The Developer's Field Guide to Software Security
summary
Concrete roadmap: learn the vocabulary via OWASP Top 10 and hands‑on labs, then shift security left by adding IDE linters, SAST, SCA, unit tests and DAST (try ZAP), plus container scanners and cloud config checks (AWS Config / Azure / GCP). Data points guide choices: DORA surveys 31,000 engineers, BSIMM examines 122 firms (85 of 122 use tooling, only ~16% add custom security unit tests). Start with 3–5 recurring bugs (XSS is common), fix them pre‑commit, iterate with allies in security groups and OWASP chapters.
AI-written summary · about
chapters (21)
- 0:00Intro
- 5:04Timeline of a Software Breach
- 7:17Cost of a Software Breach
- 10:01Timeline of a Detected Vulnerability Adversary
- 12:39Timeline of a Vulnerability Fix
- 14:38Speak the Language...
- 18:45Language Lessons: Internal, Online SSG Resource
- 19:28Language Lessons: Internal PD Platforms...
- 20:13Language Lessons: Find External Resources Read
- 22:50Code & Architecture Review!!
- 26:41(Secure) Software Development Life Cycle
- 28:01Dynamic Application Security Testing (DAST)
- 31:50Static Application Security Testing (SAST)
- 33:44Software Composition Analysis (SCA)
- 37:38Self-Made Unit Tests
- 41:11Security Linters
- 43:17Cloud Configuration Tools, Container Scanning...
- 47:32Find Allies: Check with your Software Security Grou
- 49:39Find Allies & Organize a Movement: Think Horizonta
- 53:15Pace yourself! Let data guide you...
- 55:35Find the Time...
related talks
37mDeploying Security Testing Practice in Your Team and Company
06mInterview with
45mDon't Panic! A Developer's Guide To Security
27mHow to Start Security Testing Without Fear
38mFree security resources that your competitors use!
44mShift-Left-Security with the Security Test Pyramid
40mMaking Security an integrated part of the SW Dev Lifecycle
34mEmbarking on Your Security Journey