Security Culture: Why is it important?
summary
Builds an SSDLC that embeds shift‑left SSDLC checks into pipelines, uses open‑source scanning and an OASP security‑culture framework, and creates a security champion program that moves responsibility into dev teams. Starts 2022, seeds a community from 80 to 420 members, pilots with a €3,000 seed budget, nominates full champions by March and measures outcomes with OASP‑inspired metrics. Shows an insecure invoice endpoint example and reports the program is now delivering but still maturing.
AI-written summary · about
chapters (17)
- 0:00Introduction to security culture
- 1:27What is security culture?
- 3:54Why security culture matters
- 6:26Security in agile at scale
- 7:29Risks of weak security culture
- 10:26Shift left in SDLC
- 12:12Building SSDLC model
- 13:17Role of security champions
- 15:06Security champion program
- 16:56Gaining management buy-in
- 18:47Aligning with business KPIs
- 20:13Maintaining champion interest
- 21:39Measuring program success
- 22:43Program timeline and progress
- 26:57Sustaining security culture
- 27:40Key takeaways
- 28:24Q&A session
related talks
20mBuilding security culture on infrastructure teams
01h 04mShifting Security Everywhere
24mConcrete Steps to Create a Security Culture
48mSecurity Champions And Experiments: Building Blocks For Cultural Change
26mBuilding Secure Cultures
22mBuilding SSDLC in an Enterprise Environment
36mSaaC – Security as a Culture, the Distributed Advocacy
52mLeveraging Psychological Needs For Building A Security Culture Amongst Developers