SDL at Scale: Growing Security Champions
summary
A security champions program that starts with less than one full‑time security person scales to ~20 dev teams by training volunteers, not mandating process changes: weekly CTF sessions to spark interest, a 90‑day waiting period before volunteering, onboarding with e‑learning, and a 2‑day classroom training that certifies champions to perform peer reviews focused on five controls (data validation, encoding, parameterization, logging, error handling). That handoff measurably shifts routine secure code reviews into teams.
AI-written summary · about
chapters (11)
- 0:00Start
- 1:53Building a Security Champions Program
- 4:17What Is a Security Champion
- 11:20Management
- 13:03Security Culture
- 14:31Second Post Conference Summaries
- 17:10Google's Cross-Site Scripting Game
- 25:24Define an Onboarding Process
- 26:14Kickoff Session
- 28:21Process Oriented Goals
- 28:55When Do We Need Security
related talks
54mSDL at Scale: Growing Security Champions
51mBuilding Security Champions
27mSecurity Champions: The What, Why, and How
37mBuilding Security Champions
36mChampioning Security: Scaling Security at Every Level
49mTransforming Security Champions
48mGrowing A Security Champion Program Into A Security Powerhouse
32mBeyond training: Building a high-impact security champions program