Concrete Steps to Create a Security Culture
summary
At a 70-person startup a security program uses repeatable tactics: a Google Group security champions list, detailed "fireside bug bounty" emails with proof‑of‑concepts and linked pull requests, a hands‑on hacking class using OWASP Juice Shop on Heroku and Burp Suite, biweekly watch parties and five‑minute show‑and‑tell slots, monthly "security little wins" emails and tracked JIRA links, plus printed NSA‑poster postcards (136 designs) to raise awareness. These steps increase responsiveness, reduce friction on patches and MFA rollouts, and build social capital; 20% time and focusing only on engineers proved ineffective.
AI-written summary · about
chapters (6)
- 0:00Introduction to security culture
- 1:23Why security culture matters
- 5:13Eight concrete examples
- 16:12Guiding principles for culture
- 19:05Measuring culture success
- 21:36Conclusion and Q&A
related talks
20mBuilding security culture on infrastructure teams
37mSecurity Culture Hacking: Disrupting the Security Status Quo
51mBuilding Security Champions
25mWhat Does it Mean to Build a Proactive Security...
36mChampioning Security: Scaling Security at Every Level
47mSecurity is Everybody's Job
48mHow to build a security mindset
52mLeveraging Psychological Needs For Building A Security Culture Amongst Developers