Security Metrics: Protecting Our Digital Assets of the Future

on YouTube ↗25m

" summary

A concrete metric is defined: defect density (vulns per million LOC) and used to align dev and execs; a concrete target of 20% reduction goal achieved across customer‑facing sites within a calendar year. Pen testing operates as a measurable service (Cobalt PTaaS) and analysis draws on 1600+ pen tests (2020) showing security misconfiguration as the top recurring finding for four years, and that the same top five vulnerabilities persist despite known fixes.

AI-written summary · about

" chapters (18)

1. 0:00Intro
2. 1:19Agenda
3. 2:21Carolines Background
4. 3:35eBay Example
5. 6:24Security Metrics Book
6. 6:53BSIM Assessment
7. 7:39Why Security Metrics Are So Hard
8. 9:32Cybersecurity is not impossibly complex
9. 10:30Four basic building blocks
10. 10:50Business metrics
11. 14:00Risk management objectives
12. 16:11Expansion objectives
13. 20:40Five minutes
14. 20:50Equifax breach
15. 22:12State of Pen testing
16. 23:08Ptas Platform
17. 24:14Free LinkedIn Course
18. 24:34Outro

" related talks

• 50mSoftware Security MetricsCaroline Wong · OWASP AppSec California 2016
• 27mProduct Security Vulnerability Management Metrics are HardSonny van Lingen · 33rd Annual FIRST Conference (Virtual Event)
• 53mMetrics that Matter.Confidence & Resilience in Your Security ProgramJohn Burger · BSides Tampa 2021
• 40mCybersecurity Metrics Development for Board and Risk Committee ReportingRichard White · RSAC 2021
• 47mSecurity is Everybody's JobAkira Brand · Software Architecture fwdays'22
• 45mBringing Security Testing To Development: How To Enable Developers To Act As Security ExpertsAchim D Brucker · OWASP AppSec Research (AppSecEU) 2015
• 52mContinuous SecurityLaura Bell · NDC Sydney 2017
• 46mBenchmarking AppSec Across IndustriesChris Eng · OWASP AppSec California 2016