DevSecOps Metrics
Video Activity
Join over 3 million cybersecurity professionals advancing their career
Sign up with
Required fields are marked with an *
or
Already have an account? Sign In »
Video Transcription
00:00
the lesson 3.3.
00:02
We're gonna talk about def sec up metrics. So it's important to
00:06
be able to measure the impact on the system and also how well you're doing.
00:12
So, Dev Ops very already has their own metrics. So we're gonna look at what we need for security components.
00:19
The lesson objective. Just wanted to find what what needs to be measured. Critique some of the security specific metrics, differentiate between categories and metrics and develop some metrics for def SEC ops Implementation
00:33
the 1st 1 to said Measure and assess securities impact.
00:38
And there's ah, KP. I hear that that they had missed secure software
00:44
development framework defines p 0.4. So is it important that we need to define these key performance indicators?
00:51
What we want to do is the measure to quantify the risk
00:54
track integration impacts Definitely mentioned Devil Party has their own, but we need their own distinct security metrics,
01:02
and we also need to measure the impact. So we want to see how how ah, the metrics for before security components went in there, and then how how they're reacting after where the's security tools are introduced into the pipeline
01:19
So some of the 1st 1 who is lead time Metric said, This is a capacity to respond, change, deliver requested security features.
01:26
And then I'm gonna can go through just a couple ideas of metrics and categories. There's plenty more out there. Just just kind of get you thinking about what you would need for it was implementing def SEC ops in your enterprise.
01:41
We want to look at the average lead time. Which the Delta between acquired running? Look at the velocity for the developers.
01:49
Uh, the cycle time, time to value trends.
01:53
So quick. Question. Just toe jump in.
01:57
Who will use metrics or in the organization when you get these, where where will they be used and for what purpose?
02:07
So I can think of plenty of things, so they're meant to be developers. They maybe look at their own productivity.
02:13
The operations may be looking at the actual deployment
02:17
security. Wigan would be interested in measuring the quality of the code again, the impact on the Dev ops and then the executives are very interested in the impacts how well things were functioning, how well each individual is, how where the system is anything like that
02:37
to some deployment metrics, which is the health of employment process. Leading indicators of the application stability.
02:44
So, again, we re looking at time to deploy maybe how long it takes the new version to get to production, which is a speed, how frequent you can deploy, how long it takes to fix failed releases
02:54
and how often software fails. So the production failure rate. It's another way of naming this
03:01
in the mean time to repair its How fast can threats be mitigated? How fast could services be restored? So these air security specific. So who interested in
03:12
triaging investigating remediated each one of these steps, how long they take
03:16
and then the meantime to recovery? Which is how do we recover from a failure in a production?
03:23
Here's a quick quiz
03:25
in which category of metric is time to triage? Is that lead time deployment or mean time to repair
03:35
part of the first step before investigation and remediation can occur?
03:39
So in this lesson, we talked about integrating depth, stickups, metrics and
03:46
how we would do that. What we interested in measuring and the next lesson will just take a look at how to help developers with security concepts and tools, so providing them what they need to securely write code, and so there's less testing that needs to be done afterwards.
Up Next
Instructed By
Similar Content
