Kayra Otaner -- DevSecOps

Kayra Otaner joins the podcast today to discuss DevSecOps and answer the question, is it dead? Kayra is the Director of DevSecOps at Roche and is highly involved in the DevSecOps community. Kayra states that DevSecOps in its traditional form is “dead” and that each organization should approach its needs based on their size. Otaner introduces the concept of "security as code" and "policy as code" as more effective approaches, where security functions are codified rather than relying on traditional documentation and checklists. Finally, they discuss the emergence of Application Security Posture Management (ASPM) tools as the "SIM for AppSec," suggesting these tools, especially when enhanced with AI, could help manage the overwhelming number of security alerts and issues that currently plague development teams.The Application Security Podcast is brought to you by Security Journey.About Security JourneyWe provide diverse training content and easy-to-digest lessons to meet individual learner needs.→ Learn more about Security JourneyConnect with Kayra Otaner:→ Books by Yuval Noah Harari→ RocheMentioned in this episode:→ Books by Yuval Noah Harari→ Roche→ CISA Zero Trust Maturity Model→ The Phoenix Project→ OWASP DefectDojo→ OWASP Dependency-Track→ Phoenix SecurityFollow the Application Security Podcast:➜ Home➜ X➜ LinkedIn➜ YouTube➜ Instagram➜ FacebookChapters:00:00 Meet Kayra Otaner: DevSecOps01:47 I like to be controversial about our discipline. And there was03:59 All right. Well, Kayra, I think we're going to dive right09:28 Right12:29 No, I agree with you there. I mean, there's definitely not16:17 Can you gimme an example of a problem in which security19:58 Makes sense. So what about zero trust23:12 Yeah, so lightning round are 3 questions that we typically ask25:34 Kero, what would be a key takeaway or a call to27:09 Yeah. And Defect Dojo is a commercial entity now. So I30:32 I'm going to disagree with you to some regard. I'm an