Maturing Your Application Security Program
A practical three-tier maturity model for evolving application security programs beyond intimidating compliance frameworks.
Summary
Demystifying AppSec Maturity Models
Standard security maturity frameworks often present overwhelming requirements that discourage teams in the early stages of building an application security program.
Three Stages of Program Maturity
Drawing on experience across hundreds of organizations, the session outlines three distinct phases of AppSec evolution, from ad-hoc vulnerability patching to structured tooling and proactive developer empowerment.
Actionable Steps for Progression
Practical guidance focuses on incremental improvements, establishing developer security champions, integrating baseline automation, and measuring measurable risk reduction.
Related talks
App Sec Village·45 min
Mario Areias
Uses an iconic sci-fi battle station case study to teach structured threat modeling and architectural risk analysis.
OWASP Foundation·46 min
Industry experts analyze emerging threats surrounding APPSEC Cali 2018 - The Bug Hunter's Methodology 2.0.
Creator Stage·59 min
Nikhil Shrivastava · Charlie Waterhouse
Shares insights from ten years of bug bounty hunting, focusing on bug chaining strategies and collaboration between hunters and triage teams.