In this episode, Peter Maddison and David Sharrock discuss how to integrate threat modeling into the secure development lifecycle (SDLC) at scale. They cover the importance of shifting security practices left, and how to establish communication channels between development teams and security experts.

Key takeaways:

• Threat modeling is a security practice that involves identifying and mitigating potential threats to an organization's assets.
• Threat models should be created and maintained early in the SDLC, but don't need to be updated for every minor change.
• A mechanism for ongoing communication between developers and security professionals is essential for effective threat modeling.

Resources:

• Sooner Safer Happier by Jonathan Smart - https://www.goodreads.com/en/book/show/50343488
• Larry Maccherone https://www.youtube.com/watch?v=EyS1kmmlA5Y
• Martin Fowler blog https://martinfowler.com/articles/scaling-architecture-conversationally.html

Whether you're diving into DevSecOps or just looking to get a handle on threat modeling at scale, this episode is a must-listen. Tune in now as Dave and Peter discuss how to future-proof your organization!

In this episode, Peter Maddison and David Sharrock are joined by Melissa Boggs, a leadership coach, consultant, and keynote speaker for Agile 2024. They discuss Melissa's experience as the co-CEO and chief scrum master of Scrum Alliance during the challenging times of the COVID-19 pandemic. The conversation dives into the topics of employee experience design, non-hierarchical organizations, and the importance of co-creating buy-in for organizational change.

Key Takeaways:

• Delegating authority and distributing power within an organization requires providing context, setting boundaries, and preparing employees for decision-making responsibilities.
• Leaders often avoid change due to a fear of losing authority, power, or performance. Coaching and empathy are essential to help leaders move from a state of caution to curiosity and eventually courage.
• Co-creating buy-in through collaboration and involving employees in decision-making processes leads to organic, natural buy-in and better solutions, as opposed to top-down directives.

Discount Information: Melissa provided a discount code for listeners interested in attending Agile 2024 in Dallas, where she will be the closing keynote speaker. The code "A24-podcast" will give you $100 off your registration- https://www.agilealliance.org/agile2024/

We love to hear your feedback! If you have questions or would like to suggest a topic, please feel free to contact us at feedback@definitelymaybeagile.com.

In this episode, Peter Maddison and David Sharrock discuss the complexities and misconceptions surrounding estimation in software development and agile project management. They explore the differences between bottom-up and top-down estimation approaches, emphasizing the importance of continuous conversations and feedback loops throughout the process.

This week's takeaways:

• Bottom-up estimation, where every task is estimated and summed up, is highly inefficient and inaccurate, especially for long-term projects or when requirements are likely to change.
• Top-down estimation, which involves breaking down work into relatable chunks and understanding the journey, is more effective and allows for adaptability as the project progresses.
• Estimation should be an ongoing conversation between teams, stakeholders, and decision-makers, focusing on problem-solving, progress tracking, and continuous feedback rather than rigid timelines.

Tune in for a riveting discussion that challenges traditional notches around estimation in agile software development. Subscribe to absorb invaluable insights on nurturing continuous conversations, embracing top-down estimation techniques, and fostering an environment primed for delivery excellence at scale.