Paving a Secure Road at John Lewis & Partners

Simon Skelton, Platform & Operations Manager, John Lewis & Partners
Chris Rutter, Principal Security Consultant, Equal Experts
How do you continuously secure 100 digital services made up of 400 microservices with 7000 deployments per year? How do you ensure cross-cutting security controls that still enable 40 product teams to innovate and release without friction?
John Lewis & Partners has provided its customers with retail merchandise since 1864. The company is co-owned by its 78,000 employees, and it operates 35 stores across the UK as well as johnlewis.com. Over the past 5 years, we’ve been on a digital transformation journey, replacing our ecommerce monolith with over 100 digital services built and maintained by 40 agile product teams.
At DOES Europe 2021, we shared with the DOES community how we built our award-winning digital platform and adopted the You Build It You Run It operating model to help us deliver valuable and reliable products.
videos.itrevolution.com/watch...
/ our-award-winning-john...
Now we’d like to explore how we’ve transformed security in our product delivery, by solving common technical, organisational and process challenges with scalable and robust security controls, practical workflows, and all without an army of security specialists.
We’ll cover the successes we’ve had, and the lessons we’ve learned. Your takeaways will be: When to be opinionated and provide standardised security to delivery teams for free, how to use visible metrics and policy to distribute security ownership, and how to produce the necessary assurance to streamline security gates and enable rapid delivery.