Topics of Interest: Scaling AppSec through Education
summary
Claims that security teams are outnumbered 100:1 and that 50–80% more bugs surface in code review than in testing drive a programmatic approach: measure security defect density, run automated security tests on every commit (ZAP is named as a Level 1 tool), train developers with the OWASP ASC curriculum and Cornucopia card game, map ASVS and SAM requirements into teachable modules using Bloom’s taxonomy, and build self‑service product security engineering (SRE‑style) platforms to push fixes faster and prevent implementation CVEs from reaching production.
AI-written summary · about
chapters (6)
- 0:00Start
- 2:27Iso Iec 25010 the System and Software Quality Model
- 17:33Secure Software Development Training
- 19:03New Top 10
- 21:55Authentication
- 30:37What Does the Future Hold
related talks
47mSecurity is Everybody's Job
30mThe AppSec Error Loop: How We Can Stop Repeating Common Security Mistakes
30mAppSec in a DevOps World
17mWhy you fail at Application Security - and how to fix it
57mThe Developer's Field Guide to Software Security
37mHow to get developers to want to adopt AppSec
57mKeynote: Maturing Your Application Security Program
40mMaking Security an integrated part of the SW Dev Lifecycle