How to transform developers into security people

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

SESSION ID:SESSION ID:
#RSAC
Christopher Romeo
How to Transform Developers into
Security People
HUM-R02F
CEO
Security Jour...

#RSAC
Agenda
Security Matters, Developer
Security is a Stretch for Developers
Four Developer Responses to Security
Securit...

#RSAC
Software is Eating the World

#RSAC
The Mindset of the “Average” Developer

#RSAC

#RSAC
Objections to Application Security
Speed Methodology No

#RSAC
Developers Security
We Already Have a ”Security Department”
Source: BSIMM-7

#RSAC
State of Developer Security
Security is a stretch. Security IQ is low.
Dev is first line of
defense.

#RSAC
Developers Are Not Monsters

#RSAC
The Goal
Developers that think like
security people.

#RSAC
The Security Person Mindset
Foundational
knowledge
Understand
attacks
Acknowledge
attacks
Utilize tools
and
processes

#RSAC
Start with Why
Source: Simon Sinek, “Start with Why”
SDL
Implementation
Guide
Why the heck are
we doing any of
this?...

#RSAC
The Security Culture Bell Curve
Security
people
Security
interested
Early
Majority
Forced
compliance
Probably never
...

#RSAC
1. Application security is
about the people.
2. The developers are the key.

#RSAC
Developer Responses
Unfamiliar Overworked Apathetic Gung Ho

#RSAC
Developer Response #1: Unfamiliar / Ignorance
1. “Why? like legit why do we need to do
security?”
2. “Don’t understa...

#RSAC
Action: Foundational Lessons
Security
Fundamentals
Attacks &
Attackers
Simple SDL
Security Myths
Privacy &
Customer ...

#RSAC
Action: Everyone is a Security Person

#RSAC
Developer Response #2: Overworked
1. “Too much other work to do”
2. “Management does not provide
time for security”
...

#RSAC
Action: Automation and Simplify

#RSAC
Action: Management / Executive Education

#RSAC
Developer Response #3: Apathetic / Complacent
1. “It's too hard. That sounds really
complicated.”
2. “It's someone e...

#RSAC
Action: Shock Value
11.5 million
documents
214,488
offshore entities
2.6 terabytes of
data

#RSAC
Action: Compliance

#RSAC
Developer Response #4: Gung Ho
1. “Where can we learn more about
security?”
2. “Is there someone that can
mentor me ...

#RSAC
Action: Build Security Community
Monthly
Training
Security Days
Internal Capture
the Flag
Conferences
Build a securi...

#RSAC
Who do you encounter the most?
Unfamiliar Overworked Apathetic Gung Ho

#RSAC
What is a Security Behavior?
Light weight
Well defined
Clear start and finish point
Clear definition of why it is im...

#RSAC
What is a security behavior NOT?
Step 1 Step 2 Step 3

#RSAC
Security Habits
Routine
Reward
Reminder

#RSAC
Learning

#RSAC
Experience

#RSAC
Community

#RSAC
Manager: Plan Resources
To Do Doing Done
Security Security

#RSAC
Threat Modeling

#RSAC
Code Review

#RSAC
Red Teaming

#RSAC
Response

#RSAC
Responses
Unfamiliar
Overworked
Apathetic
Gung Ho
Transforms
Knowledge
Automation /
Education
Shock Value /
Complian...

#RSAC
Apply What You Have Learned Today
Next week:
Assess your organizational security culture
Survey developer population...

#RSAC
Key Takeaways
1. Application security is a stretch for the average developer
2. Everyone has an excuse; break on thr...

#RSAC

#RSAC
Thank you!
Chris Romeo, CEO / Co-Founder / Principal
Consultant
chris_romeo@securityjourney.com
www.securityjourney....

Share Slideshare

LinkedIn
Facebook
Twitter

Embed

Size (px)

Show related Slideshows at end

WordPress Shortcode

Link

Share
Email

2024 Trend Updates: What Really Wor... by Search Engine Jou... 1063109 views
Storytelling For The Web: Integrate... by Chiara Aliotta 981811 views
Artificial Intelligence, Data and C... by OECD Directorate ... 923520 views
How to Leverage AI to Boost Employe... by SocialHRCamp 392340 views
2024 State of Marketing Report – by... by Marius Sescu 221896 views
Everything You Need To Know About C... by Expeed Software 237729 views

View on Slideshare

1 of 43 Ad

View on Slideshare

1 of 43 Ad