As we have seen from recent reports in the news and elsewhere, cyberattacks come many sources. How can we use Agile practices to improve organization's information security posture?

In this session, Dan and Paul will discuss techniques that can help make information security an important part of software development and speed your response to threats. The use of hardening pipelines, dark stories, and user stories/acceptance criteria that map to policy guidance based on NIST 800-53 controls will be discussed and how each approaches improving your security posture from a different angle.

 
4 favorite thumb_down thumb_up 0 comments visibility_off  Remove from Watchlist visibility  Add to Watchlist
 

Outline/structure of the Session

This talk will cover methods for improving the security posture. The current working outline of the talk is as follows:

Introduction/Speaker background (~2  min)

Describe the problem (~5 min)

Hardening Your System with a CI/CD Pipeline (~15 min)

How NIST 800-53 based controls can be reflected in user stories and acceptance criteria (~7 min)

The use of dark stories to thwart the hacker (~7 min)

Q&A (~5-10 min)

Learning Outcome

In this session, attendees will learn:

  • how the development teams can take advantage of secure server images built using a CI/CD pipeline
  • how security policies can be turned into user stories and/or acceptance criteria
  • how dark stories can reflect potential bad actor behavior and can be used to drive how to thwart this behavior

Target Audience

Technical Managers, Development Team Members, Security Professionals

Prerequisite

A basic understanding of automated testing, continuous integration, and user story concepts would help as these concepts will be discussed, but the basics will be presumed to be known.

schedule Submitted 1 week ago

Comments Subscribe to Comments

comment Comment on this Proposal

  • Rob Myers
    Rob Myers
    schedule 1 week ago
    Sold Out!
    45 mins
    Talk
    Advanced

    Leaders of development teams want to be able to adapt their existing product to innovative ideas and shifting market conditions. This is often the reason organizations "go Agile," yet this flexible ability to deliver rich business value is often frustratingly out of reach.

    Agile teams and their management are also familiar with the value of individual development practices. For example, Test-Driven Development's ability to catch defects early, and to provide the team with the ability to confidently extend the product. What Rob has found by working with a number of teams, each for six months or more, is another much greater--and more rare--source of business value resulting from diligent attention to software craftsmanship and the resulting two-way trust that forms between Development and Product.

    You will hear a handful of surprising (but real) first-person tales, each detailing a time when changing market forces, dramatic pivots, disruptive technological changes, or insightful requests were managed by the delivery team within a single two-week sprint. Each of these "Black Swan User Stories" (Rob's term for powerful, risky, and unforeseen user-stories) resulted in multiplying user productivity, opening whole new markets, or delighting and retaining critical customers.

    What we found in each case was that rapid completion of our Black Swan User Stories was the result of diligent, disciplined application of a few Agile technical practices; and that this resulted in the concrete realization of organizations' long-held expectations for Agile software development.

  • Paul Boos
    Paul Boos
    schedule 2 days ago
    Sold Out!
    45 mins
    Talk
    Advanced

    So you are considering getting a coach to help you in your transition to Agile. Or perhaps you are an Agile practitioner considering becoming an Agile coach. What do these Agile coaches do? What makes them different?

    This session will enter the foyer of the house that describes what coaches do and considerations one can have when they think about coaching (including hiring one). Prepare to be challenged and to learn a bit of what it takes to be or work with a coach; it has little to do with courses or certifications, though they may help. In covering what coaches do, one can now begin to think along the lines of what the skills one may need to improve.

  • Paul Boos
    Paul Boos
    schedule 1 week ago
    Sold Out!
    45 mins
    Workshop
    Intermediate

    Losing good people during your transformation? Getting more resistance than you expected? You may be producing unwanted reactions in the way you are leading your people through change. If you want your Agile transformation firing on all cylinders without the harmful side-effects, people at all levels need to become Catalysts.

    Catalytic leaders help lead continual improvement - change. How can we do that? How can anyone be a leader? This workshop will mix presentation with exercises to help you understand practical things you can do to lead change effectively.

  • Mark Grove
    Mark Grove
    Trent Hone
    Trent Hone
    schedule 2 weeks ago
    Sold Out!
    45 mins
    Workshop
    Intermediate

    Imagine you were hired to provide consulting assistance for a new team just starting out with Kanban. The team has been struggling with their implementation and is looking forward to your expert guidance, support, and advice. It’s your first day and you just walked into the team room to look at their board. You want to make smart observations and thoughtful interpretations so you can have meaningful conversations with the team members. The team starts assembling in the team room for the daily standup and you plan on making some comments afterwards.

    What comments would you make? What thoughtful questions would you ask?

    This interactive presentation provides a detailed look at how to interpret and thoughtfully observe Kanban Boards to better understand the work of your teams. We will start with an overview of the Lean Kanban Method and then proceed through a series of interactive exercises that give you an opportunity to review and interpret various Kanban boards. The exercises will increase your understanding of Kanban systems and provide opportunities to practice interpreting various board setups so you can have thoughtful and meaningful conversations with your teams.

  • Liked Manjit Singh
    keyboard_arrow_down

    What Effective Agile Contracts Look Like

    Manjit Singh
    Manjit Singh
    schedule 5 days ago
    Sold Out!
    45 mins
    Talk
    Intermediate

    The Agile Manifesto has been around for over 16 years. That seems like enough time for organizations to adapt to Agile processes and get the hang of writing Agile contracts. Yet, when it comes time for US Federal Agencies to enter into a contract about Agile work processes and deliverables, we're still seeing Waterfall language persist.

    If we want to see Agile software development contracts that are truly aligned for the best interests of all parties involved, there are a few steps that we need to take. Learn what these steps are in this presentation.

     

  • Liked Art Moore
    keyboard_arrow_down

    LeSS vs SAFe - And the Great Scaling Debate

    Art Moore
    Art Moore
    schedule 1 week ago
    Sold Out!
    10 mins
    Talk
    Intermediate

    (Can do 10 or 45. Title for 10 minutes would be Less vs. SAFe - in 10 Minutes).  Probably few topics in Agile generate more philosophical polarization, strength of opinion, and catch phrases than how to scale Agile, and nothing represents that fact better than comparisons of LeSS and SAFe.  But if we step back and take a dispassionate look - or try to - what do we find at the next level of specifics?  If you sift the data, what are key differences in terms of practice and structure, and the two or three key differences in principles or philosophy that drive them?  What shakes out.  And - what we rarely or ever dwell on - what is the same or similar about them, and what if anything can we learn from that?  These are the questions we look at and results we share in this presentation.  

  • Liked Beth Hatter
    keyboard_arrow_down

    Who am I now? - Exploring the Role of Managers in an Agile World

    Beth Hatter
    Beth Hatter
    schedule 1 week ago
    Sold Out!
    45 mins
    Talk
    Beginner

    In the latest "State of Agile" report lack of management support was still near the top of the list in what stalls or even derails successful agile adoptions. Managers are often confused on exactly what their role should be and how to transition from a 'project management' mindset to 'agile support' mindset. In my experience - as a former project manager turned agile support leader and now training/coaching agile teams - I have found managers need, but often don't receive, support and guidance on how to avoid being a suck of overhead dollars and a burden to a team - but instead focus on growing their people and modeling Lean culture while still performing important and necessary corporate or compliance functions. 

     

  • Liked Beth Hatter
    keyboard_arrow_down

    Addressing Growing Pains - Supporting Agile Culture while Scaling

    Beth Hatter
    Beth Hatter
    schedule 1 week ago
    Sold Out!
    45 mins
    Talk
    Beginner

    In my experience working with larger agile programs in the Federal government, it has been challenging at times to support an agile culture when scaling across multiple teams.  Having several teams means agile practices often have to change slightly from team level practices, and maintaining the agile culture while supporting self organizing teams becomes a fine line.  There is a need for teams to maintain their own style and approach while sharing common language and some processes and understandings across several teams.  This talk will examine how to use team kickoff training, such as SAFe for Teams, and early coaching opportunities to create the shared thoughts and behaviors to build an agile culture.

  • Liked Julie Bright
    keyboard_arrow_down

    Powerful Tools for Affecting Change: Personal and Social Identity

    Julie Bright
    Julie Bright
    schedule 1 month ago
    Sold Out!
    45 mins
    Talk
    Intermediate

    Scrum Masters and Agile Coaches wear many hats, but one of the most important is that of the Change Artist.  Understanding what people need in order to move through a change curve is critical to success, but often overlooked in the toolkit is the role of Identity.  Our self-perception, both as individuals and within the context of a group, is foundational to our psychology, and can be leveraged to affect and nurture powerful, long-lasting change.   

  • Liked Daniel Davis
    keyboard_arrow_down

    So You Want To Go Faster?

    Daniel Davis
    Daniel Davis
    schedule 6 days ago
    Sold Out!
    45 mins
    Talk
    Beginner

    How frequently does a good agile team deploy to production? Not every team is capable of deploying "on every commit". What does it take for a team to even start deploying at the end of each sprint, or each week, or each day?

    Most companies don't realize that deploying more frequently often requires both significant technical change as well as cultural change. In this talk, I'll guide you through what it takes to deploy more frequently, both from the technical side of setting up pipelines as well as the organizational side of removing red tape. I'll draw on the unique challenges that teams must overcome at each step of the way, from deploying once a month all the way down to full continuous delivery. If your team has been struggling to go faster, come see how you can change to get there. And if you already are at full continuous delivery, come see how to go even faster than that!

  • Liked Daniel Davis
    keyboard_arrow_down

    Everything Object Oriented Design Taught Me About Leadership

    Daniel Davis
    Daniel Davis
    schedule 1 week ago
    Sold Out!
    45 mins
    Talk
    Beginner

    Most senior software developers eventually find themselves in a position of leadership. About two years ago, I was in the same boat, being asked to take over as tech lead for a large agile project. I felt unprepared, I didn't know the first thing about being in charge! I found myself falling back to the thing I had spent years learning: object-oriented design principles.

    In this talk, I'll walk through some of the parallels between clean coding and leadership. I'll discuss some design anti-patterns with different styles of leadership and how to avoid falling into classic management traps. If you've always felt like your bosses treat you like a class with too many responsibilities, come learn how to code better leadership!

  • Liked JENNIFER M FORREST
    keyboard_arrow_down

    Jira 101

    JENNIFER M FORREST
    JENNIFER M FORREST
    schedule 2 days ago
    Sold Out!
    45 mins
    Talk
    Beginner

    This session is for newbies to JIRA who want to learn how to survive (and thrive!) using JIRA every day. We'll be walking through a variety of real projects in JIRA and you'll come away with a better basic understanding of the tool.