A Dancefloor that is Literally Just Banana Peels – AppSec Awareness Program Pitfalls
summary
Practical takeaways: awareness works only when it targets actual stacks, measures baseline and progress, and has an owner and budget; a surprising 1:200 expert to developer ratio means resources must scale differently. Build hands-on activities—Juice Shop + FB CTF tournaments, gamified courses, vulnerable-app links like Hack Yourself First or Nexus Game—and track retention not just completion; yearly compliance-only training yields 100% completion but rapid knowledge decay. Use risk-to-money cases or compliance to win sponsorship, then map metrics to goals.
AI-written summary · about
chapters (12)
- 0:00Intro
- 1:13AppSec Awareness is an integral part of an AppSec Program.
- 2:30A story about the mistakes I made while implementing an AppSec Awareness Program
- 3:00Get stuck without even starting...
- 3:16Where to start? awareness program training FOWASP
- 6:38Speak the same language Assess the audience and adjust the material
- 10:24Compare the options and make an objective decision!
- 11:01Security is the job of the security team...
- 17:06Make trainees read tons of text or watch long videos
- 21:54Turnover and team growth decreases the training coverage.
- 25:16When compliance is the only driver
- 26:50AppSec training is a project without an end.
related talks
20mPlay, Learn, Secure: The Power of Gamification in Security Training
28mSecurity Does Not Need to Be Fun: Ignoring OWASP to Have a Terrible Time
36mApp Security Does Not Need To Be Fun: Ignoring OWASP To Have A Terrible Time
30mSecurity by Stealth
20mHow to Use Your Vulnerabilities to Train Your Developers on Security
31mTopics of Interest: Scaling AppSec through Education
39mInternal AppSec Awareness and Education
33mLearning from Past Security Breaches: Strengthening AppSec Efforts and Focus