Mastering Security Requirements Engineering
summary
Explains how OWASP SAMM v2 frames security requirements as the foundation for architecture, testing and operations and recommends starting with ASVS and OWASP Top 10 to bootstrap measurable requirements. Shows concrete decisions—secret management alternatives (config, external service, HSM), patch testing tradeoffs tied to confidentiality vs availability, and contractual verification for vendors—then demands automated gates that break the build if critical security requirements fail so verification becomes mandatory.
AI-written summary · about
chapters (11)
- 0:00Introduction to talk
- 1:24Overview of OWASP SAMM
- 3:09Focus on security requirements
- 10:18Defining security requirements
- 13:30Starting with ASVS examples
- 15:17Verifying security requirements
- 18:29Common pitfalls in SRE
- 23:43Hiding requirements from testers
- 27:14Vendor security standards
- 29:05Next steps for improvement
- 32:34Recommended readings and Q&A
related talks
33mIntroduction to OWASP SAMM for Software Developers: Building Secure Software
55mBuilding a sustainable security requirements process with the ASVS
46mOWASP SAMM2: Your Dynamic Software Security Journey
39mHandling of Security Requirements in Software Development Lifecycle
52mAppSec: From the OWASP Top Ten(s) to the OWASP ASVS
37mDeploying Security Testing Practice in Your Team and Company
43mDesigning Security And Privacy: A Dev's Guide To Threat Modeling With OWASP SAMM
55mASVS Project