As we have seen from recent reports in the news and elsewhere, cyberattacks come many sources. How can we use Agile practices to improve organization's information security posture?

In this session, Dan and Paul will discuss techniques that can help make information security an important part of software development and speed your response to threats. The use of hardening pipelines, dark stories, and user stories/acceptance criteria that map to policy guidance based on NIST 800-53 controls will be discussed and how each approaches improving your security posture from a different angle.

 
11 favorite thumb_down thumb_up 1 comment visibility_off  Remove from Watchlist visibility  Add to Watchlist
 

Outline/structure of the Session

This talk will cover methods for improving the security posture. The current working outline of the talk is as follows:

Introduction/Speaker background (~2  min)

Describe the problem (~5 min)

Hardening Your System with a CI/CD Pipeline (~15 min)

How NIST 800-53 based controls can be reflected in user stories and acceptance criteria (~7 min)

The use of dark stories to thwart the hacker (~7 min)

Q&A (~5-10 min)

Learning Outcome

In this session, attendees will learn:

  • how the development teams can take advantage of secure server images built using a CI/CD pipeline
  • how security policies can be turned into user stories and/or acceptance criteria
  • how dark stories can reflect potential bad actor behavior and can be used to drive how to thwart this behavior

Target Audience

Technical Managers, Development Team Members, Security Professionals

Prerequisite

A basic understanding of automated testing, continuous integration, and user story concepts would help as these concepts will be discussed, but the basics will be presumed to be known.

schedule Submitted 2 months ago

Comments Subscribe to Comments

comment Comment on this Proposal
  • George Dinwiddie
    By George Dinwiddie  ~  1 month ago
    reply Reply

    Can you explain the NIST 800-53 controls in plain language?


  • Liked Rob Myers
    keyboard_arrow_down

    Rob Myers - How Agile Technical Practices Facilitate Disruptive Innovation

    45 mins
    Talk
    Advanced

    Leaders of development teams want to be able to adapt their existing product to innovative ideas and shifting market conditions. This is often the reason organizations "go Agile," yet this flexible ability to deliver rich business value is often frustratingly out of reach.

    Agile teams and their management are also familiar with the value of individual development practices. For example, Test-Driven Development's ability to catch defects early, and to provide the team with the ability to confidently extend the product. What Rob has found by working with a number of teams, each for six months or more, is another much greater--and more rare--source of business value resulting from diligent attention to software craftsmanship and the resulting two-way trust that forms between Development and Product.

    You will hear a handful of surprising (but real) first-person tales, each detailing a time when changing market forces, dramatic pivots, disruptive technological changes, or insightful requests were managed by the delivery team within a single two-week sprint. Each of these "Black Swan User Stories" (Rob's term for powerful, risky, and unforeseen user-stories) resulted in multiplying user productivity, opening whole new markets, or delighting and retaining critical customers.

    What we found in each case was that rapid completion of our Black Swan User Stories was the result of diligent, disciplined application of a few Agile technical practices; and that this resulted in the concrete realization of organizations' long-held expectations for Agile software development.

  • 45 mins
    Workshop
    Intermediate

    Imagine you were hired to provide consulting assistance for a new team just starting out with Kanban. The team has been struggling with their implementation and is looking forward to your expert guidance, support, and advice. It’s your first day and you just walked into the team room to look at their board. You want to make smart observations and thoughtful interpretations so you can have meaningful conversations with the team members. The team starts assembling in the team room for the daily standup and you plan on making some comments afterwards.

    What comments would you make? What thoughtful questions would you ask?

    This interactive presentation provides a detailed look at how to interpret and thoughtfully observe Kanban Boards to better understand the work of your teams. We will start with an overview of the Lean Kanban Method and then proceed through a series of interactive exercises that give you an opportunity to review and interpret various Kanban boards. The exercises will increase your understanding of Kanban systems and provide opportunities to practice interpreting various board setups so you can have thoughtful and meaningful conversations with your teams.

  • Liked Brandon Carlson
    keyboard_arrow_down

    Brandon Carlson - From Continuous Delivery To Continuous Compliance

    Brandon Carlson
    Brandon Carlson
    IT Nerd
    Lean TECHniques
    schedule 2 months ago
    Sold Out!
    45 mins
    Talk
    Beginner

    Continuous Delivery (CD) and regulatory compliance are two critically important ingredients in today’s connected organizations. CD enables you to move quickly and respond to change in an era where change is increasing at an exponential rate with no sign of slowing down. Regulatory compliance ensures that your organization takes the appropriate steps to follow applicable laws and appear to require adding burdensome processes and controls to your software development lifecycle. While they appear to be at odds with one another at first, they actually complement each other well. While maintaining, analyzing, confirming, and reporting on the status of required information security, compliance, and privacy controls can be difficult, integrating these tasks within your CD pipeline is easier than you think. Using examples from real-world projects in organizations just like yours, Brandon explains how to integrate compliance and reporting into your CD pipeline using tools you already know such as pair programming, Jenkins, Chef, Metasploit, and others, leading you to the regulatory promised land known as “Continuous Compliance”.

  • Liked Julie Bright
    keyboard_arrow_down

    Julie Bright - Powerful Tools for Affecting Change: Personal and Social Identity

    Julie Bright
    Julie Bright
    Agile Coach
    Capital One
    schedule 2 months ago
    Sold Out!
    45 mins
    Talk
    Intermediate

    Scrum Masters and Agile Coaches wear many hats, but one of the most important is that of the Change Artist.  Understanding what people need in order to move through a change curve is critical to success, but often overlooked in the toolkit is the role of Identity.  Our self-perception, both as individuals and within the context of a group, is foundational to our psychology, and can be leveraged to affect and nurture powerful, long-lasting change.   

  • Liked Daniel Davis
    keyboard_arrow_down

    Daniel Davis - So You Want To Go Faster?

    45 mins
    Talk
    Beginner

    How frequently does a good agile team deploy to production? Not every team is capable of deploying "on every commit". What does it take for a team to even start deploying at the end of each sprint, or each week, or each day?

    Most companies don't realize that deploying more frequently often requires both significant technical change as well as cultural change. In this talk, I'll guide you through what it takes to deploy more frequently, both from the technical side of setting up pipelines as well as the organizational side of removing red tape. I'll draw on the unique challenges that teams must overcome at each step of the way, from deploying once a month all the way down to full continuous delivery. If your team has been struggling to go faster, come see how you can change to get there. And if you already are at full continuous delivery, come see how to go even faster than that!

  • Liked PHILLIP MANKETO
    keyboard_arrow_down

    PHILLIP MANKETO - Building Strong Foundations…. Underwriting Fannie Mae’s Agile Transformation

    45 mins
    Experience Report
    Advanced

    Over the course of the last two and one-half years, Fannie Mae has worked aggressively to transform itself from a heavily silo’d and firmly entrenched command and control culture, following a gated workflow, with long release cycles, to an Agile organization.  Today, Fannie Mae is a more dynamic value oriented organization that is responsive to stakeholders, focused on achieving greater efficiency by enabling fast-feedback loops, as well as using empirical data to optimize mature and persistent agile values and practices.  

     

    Within the larger context of the transformation to enterprise agility, this Experience Report will focus on the case for change, Fannie Mae’s journey and the corresponding challenges, benefits and key learnings realized.  Our conclusion, while it is important to build bridges with business stakeholders, mature agile teams, leverage automation and embrace the values and principles of the agile manifesto… a successful and longstanding transformation is dependent upon the unrelenting focus on changing the ecosystem supporting the organization’s change at the outset.

  • Liked David W Kane
    keyboard_arrow_down

    David W Kane - Dicey Markets: A Product Owner Simulation

    45 mins
    Workshop
    Intermediate

    Product owners face a challenge: potential new markets are vast and full of unknowns. Current thinking in successful product management recognizes the importance of learning about potential customers
    and adapting product decisions to reflect those insights. However, many exercises and workshops
    geared towards product owners treat target products and markets as a fixed, concrete objective—failing to include any market feedback

    Dicey Markets is a product owner simulation designed to reflect many of the forces driving product owners, including unknown information about the market, competitive pressure, and technical debt. The simulation
    emphasizes the role of rapid regular feedback in creating successful products in the face of uncertain markets.

  • Liked Gene Gotimer
    keyboard_arrow_down

    Gene Gotimer - Experiences Bringing Continuous Delivery to a DoD Project

    Gene Gotimer
    Gene Gotimer
    Technical Manager
    Coveros, Inc.
    schedule 3 weeks ago
    Sold Out!
    45 mins
    Experience Report
    Beginner

    Not every continuous delivery initiative starts with someone saying "drop everything. Let's do DevOps." Sometimes you have grow your practice incrementally. And sometimes, you don’t set out to grow a practice at all-- you are just fixing problems with your process, trying to make things better.

    I'll walk through a case study of how our team worked on an exemplar project for the Department of Defense to show that agile could work in a decidedly waterfall culture. I’ll also discuss techniques and tools we used to bring a DevOps mindset and continuous delivery practices into an environment that wasn't already Agile.

    I'll talk about how we were able to start in development, where we had the most control, with a "let's starting being Agile" initiative and working on "why is continuous integration important?" From there, we tackled one problem after another, each time making the release a little easier and a little less risky. We incrementally brought our practices through other environments until the project was confidently delivering working, QA-tested, security-tested releases that were ready for production every two weeks. I’ll discuss the journey we took and the tools we used to get to build quality into our product, our releases, and our release process.

  • Liked Mathias Eifert
    keyboard_arrow_down

    Mathias Eifert - Agile Essentialism – Getting past rule-based Agile

    45 mins
    Workshop
    Intermediate

    Are you sometimes overwhelmed by the never-ending stream of Agile teachings you’re supposed to know and have at your fingertips to address every possible situation in the proper Agile way?

    Sure, Agile is a “mindset” and you’re supposed to “own your process” but the reality is, that’s not how we teach or learn or usually even talk about Agile. Instead, we are bombarded with ever more retro formats, technical practices, prioritization techniques, facilitation tips, and other snippets of wisdom that we should all know before we can be considered good Agilists. And if your job title is Scrum Master or Agile Coach, the range of things you’re expected to master only expands.

    In this session, Mathias Eifert will share how he found his footing in a vast sea of loosely connected Agile rules, processes, techniques and tools by recognizing that a small number of fundamental concepts can help with finding answers that are “good enough” as a starting point to tackle most new contexts or problems. Together, we will examine how many established Agile approaches can be traced back to these essential concepts and hopefully help each attendee a little further along on their journey from rules-based Agile to fundamental understanding.

  • Liked Mike Cottmeyer
    keyboard_arrow_down

    Mike Cottmeyer - Agile Transformations Explained

    Mike Cottmeyer
    Mike Cottmeyer
    CEO & President
    LeadingAgile
    schedule 3 days ago
    Sold Out!
    45 mins
    Talk
    Intermediate

    Leading a large-scale agile transformation isn’t about adopting a new set of attitudes, processes, and behaviors at the team level… it’s about helping your company deliver faster to market, and developing the ability to respond to a rapidly-changing competitive landscape. First and foremost, it’s about achieving business agility. Business agility comes from people having clarity of purpose, a willingness to be held accountable, and the ability to achieve measurable outcomes. Unfortunately, almost everything in modern organizations gets in the way of teams acting with any sort of autonomy. In most companies, achieving business agility requires significant organizational change.
    Agile transformation necessitates a fundamental rethinking of how your company organizes for delivery, how it delivers value to its customers, and how it plans and measures outcomes. Agile transformation is about building enabling structures, aligning the flow of work, and measuring for outcomes based progress. It's about breaking dependencies. The reality is that this kind of change can only be led from the top. This talk will explore how executives can define an idealized end-state for the transformation, build a fiscally responsible iterative and incremental plan to realize that end-state, as well as techniques for tracking progress and managing change.

  • Liked Richard Cheng
    keyboard_arrow_down

    Richard Cheng - How do I know if I have the right Product Owner?

    Richard Cheng
    Richard Cheng
    Principal
    Excella Consulting
    schedule 4 days ago
    Sold Out!
    45 mins
    Talk
    Intermediate

    Is your Product Owner available to the team, empowered to make decisions, knowledgeable in their business domain, engaged in the product and leading the way for delivery of value? This session does a deep dive in the these ideas.
The session starts with a brief Seinfeld video to demonstrate the importance of Product Ownership. The session then discusses 5 key attributes to look for in a Product Owner:

    1. Bandwidth
    2. Power

    3. Knowledge
    4. Interest
    5. Vision

    After that discussion, we will have an interactive exercise to identify what a Product Owner does day to day. The debrief will identify the balance a Product Owner must have between working with stakeholders, end users, customers AND working with the Scrum team AND product backlog refinement.

    The session concludes with the presenter sharing a Product Owner persona sheet. This persona sheet measures product owners across the 5 attributes mentioned above and presents a narrative on their core strengths and risks.

  • Liked Richard Cheng
    keyboard_arrow_down

    Richard Cheng - Group Hug: Implementing Agile Across Multiple Teams

    Richard Cheng
    Richard Cheng
    Principal
    Excella Consulting
    schedule 4 days ago
    Sold Out!
    45 mins
    Talk
    Intermediate

    The patterns for implementing Scrum at the team levels have largely been set, but what about dealing with Agile and Scrum across multiple teams. Is the answer just magical words like scaling, or SAFe, or LeSS? What are the core concepts and successful patterns? Is it just one big group hug?

    In this session, we will explore core concepts around implementing Agile concepts across multiple teams. The session starts with a simulation that explores distributing people across teams (which will actually NOT involve any hugging). From there, this session dives into:

    • Prioritization across multiple teams
    • Product Ownership across multiple teams
    • Dependencies and team alignment
    • Communities of Practice
    • Communication and collaboration across teams
    • The role of managers
    • A quick look at scaling methods

    Coming out of this session, attendees will have an understanding of core concepts and fundamental helpful practices in implementing Agile concepts across multiple teams.

  • Liked Brian Sjoberg
    keyboard_arrow_down

    Brian Sjoberg - Let's Sharpen Your Agile Ax ... It's Story Splitting Time

    Brian Sjoberg
    Brian Sjoberg
    Agile Coach
    Excella Consulting
    schedule 6 days ago
    Sold Out!
    45 mins
    Talk
    Beginner

    Do you want to write great User Stories (a.k.a. small features that are part of a product) that provide the vehicle for conversation and confirmation that we build the right thing? Do you struggle with completing stories (of business value) that are potentially shippable within a fraction of an iteration/sprint? During this session we will do a quick refresher on User Story formatting to include Acceptance Criteria. The reason for the refresher is that over the last few years, despite people using User Stories, I have experienced their usage far from the intended purpose.

    After the refresher, we will learn at least 2 techniques for splitting stories in this interactive workshop.

  • Liked Julie Wyman
    keyboard_arrow_down

    Julie Wyman - Multitasking is Evil

    Julie Wyman
    Julie Wyman
    Agile Coach
    Excella Consulting
    schedule 1 week ago
    Sold Out!
    10 mins
    Workshop
    Beginner

    For a long time multitasking has been considered a must-have skill when, in fact, it makes us less productive and more prone to error. But even with plenty of studies and papers supporting that idea, it can be hard to convince managers and stakeholders that we should be taking on less at a time. In this lightning talk, we'll run through one very quick, lightweight simulation (Multitasking is Evil) you can use to help make that case and show that lowering work in progress is the way to go!

  • Liked Jaap Dekkinga,
    keyboard_arrow_down

    Jaap Dekkinga, - Stakeholder involvement (sub title: How do I involve my stakeholders best in an Agile environment?)

    Jaap Dekkinga,
    Jaap Dekkinga,
    Agile coach
    Excella
    schedule 1 week ago
    Sold Out!
    45 mins
    Tutorial
    Beginner

    One of the struggles I have seen when organizations transition to Agile in relation to the Agile principle "Customer Collaboration Over Contract Negotiation" is: When and how do I involve the right customer.

    Goal of this presentation:

    • Provide tools on how to involve different types of stakeholders
    • Tool to identify different types of stakeholders

    In the presentation I will explain the 2 step process of:

    • Step 1: map out the players for a value stream, product, or feature(set) in a simple 2x2 Stakeholders Matrix (influence/power and interest)
    • Step 2: Learn about the tools and techniques to involve players in each quadrant based on their specific strength or opportunity

  • Liked Julie Wyman
    keyboard_arrow_down

    Julie Wyman - Managing Resistance: How the Kanban Method Supports Lasting Change

    45 mins
    Talk
    Beginner

    “Going Agile” is a big cultural change for most organizations and it’s significance, impact, and the effort required for successful implementation can often be underestimated. There are many benefits to be gained by adopting a more Agile approach, including quicker feedback loops, more focus on value, and higher levels of collaboration. However, for Agile to succeed in the long-term it’s essential to set expectations up front and to balance the amount of change with the amount of disruption it will cause. In this session, we will look at how David Anderson intentionally built change management principles into his Kanban Methodology and explore other change management techniques the Agile community can leverage when helping organizations transition to Agile.

  • Liked Brian Sjoberg
    keyboard_arrow_down

    Brian Sjoberg - Understanding the Whole System, Not Just a Part

    45 mins
    Tutorial
    Beginner

    Are your solutions to recurring issues having only minor improvements? Are some of these solutions actually making things worse in the long run? When answering yes to these, typically, we are trying to solve the issues with too narrow a view. Oddly we think we are addressing it at sufficient level but usually not. In order to see the entire picture we need a common language that will enable us to understand an entire complex adaptive system (e.g. organizations, teams, individuals). Join us as we learn a language called System Modeling (aka. Causal Loop Diagrams).

    With this language we will be able to have rich dialogue to gain a full understanding of the entire complex adaptive system so that we can create solutions at the fundamental level and not the symptomatic level. Addressing system issues at the fundamental level will significantly improve the system. Symptomatic solutions may give the appearance of improvement in the short term but typically make things worse in the long run. Unfortunately we usually pick the symptomatic solutions because they seem obvious and we don't realize the long term impacts because of feedback delays that could take weeks, months or even years to realize.

  • Liked Brian Sjoberg
    keyboard_arrow_down

    Brian Sjoberg - Why Are We Going So Slow? ... Time to Get Your Productivity Game On!

    45 mins
    Workshop
    Beginner

    Are you struggling with delivering a potentially releasable working product every iteration? Ever wonder what one of biggest reasons we have difficulty getting things done at the individual, team and organizational level are? Do you keep doing something even though you know it reduces your productivity and lowers quality? We are going to run an exercise that highlights one of the major culprits that you have all experienced and probably continue to experience. The exercise will likely ignite a little (or big) fire in your belly that will help you become more productive and improve the quality of your work. From this, we will discuss ways to improve this at the individual, team and organization levels.

  • Chris Li
    Chris Li
    Founder
    SparkPlug Agility
    schedule 2 weeks ago
    Sold Out!
    45 mins
    Workshop
    Intermediate

    Have you spent a lot of energy and time with your teams focusing on estimation? Do you feel that everyone isn't quite on the same page? There are many challenges on teams who wish to work with an agile mindset, and negative patterns around estimation can have quite the impact on productivity and team morale.

    In this workshop, participants will revisit what a Product Backlog Item represents and exactly what an estimate represents. Using this as a foundation, session participants will learn about four distinct parts of a pattern that repeats itself in organizations who may not have a strong handle on these concepts. The workshop concludes with a lightweight estimation exercise that participants can take back to their organization.

    Having a better understanding of estimation is helpful, and having a simple yet powerful game to compare items relatively to one another will help break your teams of the pattern of misunderstanding the point of backlog item estimation.

  • Paul Boos
    Paul Boos
    IT Executive Coach
    Excella
    schedule 1 month ago
    Sold Out!
    45 mins
    Talk
    Advanced

    So you are considering getting a coach to help you in your transition to Agile. Or perhaps you are an Agile practitioner considering becoming an Agile coach. What do these Agile coaches do? What makes them different?

    This session will enter the foyer of the house that describes what coaches do and considerations one can have when they think about coaching (including hiring one). Prepare to be challenged and to learn a bit of what it takes to be or work with a coach; it has little to do with courses or certifications, though they may help. In covering what coaches do, one can now begin to think along the lines of what the skills one may need to improve.