DevSec For Scale Podcast – Minimum Viable Security w/ David Melamed, Jit.io

In this episode of the “DevSec for Scale” podcast, Jeremy Hess interviews David Melamed, CTO and co-founder of Jit.io, a startup focused on continuous security. The conversation delves into the concept of Minimum Viable Security (MVS), which parallels the idea of Minimum Viable Product (MVP). David explains that MVS is about implementing a baseline level of security from the outset and iteratively enhancing it. This approach helps startups incorporate essential security measures without being overwhelmed by extensive requirements, allowing them to focus on core development while progressively improving security.

David highlights the challenges startups face in integrating security seamlessly into their development processes. He points out that while developers are adept at building and deploying software, security often remains an afterthought, leading to friction and inefficiencies. The traditional separation between security engineers and development teams exacerbates this issue. To address this, David advocates for embedding security practices within the development cycle, much like how quality assurance (QA) has been integrated. He emphasizes that developers should own the security of their code and infrastructure, leveraging automated tools and practices to minimize manual overhead and ensure continuous security improvements.

The discussion also touches on the importance of security as code, automation, and shift-left practices. David explains that treating security configurations and policies as code enables better management, versioning, and auditing. By incorporating security checks into the CI/CD pipeline and leveraging tools that provide real-time feedback to developers, organizations can catch vulnerabilities early and maintain a secure development environment. He also stresses the need for startups to have a clear security roadmap, starting with minimal viable security measures and iteratively enhancing them to avoid accumulating security debt. The episode underscores the necessity of integrating security from the ground up, making it a seamless part of the development process to ensure robust and scalable security practices.