What is a software security initiative and do I need one?
summary
A practical roadmap for an AppSec initiative: plug a SAST, SCA, DAST, IAST toolchain into CI/CD (examples: SonarQube/Fortify/Coverity, Dependency‑Check), run lightweight linters in pull requests, reserve manual review for security‑sensitive modules, and use pen tests only to find remaining logic flaws. Adopt OWASP/BSIMM guidance, create security champions and simple KPIs, start with one code‑scan and one threat model, automate gates where possible, and feed production incidents back into the backlog.
AI-written summary · about
chapters (29)
- 0:00Intro
- 0:21usr/bin/whoami MURLO
- 1:12What is Software Security?
- 1:59More than just...
- 4:40printf("Hello, World\n")
- 8:54Early 2000s: Fix the damn cod
- 9:57Security in a waterfall world
- 13:37We're Agile now
- 15:24Efforts to get real
- 18:45Option 1: SDLC-focused
- 26:49Option 2: Use a framework E.g. the Software Security Framework from BSIMM
- 28:17Stakeholders & Organisation.
- 31:04Strategy & Metrics
- 33:07Compliance & Policy
- 34:08Training
- 35:32Attack Models
- 36:52Security Features & Design
- 38:14Standards & Requirements
- 39:17Architecture Analysis
- 40:18Code Review
- 41:50Security Testing
- 43:39Penetration Testing
- 44:54Software Environment
- 45:51Config Mgmt & Vuln Mgmt
- 46:59Start small
- 47:41Security at the speed of developme...
- 50:37Continually improve
- 51:21Further reading
- 51:59Online Resources
related talks
49mAppSec, Ready, Set, Go!
44mSecurity Practices Useful in Agile Development
57mWhat’s in an AppSec program?
33mJumpstarting Your Appsec Program
40mSecurity-as-Code to Accelerate DevSecOps, a Practical Guide to Get Started
37mDevSecOps Guide to Bulletproof Your Development Workflow
40mDevSecOps Guide to Bulletproof Your Development Workflow
45mDevSecOps : add Security to your DevOps!