Using developer-centric data to improve Application Security Outcomes - Laura Bell Main

Using developer-centric data to predict, prioritize, and improve Application Security Outcomes - Laura Bell Main This talk was recorded at NDC Porto in Porto, Portugal. #ndcporto #ndcconferences #developer #softwaredeveloper Attend the next NDC conference near you: https://ndcconferences.com https://ndcporto.com/ Subscribe to our YouTube channel and learn every day: / @NDC Follow our Social Media! https://www.facebook.com/ndcconferences https://twitter.com/NDC_Conferences https://www.instagram.com/ndc_conferences/ #security #bigdata #software Most application security programs and initiatives stem from the security team and are passed to development teams. They are born outside the constraints and realities under which software is built. More often than not, these initiatives encounter resistance, friction, or challenges that impact their sustainability and effectiveness, mainly when applied to larger development organizations. These challenges are visible when reviewing the progress and evolution of DevSecOps approaches over the past ten years and how our teams have reverted to more siloed approaches despite the solid intentions and patterns defined within the DevSecOps concept. Using data about our software teams, their behaviors, lifecycles, and projects, can we identify which application security initiatives to implement first and which are most likely to succeed and improve overall outcomes? In addition to this, can taking a developer-centric view of these programs encourage meaningful collaboration between security and software teams based on shared contextual understanding?