KEYNOTE: Delivering software that is secure & usable - who’s job is it?
summary
Argues that poor security is a process problem not just user failure, backing it with concrete findings: historical studies where 80% failed PGP and organizational audits showing security rules people cannot follow, plus an empirical study where Stack Overflow leads to insecure code even as it speeds development. Offers fixes that have been tested: clean requirements and libraries, train security staff in collaboration and communication, rotate developers through support, add security to standups, and adopt socio-technical methods and metrics to measure real usability and effectiveness.
AI-written summary · about
chapters (10)
- 0:00Start
- 6:30Encryption?
- 8:43Impossible security (pace password policies)
- 11:00creates a ignore/circumvent habit
- 12:48or resignation/helplessness
- 14:21Security response: let's shout louder (aka security awareness, education, training)
- 15:07Back to the future - Kerkhoffs' principles
- 23:21Security-developer relationship
- 28:29Usable security in development practice
- 35:06Conclusions (1)
related talks
13mKeynote: Software Security: _You_ are the Calvary
43mOpening Keynote - Flipping the script
18mDesigning for Security Outcomes
49mKeynote: CISO Perspectives
03mGreat software is secure software
40mClosing Keynote: New Era of Software with modern Application Security
40mMaking Security an integrated part of the SW Dev Lifecycle
25mSecurity First