From the course: DevSecOps: Tips for Success

Unlock the full course today

Join today to access over 22,600 courses taught by industry experts or purchase this course individually.

Bring auditors to the DevSecOps party

Bring auditors to the DevSecOps party

From the course: DevSecOps: Tips for Success

Start my 1-month free trial

Bring auditors to the DevSecOps party

“

- [Instructor] Just so we don't bury the lede, DevSecOps includes governance, risk, and compliance, which I've shorthanded here just to be audit. Now, it's tempting to leave out audit functions from the DevSecOps journey. But that is shortsighted, and it doesn't represent the sharing and collaboration we like to engender with our DevSecOps efforts. You may have heard this one before. Separation of duties means you can't do DevSecOps. Separation of duties is often a control implemented to stop errors and fraud in the system. Practices like continuous delivery and models where the developer who wrote the code is now responsible for deploying the code seems antithetical to the separation of duties model. Usually the way to deal with this is to show that developers don't deploy their own code, they use an automated system to do so. The system only deploys the code if all of the requirements are satisfied. The tests are passed,…

Contents