Costs of Coding to Compliance
summary
Compliance-first projects leave measurable gaps: consulting engagements find most orgs at preliminary maturity with none reaching predictable or innovating, asset inventories missing and no data flow diagrams so basic scope is unknown. Surveys show 29% still compliant after attestation while 71% lapse, and attackers exploit misconfigured access so 39% breach via remote access. Concrete fixes that worked in engagements include MFA correctly implemented, VPN plus segmentation, developer training, and incremental adoption of Microsoft SDL principles.
AI-written summary · about
chapters (21)
- 0:00Intro
- 1:29Security vs Compliance
- 2:56Most Significant Driver
- 5:52Least Resistance
- 6:58Security Metrics
- 8:01Security Maturity Model
- 10:14Customer Story
- 12:49Building a Gate
- 13:23PCI Compliance
- 14:21Multifactor
- 15:11Theres no easy button
- 15:35Culture shift
- 18:21People problem
- 19:23Compliance tree
- 20:17Red Rover
- 22:36Security to Compliance
- 24:35Security Lifecycle Development Cycle
- 26:18Bring in HR
- 26:43Next steps
- 28:30Contact information
- 28:51Response to developers
related talks
41mAim-Ready-Fire
44mMission Possible: 24 Hours To Save The World With Security Compliance
31mAlleviating the Fear in Preparing for Information Security Compliance
22mBridging Compliance and Innovation: A Guide for DevOps Leaders
47mSecurity Trends and the Economics of “Better”
56mSo Long Secure Coding - Practical Steps for Securing the entire SDLC
44mCompliance by Design | Continuous Compliance
54mCompliance-As-Code For API Security