CloudNativeSecurityCon North America 2024

Teams with high-quality documentation are 3.8 times more likely to implement security practices compared to teams with low-quality documentation. This is just one of a set of findings about security practices from Google Cloud’s DORA research program (dora.dev). Our research is industry-wide, and documentation and security are two of many constructs that we study and measure. This talk focuses on these two elements, and there are many more findings about security (including evaluating SLSA and SSDF in 2022) in the DORA reports. In this talk, I will: - Describe how we measure security practices and documentation quality. - Present our findings about security practices, including why documentation is like sunshine. - Give some insight into the creation of quality documentation to support your security efforts. This talk is valuable for anyone in technical roles, and for leaders looking to improve the quality of their organization’s security practices and other performance metrics.