Effective security on a tight budget
summary
A practical framework prioritizes compliance, consistent hygiene (patching all systems, 2FA, vulnerability management), posture measurement (threat modeling, risk register, fuzzing, bug bounties) then resilience (zero trust, assume‑breach) and only after that novel red‑team work. Funding levers include declaring team boundaries and charging product teams for shifted‑left tooling, making headcount and vendor budget fungible, using a rule of three vendor evaluation, and sizing staff roughly 2% rule or one engineer per program before hiring specialized red teams.
AI-written summary · about
chapters (6)
- 0:00Introduction and context
- 1:43Pyramid of security needs
- 10:01Resource allocation strategy
- 11:53Securing additional funding
- 16:42Scaling and development
- 21:35Q&A and concluding remarks
related talks
33mSecurity on a Shoestring: A Low-Budget Security Revival Tour (Jared Casner)
45mHow to win friends and influence your security team
48mSecuring Buy-In for Security Budgets
29mDoing More with Less: DevSecOps on a limited budget
01h 03mBe your own Threatbuster!
01h 04mShifting Security Everywhere
27mBridging the Dev-Sec divide: Three tips for agile developers
31mPrioritizing Trust while Creating Applications