BEGIN:VCALENDAR
VERSION:2.0
PRODID:-//DevOpsChat//Events//EN
CALSCALE:GREGORIAN
METHOD:PUBLISH
BEGIN:VEVENT
UID:01a1989d-2cc9-7376-9b27-0f3e5fe0d1b9@www.devopschat.co
DTSTAMP:20261106T124658Z
DTSTART:20220906T140000Z
DTEND:20220906T150000Z
SUMMARY:DevOps Monthly Online: Shift Security Left with Policy as Code
DESCRIPTION:Agenda:\n• 5:00 PM - Check in and hang out\n• 5:05 PM - Lea
 n Coffee Chat/Presentation\n• 5:25 PM - Lean Coffee Chat/Q+A\n• 5:55 P
 M - Wrap up\, Next month\n• 6:00 PM - Adios!\n\nAcross all organizations
 \, IT departments have been delivering infrastructure to support the busin
 ess\, in one way or another. Initially\, on-premise infrastructure was the
  rule and IT departments were stuck with hardware procurement\, device and
  network maintenance\, physical security of data centres\, and the list go
 es on.\n\nWith the advent of the cloud\, many businesses started their “
 Cloud Transformation” journey\, migrating\ntheir workloads to data centr
 es no longer owned by the company\, but by the public cloud provider\, who
  became responsible for absorbing all the above-mentioned infrastructure c
 osts and responsibilities.\n\nWith the Cloud\, Infrastructure as Code (IaC
 ) slowly became the best practice for how IT Cloud Architects deploy and m
 anage their infrastructure. As the opportunity to create hyper scale infra
 structures increases with automation\, it also brings more challenges in t
 erms of testing and asserting compliance with benchmarks such as ISO 27000
  series\, CIS\, HIPPA\, PCI\, GDPR\, among others. A misconfigured asset p
 rovisioned in bulk using automation propagates across fleets\,\nsignifican
 tly increasing the attack surface. While the public cloud providers delive
 r overall cost benefits\, the overall security posture of the business can
  dramatically impact the ROI of moving to the cloud.\nGartner states that 
 95 percent of all security breaches are due to misconfigurations\, and tho
 se mistakes cost companies nearly $5 trillion in between 2018 and 2019 alo
 ne.\n\nChief Information Security Officers (CISOs) responsible for the ove
 rall security posture of their organizations implement policies\, track no
 n-conformity and trigger actions for architects to apply fixes to address 
 vulnerabilities. In many cases\, there is a lot of custom tooling created 
 for the purpose to support this workflow:\n\nIT Cloud Architect/Developer 
 answers a series of questions about their infrastructure.\n\nAnswers are a
 ssessed (automatically or not) by the CISO.\n\nCISO initiates the remediat
 ion for nonconforming controls\, based on the answers provided\, which may
  or may not be the same as the infrastructure that’s been provisioned.\n
 \nIT Cloud Architect tackles the remediation work and provides evidence of
  conformity back to the CISO for approval.\n\nThis manual process can be v
 ery lengthy\, cumbersome and more often than not\, does not meet the busin
 ess objectives at any level. We must bridge the gap between CISO and Produ
 ct teams to ensure an organization’s software development and delivery p
 rocesses are not negatively impacted.\n\nIn this talk we will discuss the 
 role of Policy as Code (PaC) in the creation of Infrastructure as Code (Ia
 C)\, which is one way to shift security left and close the gap between the
  CISO and the Product\nteams. PaC best practices and tooling can bridge th
 e gap by guaranteeing compliance with established control benchmarks such 
 as CIS\, or even custom internal policies\, with continuous assessment of 
 the\ninfrastructure assets.\n\n**Speaker:** Rafael Battesti\n\nAs a hybrid
  IT professional\, the scope of Rafael's work extends over the entire SDLC
 \, from requirements specifications\, design and development of software s
 olutions for the enterprise data pipeline\, data operations and quality as
 surance.\n\nAfter experimenting Web Development by getting involved in sma
 ll projects\, his career in IT took a different direction as Software Test
  Technician\, applying manual test techniques on Motorola Android© device
 s. Tests included functional\, regression and exploratory. Studying for th
 e ISTQB Certified Software Tester credential\, achieved a few months later
 \, provided him a good theoretical knowledge about testing and the importa
 nce of a good QA strategy to reduce costs\, risks and time to market.\n\nI
 mmigrating to Canada gave Rafael the unique opportunity to achieve a high 
 honours diploma in Computer Systems Technology – Computer Programmer at 
 Sheridan College\, while working as a tutor an helping fellow students eng
 age in good coding standards\, computational thinking\, debugging techniqu
 es and acting as a Git evangelist.\n\nRafael's LinkedIn: https://www.linke
 din.com/in/rafaelbattesti/?originalSubdomain=ca\n\nJoin our Slack: ​​h
 ttps://vzbl.io/devopstoslack\nIf you'd like to be a speaker: https://bit.l
 y/speakatdevopsto\nIf you'd like to sponsor a meetup: steveelsewhere [ at 
 ] gmail.com\n\nhttps://www.devopschat.co/meetings/devops-monthly-online-sh
 ift-security-left-with-policy-as-code
URL:https://www.devopschat.co/meetings/devops-monthly-online-shift-security
 -left-with-policy-as-code
END:VEVENT
END:VCALENDAR