5 Steps to Drive Enterprise Software Security
summary
Claims a concrete five‑step program that gets budget and results: Characterize the landscape, Secure champions, Define standards and strategy, Execute, Sustain. Provides data points and tools: cites ~\$900M annual app‑sec scanning spend, typical AppSec team size ~3–5 versus thousands of developers, and a measured ~25% improvement from training; references ThreadFix community edition and work to feed data into OpenSAM/OWASP SAM. Argues most programs fail before day one without these artifacts.
AI-written summary · about
chapters (16)
- 0:00Intro
- 0:40Introduction
- 1:57First day of school
- 2:28The problem
- 3:57The incumbent spin
- 7:02Most apps tech programs fail
- 11:51Define the landscape
- 12:10Compliance frameworks
- 14:11Cultural drivers
- 16:38Protos principle
- 17:17Gap analysis
- 18:59Identify gaps
- 20:11Secure Champions
- 22:56Strategies and Standards
- 27:55PCI DSS
- 28:33Questions Answers
related talks
26mHow to Build an Application Security Program
57mKeynote: Maturing Your Application Security Program
01h 00mImproving the Chances of Success in Secure Software Development
41mAim-Ready-Fire
56mSo Long Secure Coding - Practical Steps for Securing the entire SDLC
42mBuilding an AppSec Program with a Budget of $0: Beyond the OWASP Top 10
47mSecurity is Everybody's Job
28mData-Driven AppSec Champions Programs – Benchmarking Your Program with Numbers