How to get everyone to get on board with software security: practical tips and suggestions.
summary
Claims concrete wins: someone forces deep test coverage in a legacy app at the cost of a three‑month delay to a massive project and it pays off; small technical changes drive adoption like turn on static analysis only for SQL handling and add it to the build pipeline; hiring and training moves scale adoption — add security criteria to job ads and require OverTheWire badges before admin/commit privileges; buy learning products, chase tickets with devs, and measure runs‑on‑the‑board momentum.
AI-written summary · about
chapters (24)
- 0:00Intro
- 0:30Welcome
- 1:10Big achievements
- 4:55Start with the easy wins
- 8:57Runs on the board matter
- 11:14Building momentum
- 13:11Problem or opportunity
- 15:09Reporting storytelling messaging
- 16:25What outcomes can you attribute
- 17:00Storytelling mode
- 17:30Climbing the mountain
- 18:15Expect pain
- 18:50You need the team
- 19:59Technical strategy vs people strategy
- 21:36Build awareness familiarity motivation
- 22:03Specific actionable things
- 23:27What can we do
- 25:01Dealing with busy people
- 25:26Be a weed
- 25:39How to convince developers
- 26:01How to enable developers
- 26:27How to enable managers
- 26:49Conclusions
- 27:23Questions
related talks
37mHow to get developers to want to adopt AppSec
40mMaking Security an integrated part of the SW Dev Lifecycle
47mSecurity is Everybody's Job
03mGreat software is secure software
53mPractical tips for web application security in the age of agile and DevOps
31mPrioritizing Trust while Creating Applications
36m5 Steps to Drive Enterprise Software Security
01h 04mShifting Security Everywhere