devsecops - Abhay Bhargav

Abhay Bhargav

Sign in Subscribe

devsecops

A collection of 9 posts

Better OKRs for Security through Effective Threat Modeling

threat modeling Featured

Better OKRs for Security through Effective Threat Modeling

If you've read any management article, book or interview recently, its unlikely that you've not come across the term "OKR". The term (and practice) has become as entrenched with management culture, as its founding company, Intel, has with microchips. OKR is a goal-setting methodology

Building a Static Analysis Security Bot with Gitlab

application security Featured

Building a Static Analysis Security Bot with Gitlab

I am a big believer in Feedback loops. For me, DevSecOps is all about building better feedback loops. If I can get Dev or Ops folks to get quick security feedback on something they have written, with few/no false positives, in a workflow that they are used to, I

Hooking up - Automation (and Security) wins with Hooks

Hooking up - Automation (and Security) wins with Hooks

I am inordinately pleased with myself today. No, no, it was nothing earth-shattering. For you, there's a good chance, that its probably nothing. But I am a sucker for small wins, automation and developer-driven workflows. Any wins around Automation and dev-workflows actually. Don't know what I

Think "Feedback" over "Pipelines" for DevSecOps Success

Think "Feedback" over "Pipelines" for DevSecOps Success

For a while now, the term DevSecOps has become synonymous with Pipelines. That is natural. DevOps, for the longest time has been associated with pipelines. I am sure, that if you've read anything around DevOps or DevSecOps, you'd have heard of the term "CI/CD&

DAST Security Automation with a Markdown file

application security

DAST Security Automation with a Markdown file

I love automation and DevSecOps. Automation is a true force multiplier for already constrained Application Security teams. In my trainings on DevSecOps, one common problem that a lot of students come to me with is "How do I automate DAST?" Admittedly, DAST is hard. DAST products usually have

Disassembling CVE and CWE for No Fun and No Profit

application security Featured

Disassembling CVE and CWE for No Fun and No Profit

There's a good chance that you or your colleague(s) will be shuffling through the massive vendor presentation areas at RSA next week. Chances are that, as you make your way through the booths with shiny screens with Dashboards and fancy-looking charts, you'll see one or