiencies and sustain long-lasting competitive advantages. He currently serves as vice president and DevOps advocate at Sonatype, creators of the Nexus repository manager and the global leader in solutions for software supply chain automation.

Derek is also the co-founder of All Day DevOps, an online community of 40,000 IT professionals, and the lead researcher behind the annual State of the Software Supply Chain report for the DevOps industry.

In 2018, Derek was recognized by DevOps.com as the "Best DevOps Evangelist" for his work in the community.

with  Topo Pal from CapOne, Derek Weeks from Sonatype, and host, Mark Miller

The Journey to Open Source at Capital One w/ Tapabrata "Topo" Pal

What am I working on?
What can go wrong?
What am I going to do about it?
Did I do a good job?

These are the four questions at the heart of threat modeling In this episode, I speak with Adam Shostack, author of Threat Modeling: Designing for Security. We talk through how to begin threat modeling and the expectations of using modeling. Adam walks through the history of threat modeling, including his creation of the Elevation of Privilege game.

with Adam Shostack

Anticipating Failure through Threat Modeling w/ Adam Shostack

With so many working from home (WFH), security is being tested perhaps like it never has before.  The good folks at SpecOps have made their password auditor product free during this trying time.

We spoke with Darren James of SpecSoft about this release and some other tools they have released to help people through the rough spots.  Darren had some good insights he shared and we discussed. Have a listen

SpecOps Makes Password Auditor Free To Help WFH

Heavybit is the leading early-stage investor in enterprise infrastructure. Since 2013, we've helped launch and scale visionary technical startups—from DevSecOps and feature flagging to AI code generation and beyond. We go hands-on from day 0, backing founders as they turn code into companies and build the future of software from the bottom up to the top down.

"DevOps Chats" by Techstrong Group, the force behind industry-leading platforms like DevOps.com, Cloud Native Now, Security Boulevard, Techstrong.ai, DigitalCxO, and Techstrong.TV, is your premier destination for all things DevOps. Hosted by industry veterans Alan Shimel and Mitchell Ashley, this podcast series delves deep into the world of DevOps, bringing you the latest trends, innovative strategies, and insightful discussions that matter.

Each episode of "DevOps Chat" is a journey through the evolving landscape of DevOps, featuring interviews with thought leaders, practitioners, and change-makers who are shaping the future of technology. Whether you're a developer, operations professional, IT leader, or tech enthusiast, Alan and Mitchell ensure you stay informed, engaged, and ahead of the curve.

From continuous integration and delivery to cloud-native development and cybersecurity, "DevOps Chat" covers the spectrum, offering valuable lessons, expert advice, and engaging stories. Tune in to explore how DevOps principles and practices are transforming the tech industry, driving efficiency, enhancing security, and fostering innovation.

Join us at "DevOps Chat" for your regular dose of DevOps insights, inspiration, and community. It's not just a podcast; it's your gateway to the forefront of the DevOps movement. Subscribe now and be part of the conversation that's setting the pace for the future of technology.

Software engineers, architects and team leads have found inspiration to build better, high performing teams by listening to the weekly InfoQ Podcast. We have achieved that by interviewing some of the top CTOs, engineers and technology directors from companies like Uber, Netflix and more. Over 500,000 downloads in the last 3 years.

Security Boulevard is the destination for the security community to stay up on the latest news, discussion and analysis. Home of the Security Bloggers Network, Security Boulevard has more security related content than anywhere else on the web.

The OWASP Podcast Series is a recorded series of discussions with thought leaders and practitioners who are working on securing the future for coming generations.

Popular tracks tagged #devsecops