Mapping ISO 27001 to Modern Software Engineering: Secure by Design
summary
Company gets ISO 27001 mapped onto modern SDLC in practical steps, achieving certification in 8 months to certification by adding threat modeling, automated checks and governance. The team scans dependencies and code with Dependabot, SonarQube, Trivy, OWASP ZAP, signs images, pushes to Nexus/ECR, and deploys via GitOps (Flux/Argo) so tests run in-cluster. Specific incidents motivate choices: Heartbleed (2014) exploit ~186 lines, a 9.5 GB EV data leak exposing ~68,000 Swedish and ~300,000 German records, and a November breach that forces 300 systems patched; adopt OWASP SAMM for continuous improvement.
AI-written summary · about
chapters (10)
- 0:00Secure software engineering intro
- 10:56Security incidents lessons
- 14:29ISO 27001 for engineers
- 18:45ISO 27001 to engineering controls
- 23:45Threat modeling with STRIDE
- 31:54Architectural views for security
- 37:53Secure coding principles
- 41:45Microservices security testing
- 47:10Security maturity with SAMM
- 49:15Security as core quality
related talks
42mEngineering Trust: Integrating Security into Your Modern SDLC
26mSimple Guide to Secure SDLC
57mThe Developer's Field Guide to Software Security
45mDon't Panic! A Developer's Guide To Security
40mEmbracing Security - A Changing DevOps Landscape
56mSo Long Secure Coding - Practical Steps for Securing the entire SDLC
30mSecuring DevOps using OWASP DevSecOps Tools
24mBeing secure by design: Engineer-led security