SDL at Scale: Growing Security Champions
summary
Claim: embedding two champions per team scales product security to agile release cadence. Program grows over 5 years using CTF sessions, lunch‑and‑learns and post‑conference summaries to recruit volunteers; a grooming guideline and an online wizard classify stories; a two‑tier review model plus e‑learning, a two‑day training and merge‑request exercises certify code reviewers. A product security maturity model, dashboards and a Slack guild track progress. Iteration fixes early failures and reduces the central team bottleneck.
AI-written summary · about
chapters (13)
- 0:00Program introduction
- 4:18Defining security champions
- 7:34Securing program buy-in
- 13:54Fostering security culture
- 19:13Selecting the right people
- 20:56Ideal champion qualities
- 25:22Defining champion tasks
- 28:12Phased program implementation
- 32:48Advanced training and roles
- 40:07Sustaining the program
- 46:07Monitoring and measuring
- 48:52Conclusion and Q&A
- 49:21Detailed Q&A session
related talks
35mSDL at Scale: Growing Security Champions
51mBuilding Security Champions
36mChampioning Security: Scaling Security at Every Level
27mSecurity Champions: The What, Why, and How
48mGrowing A Security Champion Program Into A Security Powerhouse
38mChampioning Security for your Agile Development
44mFrom Rogue One to Rebel Alliance: Building Developers into Security Champions
32mBeyond training: Building a high-impact security champions program