Software Security for the 99%: Realistic Approaches

Industry conferences and professional literature give examples of successful software security programs, but those examples are usually of the largest, most security-conscious companies in the marketplace. These Wall Street banks and independent software vendors, such as Microsoft and Adobe, have mature software security programs that have been in place for years and have driven best practices for developing more secure code. Benchmarking tools capture successes of these companies, but leave most organizations wondering, “What about us? How can we build a software security program on a limited budget, with little resources?” Unfortunately, the state of software security outside these top companies is vastly different. In many organizations, software security champions still struggle to justify resources and head count, and find themselves substantially behind their more sophisticated companies. What can a security leader reasonably do to build a successful software security program in the small enterprise or upper mid-market space? What can they do to build more secure code when regulatory scrutiny or the publicity of product breaches is not yet a business consideration? This presentation will represent what these companies are doing, and what one can do to define success.