Larry Maccherone

Not all apps are created equal, don’t mindlessly #ShiftLeft. #ShiftSmart instead. Check out Part 1 of @LMaccherone's Considered Harmful series as he highlights why shifting smart is the innovative approach in #AppSec: contrastsecurity.com/security-influ…

My philosophy in under 2 minutes

The 2023 @coissa Infosec Summit is just around the corner. Join us on Apr. 20 for a discussion with Contraster @LMaccherone on how to deliver a transformation blueprint for accomplishing the cultural shift to developer-centric application security. #COISSA bit.ly/3Uz3QRr

Join our DevSecOps Transformation Architect @LMaccherone at #DevOpsCon on Nov. 22 from 11:15 - 12:00pm Singapore Time as he discusses what true Shift-Left Developer-Centric Security means and how to "make a deal" with security so you're ready. Learn more: devopscon.io/devsecops/a-de…

What is #DevSecOps? It’s empowering your engineering teams to take ownership of the security of the products being built following the three ways of #DevOps. More from @contrastsec’s @LMaccherone on @AgntOfInfluence: ow.ly/Fh5v50LGj3I

@plaugg @johanneslink @JoshuaKerievsky The only new detail that our qual research showed for high performing larger teams was that they had more specialists UX, Architect, and upwards of 1:1 ratio between dev and test. I believe this explains why larger teams had better quality but worse responsiveness 2/2

@LMaccherone @johanneslink @JoshuaKerievsky How did they deal with communication complexity? In my experience, teams with more than ~10 people form sub-teams anyway and complain about communication overhead.

I will take one 8-pizza team with few-to-no slow handoffs over four 2-pizza teams with many slow handoffs. Size teams for agility not adherence to “what worked at another company.” #agile #lean.

@plaugg @johanneslink @JoshuaKerievsky I did quantitative research of a body of data that included over 10,000 teams. We dug in qualitatively when the quant results made no sense. 1/

Great advice from a one of the best leaders I know!

Need a quick summary on what @LMaccherone talked about? Check out our blog 👉 bit.ly/3O77U7o

@johncutlefish @williamwong Yes. Trusted Advisor is the original but I didn’t know that until I published my algorithm for maximizing my version of the formula for DevSecOps. I heard it from someone at Rally Software who didn’t tell me where he learned it.

While the purpose of Webb’s latest image was to focus on a bright star and evaluate the alignment progress, Webb’s optics are so sensitive that galaxies and other stars can be seen in the background. Watch this video for an in-depth explanation of how the image was created!

@jezhumble Scary

Here is a very depressing article on the likely outcomes of Putin’s war in Ukraine: theguardian.com/commentisfree/…

It's not too late to register for my webinar discussing how to avoid the next zero-day in light of learnings from the Log4Shell kerfuffle last month. contrastsecurity.com/cs/c/?cta_guid… #DevSecOps #CyberSecurity

@johncutlefish I think this just means that you aim for “warm candor” not “brutal honesty”

Some good questions to answer in crafting a team agreement: “How do we make decisions?” “If we fail to reach consensus, how do we move forward?”

@ankurkumarz I really need to update that. Thanks for the kind words and reposting.

2017 post - still one of the most simple and effective way to explain #DevSecOps cycle

Dramatic. Appropriately dramatic.

I'm excited to be presenting "The Future of Dev[Sec]Ops" tomorrow at 12:30am eastern US at OWASP 20th Anniversary Event. It's not too late to sign up! sched.co/m5hA @owasp #AppSec #DevSecOps #owasp @sched