The ultimate thing will be the zero-day vulnerabilities, right? Whenever it's found and how long does it take for the organization to actually take an action? Maybe in your opinion, you are in this security space a lot more. How should people build this kind of zero-day capability? I'll go back to the SCA example, the software composition. We can develop software and we can have zero vulnerabilities when that the software goes out into production. The next day, some component that we pulled in from a repository could be vulnerable,. Whether it's a zero-day or whether it's an identified public vulnerability.
“Building an application security program is about ensuring security is built into the software development lifecycle and how to respond to vulnerabilities."
Derek Fisher is the author of “Application Security Program Handbook”. In this episode, Derek shared about building an application security program and how to implement it in our organization. First, we discussed some security fundamental concepts, such as shift-left, CIA triad, and threat modeling. Derek then outlined how to start an application security program and measure the program’s success. Derek also touched on the security program maturity model and gave his tips on how to build and hire application security teams. Towards the end, Derek also gave his insights on how to address zero-day vulnerabilities when it becomes prominent.
Listen out for:
- Career Journey - [00:03:51]
- Building Application Security Program - [00:06:56]
- Shifting Left - [00:11:58]
- CIA Triad - [00:16:30]
- Threat Modeling - [00:19:04]
- Threat Classification - [00:22:49]
- Starting Application Security Program - [00:27:04]
- Security Program Maturity Model - [00:32:45]
- Building Security Teams - [00:35:27]
- Measuring the Program’s Success - [00:40:19]
- Zero Day Vulnerabilities - [00:42:48]
- 3 Tech Lead Wisdom - [00:44:59]
_____
Derek Fisher’s Bio
Derek is an award winning author of a children’s book series in cybersecurity as well as the author of “The Application Security Handbook.” He is a university instructor at Temple University where he teaches software development security to undergraduate and graduate students. He is a speaker on topics in the cybersecurity space and has led teams, large and small, at organizations in the healthcare and financial industries. He has built and matured information security teams as well as implemented organizational information security strategies to reduce the organizations risk. His focus has been to raise the security awareness of the engineering organization while maintaining a practice of secure code development, delivery, and operations.
Follow Derek Fisher:
_____
Our Sponsors
Are you looking for a new cool swag? Tech Lead Journal now offers you some swags that you can purchase online. These swags are printed on-demand based on your preference, and will be delivered safely to you all over the world where shipping is available. Check out all the cool swags available by visiting techleadjournal.dev/shop. And don't forget to brag yourself once you receive any of those swags.
Like this episode?
Show notes & transcript: techleadjournal.dev/episodes/138
Follow @techleadjournal on LinkedIn, Twitter, and Instagram.
Buy me a coffee or become a patron.
