Securing your pipes with a TACO
TACO is an acronym I use with clients to help them map controls from their software delivery pipelines to the organizational controls.
TACO stands for Traceability, Access, Compliance, and Operations.
The approach consists of a base list of 25 automatable controls that are documented and the control activity, artifacts and SOR identified. After mapping how these controls are handed we map them to the organizational controls and identify any gaps.
This model allows for the creation of opinionated pipelines and helps create a common understanding across teams as to what is required in order to be secure.
Taking a TACO approach can be considered a part of implementing a DevSecOps program and I’ve used this approach at multiple banks. I’ve given the base talk at three conferences and multiple times to internal teams. It helps build organizational confidence in the automation of software delivery.
During the talk, I’ll run through the different categories of controls, how they are implemented, what the purpose of them is, how to create robust feedback loops for controls such as SAST and how to handle long-running processes such as DAST.
Content is fairly high level but I can dig into specifics of each given area as questions arise.
Outline/Structure of the Talk
- Introduction - 5 minutes
- Problem description - 10 minutes
- Walkthrough and examples of using TACO - 15 minutes
- Wrap and conclusion - 5 minutes
- Q&A - 5 minutes
Learning Outcome
- How to create a common understanding of what a continuous delivery software pipeline looks like for you
- How to overcome common barriers when dealing with security and compliance teams
- How to deal with security vulnerabilities across legacy codebases
Target Audience
People with an interest in how to secure pipelines and meet the governance demands of highly regulated environments.
Prerequisites for Attendees
Having a base understanding of DevOps principals and tools would be valuable
Video
Links
I have given this talk at Agile2018, GOAT 2018, Agile and Beyond 2019 and SecTor 2019. I've also given this talk internally at companies many times to audiences up 150 people.
The most recent of those is here: Sector presentation link
There is a blog on this topic here: https://www.xodiac.ca/2018/11/28/satisfying-controls-at-speed.html
schedule Submitted 2 years ago
People who liked this proposal, also liked:
-
keyboard_arrow_down
Steve Pereira / Donald Phillips - Break Through Workflow Bottlenecks with Value Stream Mapping
60 Mins
Workshop
Beginner
Stop driving on the sidewalk!
In software development and delivery, it sometimes feels like we're perpetually stuck behind a slow-moving vehicle. Sometimes we can easily go around, and sometimes we can't see what's really holding us up. In our experience, many teams are barely peeking over the steering wheel! Our workshop is aimed at sharing a technique that will help you arrive at faster, safer, and happier - whether you're stuck in a ditch or cruising the highway.
This workshop will introduce a simple method you can use to discover, define and communicate risks and opportunities affecting your teams. Even better, you can use it regardless of what team, department or silo you find yourself in. We'll examine visual representations of valuable data you can use to have productive conversations, make confident decisions, and align towards making real progress.
Takeaways:
- How to create a collaborative Value Stream Map
- How to use Value Stream Maps to find and diagnose workflow bottlenecks
- How to build actionable, data-driven maps that make the path clear to everyone
- How to use maps to target your improvement and automation efforts where you need them mostTackle complexity, friction and waste in a few hours with a versatile and actionable mapping technique.
Not only will you see dramatically improved alignment and collaboration, but you can do it all remotely with free tools.
We'll show you how with the right map, you can be 20% better tomorrow.
-
keyboard_arrow_down
Dave Sharrock - What can we learn about our Agile Transformations from Wardley Maps
60 Mins
Workshop
Intermediate
After over a decade of agile transformations, many organizations have several years experience of agile and are naturally looking for signs that the change is complete. Attention turns to the level of skill or maturity an organization needs in order to declare the transformation a success. As a result, models of agile maturity have emerged that promise to somehow measure how agile you are.
The good news is that agile, by definition, should be iteratively delivering value from the moment a transformation starts. Looking back, your ability to deliver has already changed immeasurably. You are already faster, more focussed, and delivering a product with higher quality. The bad news is that you have only just started your journey. Change itself has changed, as Gary Hamel said. What looks mature today will be table stakes tomorrow.
We will talk about what agile maturity looks like today, and where agile maturity will go in the future. We will learn how iterative value delivery is the price to pay to move along the experience curve. The more frequently you deliver value, the faster you move along the experience curve. By introducing a Wardley Maps in the context of business agility, you will be able to map out the path of your transformation, filling in any gaps that you may have, and beginning to understand what direction your transformation may take you in the future. Specifically, you can identify the drivers needed to reap the benefits along the way, rather than at some mythical end point. Business agility is not a destination but a continually evolving journey. Learn how to enjoy the journey rather than long for the destination.
-
keyboard_arrow_down
Steve Pereira - Value Stream Mapping: See Where You're Going By Starting Where You Are
40 Mins
Experience Report
Intermediate
This experience report details my 2019 involvement with 3 organizations of 3 different sizes (small startup, small-to-medium enterprise, and giant enterprise) to illustrate how I've used a form of Value Stream Mapping to help them define their current state and leverage data collected in the process to confidently identify (often surprising) risks and opportunities.
-
keyboard_arrow_down
Peter Maddison - Applied Coaching Practices
40 Mins
Talk
Beginner
This talk is about my journey to become an ICF certified coach and how I apply those skills both to my role as a strategy consultant and business leader.
Coaching is a powerful discipline that differs from mentoring, teaching and consulting. Applied correctly it can help you have better, more powerful conversations and allow you to overcome difficult challenges.
I'll talk through the skills what I learned and where they align and differ from Agile coaching practices. I'll talk to the most powerful tools I learned that I now apply to all my work such as logical levels. Throughout this, I'll do a couple of simple exercises for the audience to take with them and use.
These skills are valuable to people at every level of the organization and equally, can be applied to all aspects of your life.
-
keyboard_arrow_down
Steve Pereira - Navigating Dev and Delivery Improvement with Maps and Compasses
40 Mins
Talk
Intermediate
How to Navigate Software Delivery With Confidence
Too many organizations rely solely on "Compasses" like specific metrics, principles and reference companies (being more like Spotify) instead of pairing that reference with "Maps" of where you are right now, and what surrounds you. I'll introduce some of my favourite maps: Value Stream, Dependency and Capability Maps, and how to use them to move with confidence towards your compass target.
Takeaways:
- How Value Stream, Capability and Dependency Maps help visualize and share what's between you and where you want to go
- How to pair Compasses with Maps to drive progress in the right direction
- Clear examples of data-driven maps that make the path clear to everyone -
keyboard_arrow_down
Peter Monkhouse - Projects Deliver Products, Products Deliver Strategy
40 Mins
Experience Report
Intermediate
Organizations and products are failing at an alarmingly high rate in today’s challenging markets. It is more important than ever that we are able to implement our strategy as effectively as possible. But this is not the full story, for an organization to achieve its strategic objectives, we need great products that continuously deliver value to their customers.
This webinar will introduce the strategy implementation circle showing the role of products in support of an organization implementing strategy. The webinar will highlight the need for organizations to use an iterative approach to product development and strategy execution. The approach will be supported by a successful example and case study as well as by constant reference to the relationship between products and projects, and product owners/managers and project managers.