James Wickett, from Gauntlt core team, gave a tutorial at Velocity Conf London about integrating security testing in the continuous integration cycle for early feedback on application security level. James stressed the importance of regularly checking for security as release delivery rates increase with continuous delivery.
Enterprises that are adopting agile organizational-wide will at some time have to scale their agile practices. In a session at the Agile Methods in the Finance Sector and Complex Environment conference, attendees shared their experiences with scaling agile in enterprises.
To enable development of secure products, processes covering the software development life cycle have to include security activities. Winfried Russwurm from Siemens and Peter Panholzer from Limes Security facilitated a workshop at the SEPG Europe 2013 conference where they explored security activities and presented the Application Guide for Improving Processes for Secure Products.
Projects and product development is one long series of difficult decisions, says Pascal Van Cauwenberghe. Real Options can help you to take the right decision at the right time, even under difficult circumstances. At the Agile Tour Brussels conference, Pascal presented stories of his experiences with using real options in decision taking.
Frank Breedijk, security officer at Schuberg Philis, talks about the friction points between security and DevOps and how to collaborate to avoid them. Examples include automating security tests and environments, reducing scope of security audits to relevant system components only or allowing security fixes to jump the queue of changes to production.
The first day of DevOps Days Amsterdam had its focus split between continuous delivery and promoting a DevOps culture. Talks focused on how to automate the deployment pipeline but also system recovery in case of failure. On the culture side leveraging distinct personality types to successfully introduce changes and the positive impact of strong company culture on hiring were some of the takeaways.
IEEE announced that the Hans Karlsson Standard Award 2012 has been given to Paul R. Croll for dedicated leadership of the IEEE Systems and Software Engineering Standards Committee, and for his diplomacy and collaboration in facilitating the development of a collection of high-quality standards.
Should software development look to finance for planning risk and uncertainty? That question recently surfaced in a debate about the “Last Responsible Moment” decision making practice in agile software development. This article covers some recent trends and debate around using finance concepts for risk management and planning in software development.
Clive Gee, an experienced IBM SOA Practitioner, describes how IT securing the networks has evolved into what he refers to as Information risk management. As the collaboration space increases with application integration and service oriented systems, he examines the risk management of the increased the surface area of threats and vulnerability.
Web application security testing and assessment should include both security code review and penetration testing techniques. Dave Wichers, an OWASP Board Member, spoke at the recent AppSec DC 2010 Conference about the pros and cons of code reviews and penetration testing approaches in finding security vulnerabilities in web applications.
Irrespective of the size of the project, stakeholders feel confident when they can a keep track of the risks and their mitigation strategies. Agile heavily promotes the use of information radiators. Keeping in line with the philosophy of radiators, Agilists suggested different ways of depicting risks visually for easy tracking and mitigation.
Real Options, a decision-making process based on Financial Option mathematics, was mentioned by Kent Beck in his 1999 "white book," Extreme Progamming Explained. More recently, Agilists have been exploring how Real Options intersects with Agile. Now Chris Matts and Olav Maassen specifically address the Lean Software community, proposing that application of Real Options improves Lean Development.
Risk management is an activity directed towards the assessing, mitigating and monitoring of risks. Agilists suggest ways to effectively manage risk and use it to make better commitments to the stakeholders.
Software development is Hard. One of the main reasons is that it is a complex adaptive system. Agile - when done right - seems to do a very good job of providing stabilizing feedback. We take a look at what it means for something to be a 'complex adaptive system' and what particular practices in Agile help us out.
Risk management deals with reducing the probability and impact of adverse events on a project. Members of the Agile community discuss whether explicit risk management is required or it is addressed implicitly as a part of Scrum.