Loading…
Attending this event?
We have been working hard to secure the world through challenges and discovery. And now, it’s time to celebrate! Many of you have played a crucial role in the Foundation’s enduring history, and we encourage you to participate in the celebration coming this September! Our theme, Securing the Next 20 Years, is encouraging and exciting as we look ahead to the next 20 years!

Join us for FREE at this live 24-hour global event as we honor the past, celebrate the present, and embrace the future of OWASP and cybersecurity. Hear from world-renowned keynotes and special speakers, and network with your peers. It is FREE to attend, however, registration IS required, so please register today!

Back To Schedule
Friday, September 24 • 5:30pm - 6:00pm
These are the Vulns You are Looking For: AppSec Champions & Jedi Mind Tricks

Log in to save this to your schedule, view media, leave feedback and see who's attending!

Abstract:
AppSec champions program exist in virtually every organization that builds a ton of software and is security paranoid.   These programs use informal influence and the art of persuasion to get software developers to write more secure applications.  Many programs originate from the bottom up and lack strong organizational mandates – that’s where the Jedi Mind tricks come in.  

AppSec champions may be widely implemented, but in general there is a lack of data on what organizations are actually doing in the field. The results of a nine-month research survey attempt change that, with first-ever data of common denominators of leading-edge AppSec champions programs published. The structured research project involved 26 of the most innovative AppSec programs. Many, if not most, were operating in isolation with no benchmarking data or widely understood best practices.

This session will identify the common denominators that we observed in the survey respondents including emerging best practices around identification and recruiting of champions, how security organizations trained champions, and how they communicated with champions in the field. Finally, return on investment responses are included to provide insight into how organization are measuring success around their programs.

This data provides certain recommendations about how security leaders should further build these programs to get upstream of the “vulnerability production engine” that creates additional attack surface. An emphasis will be placed on how attendees can take the survey results and use them for further justification for their own programs.

We’re not remotely close to solving the secure development problem.  AppSec champions helps win the hearts and minds of developers who are ultimately the one who solve this issue.  The hope is that, armed with AppSec champions numbers and best practices, attendees will be better equipped to help their development colleagues via AppSec champions programs.

Speakers
avatar for John Dickson

John Dickson

VP, Coalfire
John Dickson is an internationally recognized security leader, entrepreneur and Principal at Denim Group, Ltd. He has nearly 20 years hands-on experience in intrusion detection, network security and application security in the commercial, public and military sectors. As a Denim Group... Read More →


Friday September 24, 2021 5:30pm - 6:00pm EDT
On-Line
Feedback form isn't open yet.