Pilots, Surgeons & Developers - Improving AppSec With Checklists
summary
Build a customized application security checklist tied to actual tech stacks and workflows, not vague rules: use do-list vs challenge response where appropriate, keep items short, actionable and highly relevant, and assign clear definitions of done. Leverage aviation and surgical patterns for team introductions and ownership, create multiple checklists (standard, high‑risk, incident), and track effectiveness by developer collaboration metrics and measure by phase caught for vulnerabilities. Use a 10‑item meta‑checklist to iterate with developers and management.
AI-written summary · about
chapters (19)
- 0:00Introduction
- 1:05Types of Problems
- 3:30Checklist Definitions
- 7:10Good Checklists
- 9:28Checklist Effectiveness
- 10:43Aviation Checklists
- 13:39Surgical Checklist
- 15:26Building a Checklist
- 16:37Ground Rules
- 20:28Checklists in Aviation
- 21:40Emergency Situations
- 22:40Collaboration
- 24:03Developers
- 27:02Antipatterns
- 27:51Simplicity
- 28:08Relevant
- 28:31Measurement
- 29:42Checklist Examples
- 30:51Checklist Criteria
related talks
31mManaging Unmanageable Complexity
33mLearning from Past Security Breaches: Strengthening AppSec Efforts and Focus
44mSecurity Practices Useful in Agile Development
57mThe Developer's Field Guide to Software Security
40mDevSecOps Guide to Bulletproof Your Development Workflow
46mThe Best Flaw Didn't Make Into Production
27mDevelopers Struggle with Application Security (and How to Make ...)
33mBattle Tested Application Security