Sign in Subscribe

Leadership

A collection of 5 issues

Integrating Security With Agile Development

> "We're practicing agile, so that means we don't do any architecture or security planning" - A Project Manager I spoke with Agile is sometimes used as an excuse to bypass controls in large organizations. Fortunately, agile methodologies and security methodologies work really well

How I Built an Application Inventory for a Secure Development Program

When I first formed the Secure DevOps team, one of the first things I set out to do was to understand our software landscape. Our company has traditionally done a pretty good job of maintaining a list of all running IT applications (we use ServiceNow [https://www.servicenow.com/] and

Building a World Class Application Security Program

In this article, I will walk through setting up a modern appsec program from scratch. The goal is to help security professionals building a new application security program, but there should be plenty of ideas that can be adapted into existing programs as well. I'll start by looking

How To Hire Security Talent

I don't think it's quite as hard as most people make it out to be. I keep hearing from colleagues and articles that there is great difficulty in hiring a technical security people to work on application security, network security, or devsecops. If you want to

Successfully Starting a Secure DevOps / DevSecOps Program

When I was first asked to build a Secure DevOps program, I was excited about the possibilities for continuous security, and truly making an impact on our applications from the first line of code written. Over the following months, the difficult reality set in for me: Though there is no