AppSec’s Future and the Rise of the Chief Product Security Officer
summary
Claim: classic AppSec no longer scales and organizations must create a Chief Product Security Officer role to manage productized software, supply chains and APIs. Evidence: SolarWinds and hospital ransomware spur executive orders; Verizon finds 43% of breaches stem from apps and 70% of apps inherit OSS flaws. Concrete actions: publish SBOMs (seven core fields), run infrastructure as code checks (Terraform/CloudFormation), automate security-as-code in CI/CD, run PSIRT/vulnerability-disclosure/bug-bounty programs and chaos tests (Chaos Monkey/gauntlet) to reduce risk.
AI-written summary · about
chapters (20)
- 0:00Start
- 3:37A Pathos for Software Engineering...?
- 8:39SBOM IS COMING
- 9:06Software continues to eat the world
- 11:38Why do we need a Chief Product Security Officer (CPSO)?
- 13:53Module Overview
- 14:36CPSO Needs to Navigate 2 views of Software Security
- 17:14The Attack Surface is Growing Exponentially
- 20:11Technology Trends Impacting CPSO
- 21:02Ubiquitous Connectivity
- 21:43Abstraction & Componentization
- 22:40Supply Chain Security Becomes More Critical
- 23:15Example: Microsoft Security Development Lifecycle (MS SOL)
- 24:44COMPOUND PARTS
- 27:10Baseline Component Information
- 27:49Cloud Native Technology and Infrastructure-as-Code
- 29:12Scanning lac & Cloud Configuration Gives You Context
- 30:19Hyperautomation of Software Delivery
- 30:57Security-as-Code / Compliance-as-Code
- 31:53Patching in an "Everything-as-Code" World
related talks
42mAppSec is dead. Long live DevSecOps!
50mThe Application Security State of the Union
47mSecurity is Everybody's Job
31mTopics of Interest: Scaling AppSec through Education
49mKeynote: CISO Perspectives
26mHow to Build an Application Security Program
34mSupply Chain Security, SBOMs and How OSPOs Can Play An Important Role Going Forward - An Ecosystem and Compliance Update
38mKeynote: Dumping Traditional Security Teams