location_city Toronto schedule Nov 6th 11:00 - 11:40 AM EDT place Lake Winnipeg people 1 Interested

TACO is an acronym I use with clients to help them map controls from their software delivery pipelines to the organizational controls.

TACO stands for Traceability, Access, Compliance, and Operations.

The approach consists of a base list of 25 automatable controls that are documented and the control activity, artifacts and SOR identified. After mapping how these controls are handed we map them to the organizational controls and identify any gaps.

This model allows for the creation of opinionated pipelines and helps create a common understanding across teams as to what is required in order to be secure.

Taking a TACO approach can be considered a part of implementing a DevSecOps program and I’ve used this approach at multiple banks. I’ve given the base talk at three conferences and multiple times to internal teams. It helps build organizational confidence in the automation of software delivery.

During the talk, I’ll run through the different categories of controls, how they are implemented, what the purpose of them is, how to create robust feedback loops for controls such as SAST and how to handle long-running processes such as DAST.

Content is fairly high level but I can dig into specifics of each given area as questions arise.

 
 

Outline/Structure of the Talk

  • Introduction - 5 minutes
  • Problem description - 10 minutes
  • Walkthrough and examples of using TACO - 15 minutes
  • Wrap and conclusion - 5 minutes
  • Q&A - 5 minutes

Learning Outcome

  • How to create a common understanding of what a continuous delivery software pipeline looks like for you
  • How to overcome common barriers when dealing with security and compliance teams
  • How to deal with security vulnerabilities across legacy codebases

Target Audience

People with an interest in how to secure pipelines and meet the governance demands of highly regulated environments.

Prerequisites for Attendees

Having a base understanding of DevOps principals and tools would be valuable

Slides


Video


schedule Submitted 2 years ago

  • 60 Mins
    Workshop
    Beginner

    Stop driving on the sidewalk!

    In software development and delivery, it sometimes feels like we're perpetually stuck behind a slow-moving vehicle. Sometimes we can easily go around, and sometimes we can't see what's really holding us up. In our experience, many teams are barely peeking over the steering wheel! Our workshop is aimed at sharing a technique that will help you arrive at faster, safer, and happier - whether you're stuck in a ditch or cruising the highway.

    This workshop will introduce a simple method you can use to discover, define and communicate risks and opportunities affecting your teams. Even better, you can use it regardless of what team, department or silo you find yourself in. We'll examine visual representations of valuable data you can use to have productive conversations, make confident decisions, and align towards making real progress.

    Takeaways:
    - How to create a collaborative Value Stream Map  
    - How to use Value Stream Maps to find and diagnose workflow bottlenecks  
    - How to build actionable, data-driven maps that make the path clear to everyone  
    - How to use maps to target your improvement and automation efforts where you need them most  

    Tackle complexity, friction and waste in a few hours with a versatile and actionable mapping technique.

    Not only will you see dramatically improved alignment and collaboration, but you can do it all remotely with free tools.

    We'll show you how with the right map, you can be 20% better tomorrow.

  • Dave Sharrock
    keyboard_arrow_down

    Dave Sharrock - What can we learn about our Agile Transformations from Wardley Maps

    Dave Sharrock
    Dave Sharrock
    Founder & CEO
    IncrementOne
    schedule 2 years ago
    Sold Out!
    60 Mins
    Workshop
    Intermediate

    After over a decade of agile transformations, many organizations have several years experience of agile and are naturally looking for signs that the change is complete. Attention turns to the level of skill or maturity an organization needs in order to declare the transformation a success. As a result, models of agile maturity have emerged that promise to somehow measure how agile you are.

    The good news is that agile, by definition, should be iteratively delivering value from the moment a transformation starts. Looking back, your ability to deliver has already changed immeasurably. You are already faster, more focussed, and delivering a product with higher quality. The bad news is that you have only just started your journey. Change itself has changed, as Gary Hamel said. What looks mature today will be table stakes tomorrow.

    We will talk about what agile maturity looks like today, and where agile maturity will go in the future. We will learn how iterative value delivery is the price to pay to move along the experience curve. The more frequently you deliver value, the faster you move along the experience curve. By introducing a Wardley Maps in the context of business agility, you will be able to map out the path of your transformation, filling in any gaps that you may have, and beginning to understand what direction your transformation may take you in the future. Specifically, you can identify the drivers needed to reap the benefits along the way, rather than at some mythical end point. Business agility is not a destination but a continually evolving journey. Learn how to enjoy the journey rather than long for the destination.

  • Steve Pereira
    Steve Pereira
    Founder
    Visible
    schedule 2 years ago
    Sold Out!
    40 Mins
    Experience Report
    Intermediate

    This experience report details my 2019 involvement with 3 organizations of 3 different sizes (small startup, small-to-medium enterprise, and giant enterprise) to illustrate how I've used a form of Value Stream Mapping to help them define their current state and leverage data collected in the process to confidently identify (often surprising) risks and opportunities.

  • Peter Maddison
    keyboard_arrow_down

    Peter Maddison - Applied Coaching Practices

    Peter Maddison
    Peter Maddison
    CTO
    Xodiac
    schedule 2 years ago
    Sold Out!
    40 Mins
    Talk
    Beginner

    This talk is about my journey to become an ICF certified coach and how I apply those skills both to my role as a strategy consultant and business leader.

    Coaching is a powerful discipline that differs from mentoring, teaching and consulting. Applied correctly it can help you have better, more powerful conversations and allow you to overcome difficult challenges.

    I'll talk through the skills what I learned and where they align and differ from Agile coaching practices. I'll talk to the most powerful tools I learned that I now apply to all my work such as logical levels. Throughout this, I'll do a couple of simple exercises for the audience to take with them and use.

    These skills are valuable to people at every level of the organization and equally, can be applied to all aspects of your life.

  • Steve Pereira
    keyboard_arrow_down

    Steve Pereira - Navigating Dev and Delivery Improvement with Maps and Compasses

    Steve Pereira
    Steve Pereira
    Founder
    Visible
    schedule 2 years ago
    Sold Out!
    40 Mins
    Talk
    Intermediate

    How to Navigate Software Delivery With Confidence  

    Too many organizations rely solely on "Compasses" like specific metrics, principles and reference companies (being more like Spotify) instead of pairing that reference with "Maps" of where you are right now, and what surrounds you. I'll introduce some of my favourite maps: Value Stream, Dependency and Capability Maps, and how to use them to move with confidence towards your compass target.  

    Takeaways:
    - How Value Stream, Capability and Dependency Maps help visualize and share what's between you and where you want to go  
    - How to pair Compasses with Maps to drive progress in the right direction  
    - Clear examples of data-driven maps that make the path clear to everyone  

  • Peter Monkhouse
    keyboard_arrow_down

    Peter Monkhouse - Projects Deliver Products, Products Deliver Strategy

    Peter Monkhouse
    Peter Monkhouse
    Principal
    MonkArt
    schedule 2 years ago
    Sold Out!
    40 Mins
    Experience Report
    Intermediate

    Organizations and products are failing at an alarmingly high rate in today’s challenging markets. It is more important than ever that we are able to implement our strategy as effectively as possible. But this is not the full story, for an organization to achieve its strategic objectives, we need great products that continuously deliver value to their customers.

    This webinar will introduce the strategy implementation circle showing the role of products in support of an organization implementing strategy. The webinar will highlight the need for organizations to use an iterative approach to product development and strategy execution. The approach will be supported by a successful example and case study as well as by constant reference to the relationship between products and projects, and product owners/managers and project managers. 

help