From Rogue One to Rebel Alliance: Building Developers into Security Champions
Talkat OWASP AppSec Europe 2018 · on Friday, 2018-07-06· at 11:00· Westminster- 4th Floor, QEII Centre Broad Sanctuary, Westminster·
summary
Nails a concrete solution: recruit two champions per team, train them with checklists, static analysis, guided secure code reviews and CTF practice, and measure before‑and‑after reductions in XSS/SQLi and time to fix. Cites surprising data—90% of breaches at the app layer and 80–95% of shipped code as open source—so champions own third‑party Bill of Materials, attend grooming to shift left, and join a maturity model; program scales by baking training, rewards, and spot‑checked peer reviews into team rhythm.
AI-written summary · about
chapters (26)
- 0:00Intro
- 1:35Overview
- 2:24Applications
- 3:37Security Champions
- 4:10AppSect Leaders
- 5:17Red Team
- 8:07Agile Process
- 9:41Testing
- 12:28The Problem
- 13:43Lack of Knowledge
- 14:24Lack of Accountability
- 16:48Job Description
- 18:22Recruiting Your Team
- 19:30Dont Overload Current Jobs
- 20:24Training
- 21:36Grooming Guidelines
- 22:38Code Reviewing
- 24:41Limits
- 29:05Defensive Rewards
- 30:16Understanding the Process
- 32:02Conclusion
- 33:18High employee turnover
- 34:43Start up limited resource environment
- 36:28Security grooming
- 39:52Who should be a Security Champion
- 41:34Who should be accountable
related talks
36mOD approach to the champions dilemma
54mSDL at Scale: Growing Security Champions
51mBuilding Security Champions
34mDecrease Your Stress and Increase Your Reach with Appsec Champions
32mSecurity Champions? Introduce them in your Organisation
36mChampioning Security: Scaling Security at Every Level
35mSDL at Scale: Growing Security Champions
27mSecurity Champions: The What, Why, and How