How to Transform Developers into Security People
summary
Argues that developers must be the first line of defense because training alone doesn't change mindset, classifying responses as unfamiliar, overworked, apathetic, or gung-ho. Recommends concrete moves: embed static analysis in the IDE, teach OWASP proactive controls, run vulnerable labs like WebGoat Juice Shop Devlop, practice threat modeling, security code review and red teaming, and build small, repeatable security behaviors. Cites a surprising ratio of 1.6 security people per 100 developers and uses large-scale experience teaching 25,000 devs as evidence these tactics scale.
AI-written summary · about
chapters (39)
- 0:00Introduction
- 1:35Agenda
- 3:58The average developer
- 5:07Myths about security
- 7:43We already have a security department
- 9:05The state of developer security
- 10:44Developers are the first line of defense
- 11:33Developers think like security people
- 12:44What defines a security person
- 14:39Start with why
- 15:42This is a people problem
- 16:10Four different answers
- 16:44The Unfamiliar
- 18:28Foundational Lessons
- 20:24Everyone is a Security Person
- 21:11Proactive Controls
- 22:54Overworked
- 23:27Automate
- 25:07Objections
- 25:50The Apathetic
- 26:27The Shock Value
- 28:37The Pain
- 29:16Thegungho
- 29:31Security Community
- 30:40Security People
- 31:34Security Behaviors
- 34:02Security Habits
- 34:33Security Learning
- 34:56Experience Security
- 37:18Community Participation
- 37:37Planning Resources
- 37:51Threat Modeling
- 39:05Security Code Review
- 39:56Red Teaming
- 40:45Respond to Security Problems
- 41:24Putting it All Together
- 42:30Takeaways
- 42:49Questions
- 45:10Behavior not process
related talks
46mAre Developers the New Front Line of Security?
27mDevelopers Struggle with Application Security (and How to Make ...)
45mShifting from Syntax to Secure Software Development Processes
27mThe Six Developers You'll Meet in Security: Why Secure by...
01h 02mDevSecOps for Developers: How To Start
48mLevel Up Your Security Mindset
47mSecurity is Everybody's Job
51mThinking Differently About Security