DevSecOps: Breaking Out of the Silo

00:05 Hello, and welcome to SYNAC Unplugged. I'm your host, Blake Thompson Hoyer, head of communications here at SYNAC. And joining me today is none other than Josh Mason, who is a solutions architect in the federal space here. Josh, welcome to Unplugged. Thanks for having me, Blake. We're gonna jump right into a conversation about DevSecOps. And in particular, this, old expression I've heard, a one ten, one hundred rule of, of of production. Can you tell me a little more about Yeah. So classically, in any sort of manufacturing or production,

00:35 there are several stages. There's the create like, the planning, the creation, and then once something's out in the world. Now when you have to go and fix a problem in that that system, there is a price that goes along with it. If you can solve the problem back in the planning stage, it's gonna be your cheapest fix because then you go you don't have to change any machining. You don't have to change any coding. You don't have to change anything that, like, is more than just written on paper and ideas.

01:06 Once you get into starting to build something, starting to code a program, Then if you find any issues, it has to be fixed as an idea and you actually have to fix whatever it is, the the defect in the code, in the manufacturing, wherever. Once something's out in the world, that price ten times increases. Where now you have to pull things back. There's other infrastructure there. And then you have to go through the whole process again to get it to a fixed state in cyber and in

01:37 software development. If we test something in production, the cost to fix it is gonna be super high, which is why so many people look at left of boom solutions where if you bring that testing into the development stage or even utilizing testers as part of the planning, you can make your solutions a lot cheaper. So it's interesting. You know, Synack, obviously, we're a pen testing company. We have penetration testing as a service. We are typically testing more on that production level. How do you bridge that gap?

02:07 How do you take insights from production, bring them back to development teams, maybe help some of those dev sites from production, bring them back to development teams, maybe help some of those DevSecOps folk along the way? How would you go about bridging that culture gap in between development, just wanting to push out product and security, wanting to find those vulnerabilities, fix them, maybe prevent them from occurring in the first place? Place. Yeah. Often in in house security, they've got their their role. And, traditionally, so many organizations end up siloed, and cybersecurity or security in general rests on its own. If security is able to mesh and help,

02:37 reach out and try to add value at earlier stages, because if people understand code, then they might be able to plug in and help not just find security bugs, but other bugs and quality assurance type issues and add some value earlier into the process. And if they've gone through that training, they probably also understand a bit bit of the planning. So in that organization, if they can tune in and be brought in even earlier and add some value there and try to help fix those problems in the organization.

03:08 They're not just saving the company money, but hopefully helping people have less stress and get to their final product easier. With external testers, there is the ability to start touching things while they're still in the production environment before they've gone public. And with certain missions or, getting a hacker perspective, you could actually move that even further left and have someone look at source code or be brought in during the planning process if there isn't someone in house to do that.