AppSec as Glue...
summary
Teams describe building a platform for vulnerability management with centralized dashboards that engineers use to prioritize fixes, and a security platform that enforces Monle security grade B as a gate; service-to-service authentication and authorization is a multi-year effort (3–3.5 years) that requires hiring platform engineers (service auth platform (3+ years)) rather than only teaching developers. Quick wins include GitHub hardening and branch protection, turning off unused services, and counting findings per capita / MTR; postmortems show leaked secrets cause 7 of 10 major incidents.
AI-written summary · about
chapters (11)
- 0:00Introduction and panel setup
- 1:48Panelist introductions and icebreaker
- 7:02Defining AppSec as organizational glue
- 11:37First security partnerships prioritized
- 16:15Security partnerships at scale
- 17:58Building secure defaults with platform teams
- 22:53Partnering within security teams
- 28:50Collaborating with business teams
- 34:06Measuring business value of partnerships
- 39:06Hardest lessons in partnership building
- 40:55Closing remarks and Q&A
related talks
57mBuilding a Modern Security Engineering Organization
41mAppSec From the Ground Up
24mBeing secure by design: Engineer-led security
47mSecurity is Everybody's Job
30mAppSec in a DevOps World
39mInternal AppSec Awareness and Education
37mPlatform and Security Engineering
21mIncorporating Security into Platform Engineering: The Dos and Dont’s