Secure DevOps (DevSecOps)

**What is this session about?**
Today IT security is not something we care about after the system has been released but instead, we must build security into our products and processes. We need to think about security when we write code to avoid exposing attack surfaces, we need to carefully assess the modules we base our solutions on, and we need to make sure we continuously inspect the result of the security analysis.

Last time we looked at the software development lifecycle and how we can automate the process using Azure DevOps and GitHub. This time we are going to extend the process to include security practices to limit the risk of introducing vulnerabilities in the product we build and release.
If you have missed the previous session, you can view it **[HERE](https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.youtube.com%2Fwatch%3Fv%3DYPYMZsX7Bnk&data=05%7C01%7Cv-yaelnegrea%40microsoft.com%7Cd1ae7f861f2c4aa6269d08daf7df776a%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C638094837688494865%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=xh2DlGJEd%2B14QpKIvtRPM1HA4MdecINNMa0b%2B2tVXdE%3D&reserved=0).**

**The topics covered are:**
– What is DevSecOps?
– Secure development practices
– Static code scanning for vulnerabilities using GitHub
– Dynamic security analysis using OWASP
**Start Learning now / Event Resources:**
[https://aka.ms/Secure_DevOps1](https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Faka.ms%2FSecure_DevOps1&data=05%7C01%7Cv-yaelnegrea%40microsoft.com%7Cd1ae7f861f2c4aa6269d08daf7df776a%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C638094837688494865%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=5rch%2B7WNTLV9w4GRDNaoTWEfVFgWl2pALHiKtcCuaGo%3D&reserved=0)
[https://aka.ms/owasp-and-dynamic-analyzers](https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Faka.ms%2Fowasp-and-dynamic-analyzers&data=05%7C01%7Cv-yaelnegrea%40microsoft.com%7Cd1ae7f861f2c4aa6269d08daf7df776a%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C638094837688494865%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=3XSZhDDkaUSGROQUsKANEdwmGdt%2BvBSIPTgEJcnCZdY%3D&reserved=0)
[https://aka.ms/Static-analyzers](https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Faka.ms%2FStatic-analyzers&data=05%7C01%7Cv-yaelnegrea%40microsoft.com%7Cd1ae7f861f2c4aa6269d08daf7df776a%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C638094837688494865%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=eJlHq0U%2FfgegpAdjRzD9c%2FlBvxsVqfBeh%2B707vArn%2Fo%3D&reserved=0)

**Speakers' info:**
**Mathias Olausson** is the CTO and co-founder of Solidify, an expert consulting company focusing on helping companies improve their engineering skills. Mathias is a Microsoft MVP, Microsoft ALM Ranger and has published several books on development practices using Visual Studio and VSTS. As a hobby Mathias like to contribute to community add-ons for Visual Studio and VSTS, including the Test Case Explorer.
Mathias is a regular speaker at conferences and runs the Swedish Microsoft ALM and DevOps meetup.

**Magnus Timner** is the VP and partner at Solidify AB, Sweden. He is a Cloud and DevOps consultant, as well as a Microsoft Developer Technologies MVP.