Security Culture Hacking: Disrupting the Security Status Quo
summary
Profiles anonymous orgs vs external story, offers 15 hacks and a 30-60-90-1-year plan that were used at scale (examples from 5 to 25,000 developers), points to tooling and frameworks like OpenSAM and OWASP Proactive Controls, and measures success with concrete numbers — especially a shrinking time-to-fix metric, coverage of security champions, and counts of threat-models or community activities. Concrete tactics include office hours, gamified belts, internal hackathons/bug bounties, executive demos, and rewards.
AI-written summary · about
chapters (25)
- 0:00Start
- 3:03The reality of security culture
- 5:07Security culture goals
- 6:29Avoid the security status quo
- 7:30Security culture hacking takes time...
- 8:32The security culture hacker "way"
- 10:48Strategy
- 11:24Basic hacks
- 11:52Learn the methodology and lingo of the groups
- 14:40Work all the levels
- 16:10Build deliberate security community
- 17:04Host monthly training for anyone and security office hours
- 19:34Host a security focused hack-a-thon
- 20:55Use modern approaches to teach security
- 21:47Gamify and provide a path with security education
- 22:44Send reward and recognition e-mails and give away cash.
- 23:53Teach the OWASP Top 10 over lunch
- 24:21Unleash the OWASP Proactive Controls one per month
- 25:02Threat model
- 25:21Give them something to break
- 26:10Executive specific hacks
- 27:03Break whatever you build in front of your Executives
- 28:04Measuring security culture change
- 28:57Security culture hack summary
- 30:25Resources
related talks
24mConcrete Steps to Create a Security Culture
37mSecurity Culture Hacking: Disrupting the Security Status Quo
52mContinuous Security
31mThe Art of Cybersecurity Mastery: From Entry-Level to Staff+
25mWhat Does it Mean to Build a Proactive Security...
46mCultivating a Security-First Culture in Tech Organizations
36mChampioning Security: Scaling Security at Every Level
33mRapid-Fire Stories of Creative Solutions to InfoSec Problems