A Warrior's Journey Building a Global AppSec Program
summary
Program outlines concrete benchmarks and tools: a 600‑developer org with 7 R D sites and ~150 products, an SSG sized 1–3% SSG to developers per Bsim/BSIM study of 130 firms, and 25% third‑party component issues driving an SCA program. Details include chartered SSGs, written security bars (example: SCA scan + triage + fix critical/high/medium before release), CI/CD gating that inlines SCA and Twistlock and pulls out‑of‑band results, exception approval via Jira with mitigation timelines, and capture‑the‑flag using alas security shepherd.
AI-written summary · about
chapters (24)
- 0:00Start
- 0:11Highlights of My Background
- 1:46Where Would You Begin
- 3:51Culture
- 4:24The Central Application Security Group Cisco
- 5:28Defining the Charter
- 6:09Data and Pointers from Bsim
- 7:43Advice and Notes on Building Your Software Security Center of Excellence
- 12:38Data Driven Program Management
- 13:49Security Champion
- 20:43Structured Training Programs
- 21:36Black Belt
- 22:32Security Events
- 23:38The Recognitions and Rewards
- 25:13Define Your Security Gates and Passing Criteria
- 25:35Security Requirements
- 26:57Requirements Phase
- 27:45Development Cycle
- 32:50Example of What a Continuous Security Pipeline at Scale
- 37:29Aggregated Risk Score
- 38:44Accountability
- 39:52What Is a Security Exception the Risk Approval Process
- 41:55Recap
- 42:19Takeaways
related talks
01h 00mImproving the Chances of Success in Secure Software Development
36m5 Steps to Drive Enterprise Software Security
57mWhat’s in an AppSec program?
56mSo Long Secure Coding - Practical Steps for Securing the entire SDLC
38mChampioning Security for your Agile Development
50mCase Study: 10 Steps to Agile Development without Compromising Enterprise Security
28mData-Driven AppSec Champions Programs – Benchmarking Your Program with Numbers
40mDevSecOps Guide to Bulletproof Your Development Workflow