Ambitious S SDLC at Norway's biggest home construction company
summary
A rollout of a company-wide secure software development lifecycle at UBOS mandates asset classification, continuous OSS scanning with defined patch deadlines, and external pentests for critical systems plus follow-up remediation; teams do threat modeling before major features and perform dynamic and code scanning, enforce secure configuration and change management, and maintain incident playbooks. Senior management defines the acceptable risk level and funds tooling; the program requires significant ongoing effort and cultural change and is treated as a never-ending improvement process.
AI-written summary · about
chapters (6)
- 0:00Introduction to OBOS
- 0:14Company background
- 1:05Need for an S-SDLC
- 1:49Overview of S-SDLC policy
- 2:05S-SDLC core activities
- 5:52Lessons learned and conclusion
related talks
51mA Roadmap for Your OSS Security Lifecyle Journey to Protect Customers
50mCase Study: 10 Steps to Agile Development without Compromising Enterprise Security
22mBuilding SSDLC in an Enterprise Environment
50mMapping ISO 27001 to Modern Software Engineering: Secure by Design
52mOSS Security Maturity: Time to Put on Your Big Boy Pants!
30mManaging Vulnerabilities through SSDLC
34mSupply Chain Security, SBOMs and How OSPOs Can Play An Important Role Going Forward - An Ecosystem and Compliance Update
44mMaturing SDLC At A Fortune 500 Company Based On OWASP SAMM: Successes And Pitfalls