Peter Edworthy

🎤 Chris McFee (KeyBank), Adam Parker (Huntington National Bank), and Darshana Pai (Virtusa) are set to take the {unscripted} stage in Columbus to discuss the evolution of DevOps practices, along with challenges and expectations. They will share how to effectively scale DevOps in complex, regulated environments by streamlining cloud migrations, aligning teams around DORA metrics, and fostering cultural change. 🌎 Not in Columbus? See the complete list of cities and our virtual event. 👉 https://lnkd.in/dhAKHU3B

1

Here’s a pattern I’m seeing more often: More sites. More assessments. More reporting expectations. Same headcount. Security teams are being asked to scale output without scaling structure. So what happens? Assessments become episodic. Reporting takes too long. Prioritization becomes subjective. And leaders spend more time translating risk than reducing it. This isn’t a capability issue. It’s an architecture issue. At some point, physical security has to operate with the same operational discipline as finance and IT. Otherwise it stays in permanent catch-up mode. For security people overseeing medium to large portfolios (20+ sites): What’s currently your biggest bottleneck volume, visibility, or validation? And why do you think this is?

5

1 Comment

Incident Readiness Is Not an IR Plan Most companies have an IR plan. Very few have: • Executive-level tabletop exercises • Cross-functional escalation paths • Clear RTO/RPO expectations • Regulatory-ready communication workflows • Practiced recovery steps Readiness = Resilience. This is why I included a 4-question leadership IR assessment in the 2025 Cyber Risk Checklist. Comment IR if you want it.

1

1 Comment

Download Pentera Labs Report - revealing three new critical injection points in the ingress-nginx controller, building on Wiz’s IngressNightmare CVE. These overlooked vulnerabilities could let attackers hijack traffic, spoof headers, or reach unauthorized backend services - They exist in one of the most widely used ingress controllers in Kubernetes, putting countless environments at risk. This research highlights how small misconfigurations can lead to major exposure in modern cloud-native architectures. What’s Inside: ✅ 3 new injection vulnerabilities in ingress-nginx ✅ How attackers find and exploit CVEs in open source ✅ Actionable tips to secure your Kubernetes environment https://lnkd.in/eHtX6EdP

6

1 Comment

Grow engineering velocity without growing the security backlog. Build security into every commit so code ships safely, no matter whether it’s written by humans or AI.

3

Just published a new blog post on how engineering teams can “shift down” compliance into platform abstractions. I share thoughts on compliance leverage, OSCAL components vs capabilities, and how platforms can carry the heavy lifting for controls like TLS and mTLS—freeing developers from duplicating effort. Read it here: https://lnkd.in/eh5cABU5 #OSCAL #ComplianceEngineering #PlatformEngineering #ComplianceAutomation

9

Your CI/CD pipeline is not merely an automation script; it's a programmatic enforcement layer for organizational policy and architectural standards. Traditional CI/CD often falls short in ensuring consistent compliance, security, and architectural integrity across rapidly evolving, distributed systems. Manual gatekeeping or reactive checks become unscalable bottlenecks, leading to incidents and compliance drift in complex microservices environments. Advanced CI/CD leverages Policy-as-Code (PaC) to embed governance directly into the pipeline, preventing non-compliant deployments at source. This shifts security and operational checks far left. For instance, using Open Policy Agent (OPA) with Rego allows defining granular rules that validate deployment manifests, container images, or resource configurations before they ever reach a cluster. Consider this Rego policy snippet to enforce specific image registries: package kubernetes.admission deny[msg] { some i container := input.request.object.spec.template.spec.containers[i] not startswith(container.image, "my-secure-registry.io/") msg := sprintf("Container '%s' uses an image from an unapproved registry: %s", [container.name, container.image]) } deny[msg] { some i init_container := input.request.object.spec.template.spec.initContainers[i] not startswith(init_container.image, "my-secure-registry.io/") msg := sprintf("Init container '%s' uses an image from an unapproved registry: %s", [init_container.name, init_container.image]) } This policy ensures every container image originates from a pre-approved, secure registry, failing the deployment instantly if violated. Pro Tip: Beyond static analysis, integrate active feedback loops. Instrument your pipeline stages with distributed tracing and anomaly detection. This allows for proactive identification of performance degradation or security drifts introduced by new deployments, transforming your pipeline from a build server into a self-monitoring, self-correcting delivery engine. #DevOps #CICD #ContinuousDelivery #GitOps #CloudNative #PolicyAsCode #OPA #Rego #DevSecOps #Kubernetes #Automation #CloudArchitecture #SiteReliability #InfrastructureAsCode #SoftwareEngineering #TechInsights

15

Software teams are discovering something powerful: agentic automation that connects across the entire SDLC. In From the Bear Cave, Dan Faulkner and Vineeta Puranik break down how MCP enables connected workflows, what autonomy looks like in practice, and why trust and transparency matter. https://lnkd.in/gqE_Nv5z

6

Manual compliance work doesn’t just slow your team down, it drains your budget. Writing SBOMs and audit notes by hand takes hours of engineering time and leaves room for costly errors. Missed artifacts and inconsistent documentation can lead to fines ranging from thousands to over a million dollars each year. SmoothDev automates compliance documentation in real time, generating accurate release notes, SBOMs, and logs directly from your workflow. No scrambling before audits, no wasted hours — just instant, reliable compliance at scale. #ComplianceAutomation #EngineeringProductivity #SoftwareDevelopment #AuditReady #SmoothDev #DevTools #Automation #AIforDevelopers #CodeSmarter

6