Product Security at Scale: Lessons from Comcast
summary
Covers Comcast’s product security program for a Fortune 50 organization, detailing how they use tools, security experts, and gamification to enable secure software development at large scale. Focuses on operationalizing those elements to manage the added complexity of running security across many products and teams.
AI-written summary · about
chapters (30)
- 0:00Intro
- 0:34Story
- 1:40Parenting and Product Security
- 5:51Why is Product Security Important
- 8:43Guiding Principles
- 10:30Lesson 1 Branding
- 11:22The 12 Practices
- 12:09Practices 1 3
- 12:25Practice 1 Standards
- 14:06Artisanship
- 16:53Initiative Onboarding
- 18:27Building and Security
- 18:37Vendor Security Assurance
- 19:38Threat Modeling
- 21:32Privacy Threat Model
- 22:42Privacy Impact Assessments
- 23:45Secure Coding
- 25:19Production Ready Security Assessments
- 26:04Lessons Learned
- 28:36Security Reviews
- 29:47Operations Security
- 30:06Continuous Vulnerability Management
- 31:09Incident Response
- 32:27Reporting
- 33:03Lessons from Comcast
- 33:38How it works
- 34:59Design decisions
- 37:29SDL coaching
- 38:05Selfassessment
- 41:57QA
related talks
47mBuilding Security In—DevSecOps
17mArchitecting a security data lake at enterprise scale
53mFrom DevOps to DevSecOps
15mSecuring the Cloud and Training Your Dragons
30mThe future of Dev[Sec]Ops transformation
31mPractical Guide to Frictionless Cloud Native Security for DevOps
31mThe Art of Cybersecurity Mastery: From Entry-Level to Staff+
45mHow Leading Companies Are Scaling Their Security