Teach a man how to fish
summary
Claim: make security stick by changing practices not doing the work for them. Start with an assessment, measure security maturity with a few meaningful metrics quarterly, train SRE/DevOps and security teams with hands‑on kickbox style coaching, run lightweight threat modeling, and automate policy into developer tools so checks run in CI/CD. Isolate sensitive assets (credit card data example), reduce docs that drown teams, and aim to hand over maintenance before leaving; common failures are death‑by‑Excel and dumping documentation over the fence.
AI-written summary · about
chapters (26)
- 0:00Intro
- 0:51About me
- 2:16You help securing
- 5:58What happened?
- 8:42COACH WITH THE END IN MIND
- 11:37Planning phase
- 12:18Keep in touch
- 12:38The security coach
- 12:57Select your elements wisely
- 13:32Make it visible
- 15:43Get a headstart: Get & train security teams!
- 17:29Raise your champions
- 18:02Don't overdo it!
- 20:26Threatmodelling
- 22:21Next step: automate!
- 23:03See how & when you can let go
- 23:48NEVER FORGET!
- 24:06Add too many processes & steps CAUSE OF DEATH
- 24:27Let the developer dig for requirements
- 25:01Forget to measure
- 25:38Do SDLC/ automation all yourself
- 26:09Do SDLC / automation all yourself
- 26:55Making it complex
- 27:17Chief Excuse Officer
- 28:01Wanting to hold on
- 28:48Recap
related talks
01h 04mShifting Security Everywhere
51mBuilding Security Champions
47mSecurity is Everybody's Job
52mHow to Transform Developers into Security People
20mBuilding security culture on infrastructure teams
27mIncluding security in your engineering culture
27mBridging the Dev-Sec divide: Three tips for agile developers
27mDevelopers Struggle with Application Security (and How to Make ...)