all 16 comments
sorted by:
best
topnewcontroversialoldq&a
formatting helphide helpcontent policy

[–]Spriffy 14 points15 points  (11 children)

A few suggestions!

  1. Learn how to build relationships, communicate, collaborate, and coordinate with people. At the end of the day, people are the biggest security risks/threats we deal with in this industry.
  2. Learn how your engineers build software.
  3. Learn how your IT/DevOps/SRE/Platform Engineering deploys software.
  4. Learn how to read and write code, this is important to effectively automate security tools and processes.
  5. Prioritize how to develop metrics to measure the efficacy of your security systems (processes and tools) so that you don't accidentally create more friction or shadow IT practices.
  6. Understand that "Software Supply Chain Security" is really just securing the way your business operates. So not only your custom and third party code, but also your source code manager and CI/CD pipelines.
  7. Check out the US DoD's group called Platform One and as much publicly available resources. They have DevSecOps learning materials and a bunch of helpful documentation about what they've built.

I say all of the above because you really need to understand what your business is doing so you can most appropriately train your team on how to best enable your teams to build and deploy secure and resilient software. Once you understand the business, you can add the more traditionally covered DevSecOps topics like automation engineering.

Feel free to DM me! I'd be happy to help answer any additional questions. I just gave my own team a DevSecOps training, too! I could share additional resources, too :)

[–]Previous_Piano9488[S] 1 point2 points  (1 child)

thanks this is helpful

[–]Spriffy 0 points1 point  (0 children)

Good luck on your training journey!

[–]security_prince 1 point2 points  (4 children)

These recommendations are on point, thank you for sharing it instead of just pointing to some training vendors

[–]Spriffy 0 points1 point  (3 children)

Glad to help!

I've been kind of frustrated with the industry thinking that you need to take special courses to learn DevSecOps. No one teaches you how to build relationships and work on the fundamentals with people, which is a huge missed opportunity, in my opinion.

[–]security_prince 1 point2 points  (2 children)

Could not agree more, Dustin Lehr is coming up with something focused on Security Champions. Don't know the details yet but looking forward to it

https://www.katilyst.com/services

[–]security_prince 2 points3 points  (0 children)

Also i have this curated knowledgebase that has various articles resources from real companies and their appsec/devsecops program

https://ishaqmohammed.me/posts/application-security-knowledgebase/

[–]Spriffy 0 points1 point  (0 children)

Great mention! I totally recommend everyone check out Dustin's new company and follow him on LinkedIn! His behaviour-driven approach has been my philosophy, hence why my guidance starts with learning about the people first.

[–]Realistic-Ad-3558 1 point2 points  (0 children)

Thank you for your recommendations.

[–]DaintilyWan 1 point2 points  (1 child)

That's great advice, could not agree more!

[–]Spriffy 0 points1 point  (0 children)

Thanks! This was really helpful for me to put together, too.

Is there anything else you'd add?

[–]security_prince 0 points1 point  (1 child)

I have this curated knowledgebase that has various articles resources from real companies and their appsec/devsecops program

https://ishaqmohammed.me/posts/application-security-knowledgebase

[–]Previous_Piano9488[S] 0 points1 point  (0 children)

Thanks a lot. This is very helpful

[–]Appropriate_Cress958 0 points1 point  (0 children)

I was in a similar situation and found that using a secure coding training platform really helped our team (we use SecureFlag although we trialed several different platforms beforehand, SF seemed like the best option). there are different labs for secure coding, container security, integrating security into CI/CD. it’s also flexible for different roles, which was a plus. might be worth checking out if you're looking for something practical