Developers Dislike Security: Ten Frustrations and Resolutions

on YouTube ↗40m

" summary

Lists ten frustrations developers voice (loud tools, false positives, gatekeeping, no time, shifting guidance) and gives concrete fixes: security coaching practice (one large financial firm pairs appsec coaches with devs — it improves fixes), measure the % of flaws that require rework to prove ROI, job‑shadow a developer for a week, and tune the tools (e.g., narrow noisy Azure DevOps integrations, yank underperforming scanners). Provides timelines: pick partners in 3 months, deploy multiple resolutions in 6 months.

AI-written summary · about

" chapters (28)

1. 0:00Intro
2. 1:16The DevSec disconnect
3. 3:13Ten frustrations developers have with security
4. 4:23Developer empathy
5. 5:35Security doesn't understand what I do and doesn't know how to code.
6. 7:06Become a developer and learn how to code.
7. 9:15Nobody ever showed me how to security
8. 10:10Build a security coaching practice and education program.
9. 11:56I don't know why we put so much effort and time into security.
10. 13:16Start with why and security ROI.
11. 15:44The security process is difficult or undefined.
12. 16:53Use the SDL as guardrails.
13. 17:53Security changes their minds all the time.
14. 19:17Gain understanding and offer a second opinion.
15. 21:16Frustration 16: Not enough time to do security
16. 22:29Resolution 16: Raise awareness about security resource needs
17. 23:34Security is a silo and acts as a gatekeeper
18. 25:16Partnership, not gatekeeping
19. 26:22Frustration : Security busy work
20. 27:22Resolution 18: Optimize the process and no busy work!
21. 28:27The sky is always falling - we never celebrate success
22. 29:33Celebrate security wins.
23. 31:02Security tools are loud, obnoxious, and inaccurate
24. 31:48Tune the tools.
25. 33:11Summary of the ten resolutions.
26. 34:06Everyone, practice empathy
27. 34:20"Apply" Slide
28. 35:14Conclusion

" related talks

• 27mDevelopers Struggle with Application Security (and How to Make ...)S. Gerlach · OWASP 20th Anniversary 2021
• 20mThe road to developers' heartsSing Ambikapathi · BSidesSF 2024
• 28mWhy Developers Struggle with AppSecScott Gerlach · OWASP Global AppSec Virtual 2020
• 52mHow to Transform Developers into Security PeopleChris Romeo · NDC TechTown 2018
• 57mThe Developer's Field Guide to Software SecurityJennifer Janesko · NDC Oslo 2020
• 37mHow to get developers to want to adopt AppSecMatan Rabi · OWASP Global AppSec San Francisco 2024
• 17mWhy you fail at Application Security - and how to fix itFelix Winkelkötter · code.talks 2023
• 26mTop 10 Challenges for DevSecOpsGary Robinson · OWASP 20th Anniversary 2021