Security Kaizen for developers

on YouTube ↗43m

" summary

Argues that moving security into dev teams works: Radically Open Security runs a 100% online Rocket.Chat office with ~50 staff worldwide, invites customers and subcontractors to watch and join tests, and uses gamified red red pentests (two teams of ~6 each) that routinely change developer mindset — "I will never look at code the same way again." Recommends SBOMs, cites NGI funding of ~1,000 projects, warns SBOM tool fragmentation, built and open‑sourced a pentest reporting suite oasp-pentex, and reports practical wins (found XSS theming bug, handled 200 bug reports week one).

AI-written summary · about

" chapters (15)

1. 0:00Introduction
2. 3:06What is security Kaizen
3. 5:11Penetration testing workflow
4. 9:04Red-blue pentests and gamification
5. 11:14Security through openness
6. 15:14Breaking silos in security
7. 16:41Proprietary vs open-source tools
8. 18:05Open-source supply chain challenges
9. 25:20Integrating security into DevSecOps
10. 28:33Engaging security training
11. 31:43Security via Capture the Flag
12. 33:10Encouraging hacking and improvement
13. 37:06Vulnerability disclosure and bug bounties
14. 40:16Commercial security models
15. 42:45Q&A

" related talks

• 52mLeveraging Psychological Needs For Building A Security Culture Amongst DevelopersJuliane Reimann · Global AppSec Lisbon 2024
• 01h 04mShifting Security EverywhereTanya Janca · Global AppSec Dublin 2023
• 27mSecurity Learns to Sprint: DevSecOpsTanya Janca · BSidesSF 2020
• 40mMaking Security an integrated part of the SW Dev LifecycleSiren Hofvander · DevOne Detroit 2018
• 48mHow practical is “DevSecOps” really? – A field reportMaximiliane Zirm · DevOpsCon Munich 2019
• 25mPanel Discussion Led by – Joshua CormanJoshua Corman · GOTO London 2015
• 47mSecurity is Everybody's JobAkira Brand · Software Architecture fwdays'22
• 36mThe Road To Being RuggedShannon Lietz · GOTO London 2015