AppSec on a budget
summary
Session gives six concrete tactics for doing AppSec on a shoestring: find cross‑team allies, leverage security incidents to win headcount (an incident wins an extra hire), choose pragmatic tooling like Dependabot on GitHub instead of pricey scanners, build a small PoC and push it to production, run hands‑on exercises (a deployed vulnerable lambda and lock‑picking) and seed security champions who grow from four or five to nine or ten contributors with coffee as a reward.
AI-written summary · about
chapters (14)
- 0:00Intro
- 0:58Budget is important
- 1:32Constraints
- 5:08Solutions
- 5:30Zero Budget
- 5:46Find Allies
- 9:40Do Not Waste a Securing Incident
- 13:26Tools and Techniques
- 13:40Open Source
- 14:17Dependence Management
- 16:13Scale Influence
- 16:52Provide Value
- 20:35Scale
- 26:13Do not despair
related talks
42mBuilding an AppSec Program with a Budget of $0: Beyond the OWASP Top 10
26mHow to Build an Application Security Program
30mAppSec in a DevOps World
15mInterview with
42mAppSec is dead. Long live DevSecOps!
47mSecurity is Everybody's Job
49mAppSec, Ready, Set, Go!
57mKeynote: Maturing Your Application Security Program