====

Hi everyone!  I’m going to be the host for today’s Security-Audit-Compliance-GRC session.   Looking forward to talking with you all as this is always an exciting topic: Here’s the Zoom info for BOF session starting at 245pm PT / 545pm ET: https://sonatype.zoom.us/j/98357181714 Meeting ID: 983 5718 1714 One tap mobile <tel:+13017158592,,98357181714#|+13017158592,,98357181714#> US (Germantown) <tel:+13126266799,,98357181714#|+13126266799,,98357181714#> US (Chicago)

Great article we were discussing: https://cacm.acm.org/magazines/2018/4/226371-lessons-from-building-static-analysis-tools-at-google/fulltext

what about state when development has different tool preference compared to global enteprise security in the tool choice? Any experience? Development might prefer "easy to use" tools but it might not be the same preference of enterprise security. Is it the tool realy developers choice?

Nygard’s book: https://myresources.itrevolution.com/id006657043/DevOps-Automated-Governance-Reference-Architecture

Regula: https://jaxenter.com/regula-open-source-167138.html

Styra: https://www.styra.com

@aries which was the other tool you mentioned in this space?

new busineses should focus on “automating IT problems”

Also worth checking out this DevSecOps reference architecture: https://www.sonatype.com/referencearchitecturetestdrive