Shifting from Syntax to Secure Software Development Processes
summary
Conference data shows security teams are tiny — examples range from 2 security people for 1,000 engineers to 3 security people for 150,000 devs — so shift from “secure code” to process: run threat models (OWASP threat dragon), pick controls, treat third‑party libraries as inherited risk (60% of code is external; npm deps average nine lines), use Dependabot, truffleHog and GitHub Actions, add one cucumber-style security test per sprint, avoid 3‑hour blocking scanners, and create incident playbooks (exercise them; logs ran out after six months in a real scenario).
AI-written summary · about
chapters (11)
- 0:00Intro
- 3:51AppSec
- 6:23World is not as mature as we think
- 7:46SDLC
- 11:12Design
- 19:25Code
- 24:14Test
- 31:15Deploy
- 35:30Support
- 42:50Summary
- 43:39Outro
related talks
56mSo Long Secure Coding - Practical Steps for Securing the entire SDLC
01h 02mSo long secure coding... Hello secure development!
01h 04mShifting Security Everywhere
52mSo Long Secure Coding - Practical Steps for Securing the entire SDLC
52mHow to Transform Developers into Security People
47mSecurity is Everybody's Job
43mDeveloper Driven Security In High-Growth Environments
53mFlipping the Script on Application Security