Secure code from start; a journey through security training for developers
summary
Research finds 85% of vulnerabilities are introduced in coding and fixing them grows exponentially more expensive, so a structured program is built at Skatteetaten: five components including 1.5-day onboarding, leader training, role-specific half-day courses, computer-based learning via Secure Code Warrior and team tournaments for ~800 developers. Measured engagement uses a 0–5 score; trained developers show 77% vs 47% accuracy in platform tasks. Next step is correlating SAST outputs with training to prove reduced vulnerabilities.
AI-written summary · about
chapters (11)
- 0:00Introduction and background
- 2:56Why secure code matters
- 5:56Technical vs logical vulnerabilities
- 8:14Research findings on developer training
- 10:02Recommendations for security training
- 13:22Security training at Skatteetaten
- 17:57Key focus areas for training programs
- 21:49Gaining leader support for training
- 23:14Making training measurable
- 26:23Next steps and future improvements
- 27:31Key takeaways and conclusion
related talks
36mEducation & Training for Secure Software Development & Distribution
33mCan AppSec Training Really make a smart developer
57mQuantifiable Quality: The New Standard of Secure Code
56mSo Long Secure Coding - Practical Steps for Securing the entire SDLC
20mHow to Use Your Vulnerabilities to Train Your Developers on Security
21mWhy Unleashing Your Software Security Potential is Necessary & How to Achieve It
01h 00mImproving the Chances of Success in Secure Software Development
49mPanel: From Code to Defense: Why Developers Are the New Security Leaders