Application security teams are the side card to engineering. They have to be part of that development process to ensure that security is integrated. Hiring a good security engineer is tough, but supply is also not that many. Do we want to get more proactive in terms of blue teaming and purple teaming or red teaming? Or are we just going to stick to architecture and design? It really comes down to understanding what is your organization's tolerance for this kind of work.
“Building an application security program is about ensuring security is built into the software development lifecycle and how to respond to vulnerabilities."
Derek Fisher is the author of “Application Security Program Handbook”. In this episode, Derek shared about building an application security program and how to implement it in our organization. First, we discussed some security fundamental concepts, such as shift-left, CIA triad, and threat modeling. Derek then outlined how to start an application security program and measure the program’s success. Derek also touched on the security program maturity model and gave his tips on how to build and hire application security teams. Towards the end, Derek also gave his insights on how to address zero-day vulnerabilities when it becomes prominent.
Listen out for:
- Career Journey - [00:03:51]
- Building Application Security Program - [00:06:56]
- Shifting Left - [00:11:58]
- CIA Triad - [00:16:30]
- Threat Modeling - [00:19:04]
- Threat Classification - [00:22:49]
- Starting Application Security Program - [00:27:04]
- Security Program Maturity Model - [00:32:45]
- Building Security Teams - [00:35:27]
- Measuring the Program’s Success - [00:40:19]
- Zero Day Vulnerabilities - [00:42:48]
- 3 Tech Lead Wisdom - [00:44:59]
_____
Derek Fisher’s Bio
Derek is an award winning author of a children’s book series in cybersecurity as well as the author of “The Application Security Handbook.” He is a university instructor at Temple University where he teaches software development security to undergraduate and graduate students. He is a speaker on topics in the cybersecurity space and has led teams, large and small, at organizations in the healthcare and financial industries. He has built and matured information security teams as well as implemented organizational information security strategies to reduce the organizations risk. His focus has been to raise the security awareness of the engineering organization while maintaining a practice of secure code development, delivery, and operations.
Follow Derek Fisher:
_____
Our Sponsors
Are you looking for a new cool swag? Tech Lead Journal now offers you some swags that you can purchase online. These swags are printed on-demand based on your preference, and will be delivered safely to you all over the world where shipping is available. Check out all the cool swags available by visiting techleadjournal.dev/shop. And don't forget to brag yourself once you receive any of those swags.
Like this episode?
Show notes & transcript: techleadjournal.dev/episodes/138
Follow @techleadjournal on LinkedIn, Twitter, and Instagram.
Buy me a coffee or become a patron.
