Jumpstarting Your Appsec Program
summary
Defines appsec as helping engineering write defensible code and release trustworthy software, and recommends starting with company goals, customers and stakeholders before buying scanners. Describes concrete moves used at Adobe: VP-nominated security champions with training and quick wins, automated environment discovery, plugging SAST/DAST into CI/CD (as gate or parallel scan depending on cadence), and a fact-based opinionated dashboard that links failures to Jira tickets. Emphasizes measurable KPIs, iterating them, and preferring integrations into existing dev workflows over separate security portals.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 2:50What are your goals
- 5:22Do your homework
- 12:19Cultural fit
- 13:59Tech team
- 18:09Security champions
- 21:15Environment observations
- 24:34Wrapup
- 25:34QA
related talks
49mAppSec, Ready, Set, Go!
57mWhat’s in an AppSec program?
57mKeynote: Maturing Your Application Security Program
08mRunning an Appsec Program with Open Source Projects"
26mHow to Build an Application Security Program
48mAppSec++ Take the best of Agile, DevOps and CI/CD into your AppSec Program
42mAppSec is dead. Long live DevSecOps!
28mWhy Developers Struggle with AppSec