4.3 What you can say out loud
Give this talk in under three minutes.
- I can describe waterfall, Agile, DevOps, and DevSecOps with the bridge, the bricks, and the belt.
- I can say why a bug in a requirement sentence is cheaper than the same bug in production.
- I can name Dev, Sec, and Ops without mocking any of them.
- I can list four DORA goals and refuse to invent a company's score.
- I can add security scan coverage and label it as not DORA.
- I can draw the payment picture and state the 5000-to-1 threat in one sentence.
- I can name TLS, HMAC, and the server-side amount check as fixes, without telling anyone how to tamper with a request.
- I can say that STRIDE is six threat types and PASTA is seven thinking steps.
One sentence each, then stop. Netflix: a small release beats a year-long bridge, and the daily belt still needs a safety station. Instagram: Dev, Sec, and the server-side people look at one change together. Infosys on a client project: a file copied by hand is not a belt. An Indian payment API: the server re-checks 5000 and does not store 1 because a phone said so.
Practice task
Record yourself once, or tell a friend. Use the eight lines above as a checklist. Any line you cannot say, write the chapter number beside it and reread only that chapter.
Ravindra Bagale's Tip
A recap that copies the same sentence ten times feels long and teaches nothing. If you are bored, you are ready to speak. Close the page and speak. The gap you feel is the real review.