Posted inSecure Software Development
Is Shift Left Dead?
Recently, the term “Shift Left” has faced much criticism in the security community, with some suggesting “it’s time to stop shift left“, “shift left starts to rust”, or even calling it a “dirty word“. This raises an obvious question: does…
Posted inSecurity Test Automation
What You Should Consider Before Choosing a New AppSec Tool
Tools play an important role in an effective AppSec strategy. However, tools alone can only…
Solving the AppSec Governance Disconnect
An often-seen anti-pattern in software architecture is the Ivory Tower Architect. It describes architects who…
Posted inSecure Software Development
Shift-Up Strategies for Elevating Product Security as a Management Priority
Since “shift-left”, and also and “shift-right”, have increasingly been taken over as marketing terms, I…
Posted inSecure Software Development
A Guide to Organizational AppSec Functions
With OWASP SAMM, BSIMM, and NIST SSDF, there have been excellent resources for some time…
Posted inSecure Software Development
Positive Security Culture in Software Development
The significance of a positive security culture is more crucial than ever in times of the increasing complexity of business applications and threats. But what does this practically mean? Here are some indicators for a product-oriented development organization that I…
Implementing Smart Security Gates in Modern Software Development
In modern software development, there is a strong emphasis on aspects like speed and productivity.…
Posted inSecure Software Development
Why Security Champions Are Not the Silver Bullet
Security Champions have been a proven and popular security practice over the years. We’ve learned…
Posted inSecure Software Development
Secure Software Lifecycle Management (SSLM)
The concept of integrating security into the software development process is not new. While I…
Posted inSecure Software Development
Shifting Security Left by Sharing Ownership & Responsibilities
Many discussions on how to shift security left in the SDLC, or about implementing DevSecOps…