Security experts are mainly specialized in tools. I would say that I agree with your opinion as well that we should hire security engineer with some development background. If you can prevent security issues in the earlier phase, again, coming back to the shift left, I think that makes a lot more impact. The amount of time it takes to remediate a vulnerability is also a critical indicator of how successful the program is.
“Building an application security program is about ensuring security is built into the software development lifecycle and how to respond to vulnerabilities."
Derek Fisher is the author of “Application Security Program Handbook”. In this episode, Derek shared about building an application security program and how to implement it in our organization. First, we discussed some security fundamental concepts, such as shift-left, CIA triad, and threat modeling. Derek then outlined how to start an application security program and measure the program’s success. Derek also touched on the security program maturity model and gave his tips on how to build and hire application security teams. Towards the end, Derek also gave his insights on how to address zero-day vulnerabilities when it becomes prominent.
Listen out for:
- Career Journey - [00:03:51]
- Building Application Security Program - [00:06:56]
- Shifting Left - [00:11:58]
- CIA Triad - [00:16:30]
- Threat Modeling - [00:19:04]
- Threat Classification - [00:22:49]
- Starting Application Security Program - [00:27:04]
- Security Program Maturity Model - [00:32:45]
- Building Security Teams - [00:35:27]
- Measuring the Program’s Success - [00:40:19]
- Zero Day Vulnerabilities - [00:42:48]
- 3 Tech Lead Wisdom - [00:44:59]
_____
Derek Fisher’s Bio
Derek is an award winning author of a children’s book series in cybersecurity as well as the author of “The Application Security Handbook.” He is a university instructor at Temple University where he teaches software development security to undergraduate and graduate students. He is a speaker on topics in the cybersecurity space and has led teams, large and small, at organizations in the healthcare and financial industries. He has built and matured information security teams as well as implemented organizational information security strategies to reduce the organizations risk. His focus has been to raise the security awareness of the engineering organization while maintaining a practice of secure code development, delivery, and operations.
Follow Derek Fisher:
_____
Our Sponsors
Are you looking for a new cool swag? Tech Lead Journal now offers you some swags that you can purchase online. These swags are printed on-demand based on your preference, and will be delivered safely to you all over the world where shipping is available. Check out all the cool swags available by visiting techleadjournal.dev/shop. And don't forget to brag yourself once you receive any of those swags.
Like this episode?
Show notes & transcript: techleadjournal.dev/episodes/138
Follow @techleadjournal on LinkedIn, Twitter, and Instagram.
Buy me a coffee or become a patron.
