Can AppSec Training Really make a smart developer
Talkat AppSec California 2014 · on Monday, 2014-01-27· at 13:45· Track 3, Annenberg Community Beach House, East Pacific Coast Highway·
summary
Yearlong survey of ~1,000 developers measures knowledge before and after formal secure‑coding training, with about 450 usable responses and ~100 paired before/after tests. Results show an average 25% post‑training improvement, a persistent gap between awareness and how to fix issues, and QA respondents scoring consistently lower than developers. Classroom and 2–4 hour e‑learning blocks prove disruptive, retention drops with turnover, and incentives materially raise survey completion and engagement.
AI-written summary · about
chapters (24)
- 0:00Introduction
- 1:33Denim Group
- 2:20Bruce Schneier
- 3:17AppSec vs Developer Training
- 5:13Training is one of those sacred cows
- 6:07Background on the project
- 7:36Lack of workforce analytics
- 9:32Research
- 13:54Have You Had Any Training
- 14:52How We Did It
- 16:58Three Big hypotheses
- 17:38Sample questions
- 18:00prescriptive questions
- 18:47results
- 19:50gap between awareness and prescriptive
- 21:12sample fatigue
- 23:33weird results
- 24:03technology companies
- 24:20no prior secure coding
- 26:00How Developers Learn
- 27:55Asynchronous Learning
- 29:41Incentives Matter
- 31:29Conclusions
- 31:49Whats next
related talks
45mCan AppSec Training Really Make a Smarter Developer?
39mAppSec Survey 2.0 : FineTuning an AppSec Training Program Based on Data cut
28mSecure code from start; a journey through security training for developers
36mEducation & Training for Secure Software Development & Distribution
30mAppSec in a DevOps World
21mWhy Unleashing Your Software Security Potential is Necessary & How to Achieve It
30mThe AppSec Error Loop: How We Can Stop Repeating Common Security Mistakes
39mInternal AppSec Awareness and Education