Information Security Management Programs-Changing the Paradigm on Implementation and Management
summary
Argues for replacing centralized control with a distributed abiso / BISO model that pushes accountability into HR Finance and Dev, shows automation of compliance so you can do 1000 pushes a day while keeping audit evidence, says Change Management does not mean change meeting, recommends two‑way GRC connectors and tools like Hyperproof Veracode SonarQube Tenable Nessus, reports real results from empowering devs with Burp Suite and automated pipelines and warns to keep 6–12 month logs.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 3:56Centralized governance failures
- 7:24Distributing accountability with BISO
- 10:13Autonomous security teams
- 14:52Third-party and cloud automation
- 16:59GRC tools effectiveness
- 26:14Compliance automation in DevOps
- 31:53Preventing security mistakes
- 33:21Documentation and training tips
- 36:53Aligning security with growth
- 37:56Summary
related talks
32mThe One About Controls
50mHack the Institution – A Map To a Strong Partner-Based Security Program
42mEngineering Trust: Integrating Security into Your Modern SDLC
39mProactive Security, less buzzword, more action
22mChange is Hard - Securing the Future Today
30mThe 3 Ways of DevSecOps – Making Shift Happen
53mOver a Decade of Software Security: What Have We Learned
51mThe End of DevSecOps?