Building a Security Assurance Program
summary
Practical checklist for starting a security assurance program: require executive buy‑in, write defensible policies with waiver deadlines, and set a clear bug bar such as severity 0–3 that ties each risk to an approver and remediation date. Use threat modeling with STRIDE for design reviews, run static/dynamic analysis and fuzzing (team uses libFuzzer) to build a crash corpus and regression tests, publish artifacts (design reviews, risk assessments, incident playbooks, monthly security bulletins), and exercise incident response with disaster recovery testing.
AI-written summary · about
chapters (6)
- 0:00Introduction to security assurance
- 7:12Microsoft’s security evolution
- 12:28Policy and leadership buy-in
- 18:57Android’s advanced assurance
- 25:45Secure development lifecycle
- 36:18Incident response planning
related talks
38mBuilding an Assurance and Secure Development Program
23mSecurity Doesn't Have To Be a Nightmare
24mConcrete Steps to Create a Security Culture
51mBuilding Security Champions
01h 01mSecurity Champion Worst Practices
33mLearning from Past Security Breaches: Strengthening AppSec Efforts and Focus
40mMaking Security an integrated part of the SW Dev Lifecycle
53mWhat is a software security initiative and do I need one?