Shifting Security Everywhere
summary
Argues that shifting left alone fails and shows concrete alternatives: create short one-hour threat models, add lightweight secure design checks to project kickoff and schedules, buy and train developers on SAST/SCA linters and run them in CI, use DefectDojo for result aggregation and dashboards, run automated web asset inventory and monthly scans, hold monthly one‑on‑one security champion checkins, measure incidents (example: 26 app incidents causing 75% of cost) and iterate SLAs gently so fixes actually happen.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 0:24Shifting left is not enough
- 3:54Meet the speaker
- 4:37Comprehensive security
- 17:59Shifting right for legacy apps
- 35:29Developers for security
- 43:31Security for business
- 53:19Conclusion
- 57:57Q&A
related talks
22mShifting left, how security fits into the DevOps story
40mMaking Security an integrated part of the SW Dev Lifecycle
27mSecurity Learns to Sprint: DevSecOps
47mSecurity is Everybody's Job
27mStandard Classification: Achieving Security by Shifting Left in Agile
38mPrioritizing Trust While Creating Applications
31mPrioritizing Trust while Creating Applications
45mShifting from Syntax to Secure Software Development Processes