Sharing Security Secrets: How to Encourage Security Advocates
summary
Describes building an automated GitHub CI checks pipeline that runs security baselines early in the proposal/prototype phase, generates a report sent to service owners, and issues opened from scans so fixes fit normal developer workflow; lead time for manual security reviews falls from roughly two weeks toward a same-cycle fix and tier-blocking changes drop. Covers practical education: learn-to-hack workshops, anatomy-of-a-hack sessions, threat modeling, and project self-assessments for TAG/SIG security.
AI-written summary · about
chapters (8)
- 0:00Introduction
- 1:11Defining security advocates
- 6:06Strategies for management
- 9:33Individual contributor tips
- 16:07Case study at Shopify
- 20:58Security self-assessments
- 22:33Key takeaways and conclusion
- 25:07Q&A session
related talks
07mInterview
38mDevOps Meet Sec: Your Journey To Delivering Secure Code Fast
40mMaking Security an integrated part of the SW Dev Lifecycle
38mPrioritizing Trust While Creating Applications
47mSecurity is Everybody's Job
37mSecurity Doesn't Have To Be a Nightmare
11mLove Your Security Engineer as Yourself
40mDevSecOps Guide to Bulletproof Your Development Workflow