Security Champions LeaderBoard - Building and Gamifying the Security Culture at Your...
summary
Built a company-wide security champions leaderboard that awards points and levels for actions (identifying or fixing P0/P1s, completing training) and integrates via a Slack command Kudos plus public profiles and weekly posts. Tools and defaults include Pulumi modules, AWS Secrets Manager and an internal privatebin; cloud tooling mentioned: Prowler, Cloud Custodian, Vazu, AWS Security Hub. Case studies: 50–60 engineer fintech with culture gaps and Pegasus Airlines exposure of ~6.5 TB / millions of files. Outcome: faster bug triage, more volunteers for CTFs and easier identification of champions via a weekly leaderboard.
AI-written summary · about
chapters (12)
- 0:00Introduction
- 1:46Security Champions leaderboard matters
- 2:50Singaporean fintech case study
- 7:42Pegasus Airlines data exposure
- 9:48Security awareness gaps
- 10:09Security engineers' challenges
- 11:42Shift left culture
- 13:50Gamifying security with leaderboard
- 15:58How leaderboard works
- 19:09Results and benefits
- 20:54Future plans and rewards
- 21:38Q&A
related talks
48mGrowing A Security Champion Program Into A Security Powerhouse
51mBuilding Security Champions
27mSecurity Champions: The What, Why, and How
32mSecurity Champions? Introduce them in your Organisation
32mBeyond training: Building a high-impact security champions program
40mSecurity Champions: Drive Innovation by Creating Future Cyber Workforce
48mSecurity Champions And Experiments: Building Blocks For Cultural Change
20mBuilding security culture on infrastructure teams