The Best Flaw Didn't Make Into Production
summary
Argues that developers must surface small security changes as actionable tickets using existing issue trackers (JIRA) tied to tiny, testable checklists and just‑in‑time training; checklist items are written as if you did this then do that triggers that create notable security events for threat‑model updates, tests, docs or deployment changes. A pilot shows more developer clarity, mined tickets that become learning data, fewer late fixes and reduced interruptions when management enforces the checklist.
AI-written summary · about
chapters (32)
- 0:00Intro
- 0:18Welcome
- 1:22The Development Process
- 4:23Security Tools
- 4:52CV Counts
- 5:42Threat Modeling
- 8:00Bob Alice
- 8:26Bob Tizen Board
- 8:51SQL Injection
- 10:04Buffer Overflow
- 10:50Change of Culture
- 11:51The Problem with Problem
- 13:31Security Objectives
- 15:37Notable Security Events
- 17:26Expanded Documentation Changes
- 19:26Developer Time
- 23:29Training Module
- 24:56Key of Competence
- 25:55Learning to Apply
- 27:18Training Material
- 27:43JustInTime Learning
- 29:05We Not This Way
- 29:57Checklist Manifesto
- 31:31The Checklist Manifesto
- 33:13Checklist Criteria
- 34:13Security Events
- 34:51The Experiment
- 36:23The Overload
- 37:19Why Not Code Reviews
- 40:37Effects
- 42:36Collab
- 43:26Justintime training
related talks
27mDevelopers Struggle with Application Security (and How to Make ...)
40mMaking Security an integrated part of the SW Dev Lifecycle
01h 04mShifting Security Everywhere
33mPilots, Surgeons & Developers - Improving AppSec With Checklists
45mBringing Security Testing To Development: How To Enable Developers To Act As Security Experts
46mApplication Security in an Agile World
48mGamify your Security
28mFrom Cockroaches to Marble Floors