Internal AppSec Awareness and Education
summary
Seven-minute lightning advice condenses reproducible steps: buy an LMS with admin tools and HR integration, customize training to the top vulnerabilities observed, require a mandatory baseline course then offer hands-on followups, and measure success by coverage and quiz pass rates rather than raw vuln counts. Spin up security champions as volunteers with clear asks—Slack runs about 1:40 ratio and asks 2 hours/week—use JIRA orchestration for workflows and tools like Semgrep and Elevate for automation and tracking.
AI-written summary · about
chapters (14)
- 0:00Introduction
- 1:20AppSec Training
- 7:51Security Champions
- 14:34Training Software Engineers
- 15:20Teaching Security
- 15:57Tell a Story
- 18:04SQL Injection
- 19:25Root Cause
- 20:54Teaching both sides
- 21:54Questions
- 24:03Job Description
- 28:01AppSec Champions
- 34:43QA
- 37:12Product Security
related talks
47mSecurity is Everybody's Job
39mAppSec Survey 2.0 : FineTuning an AppSec Training Program Based on Data cut
31mTopics of Interest: Scaling AppSec through Education
29mAppSec on a budget
26mTopics of Interest: These are the Vulns You are Looking For: AppSec Champions & Jedi...
20mHow to Use Your Vulnerabilities to Train Your Developers on Security
21mWhy Unleashing Your Software Security Potential is Necessary & How to Achieve It
33mLearning from Past Security Breaches: Strengthening AppSec Efforts and Focus