Org Web Adapter

Editing pages/presenation_secure_code_review_checklist_manifesto.org

:PROPERTIES:
:ID:       b858d863-f407-4d21-8169-8f4a106975cf
:ROAM_ALIASES: "Presenation: Secure Code Review Checklist Manifesto"
:END:
#+Title: Secure Code Review Checklist Manifesto
#+OPTIONS: num:nil toc:nil
#+REVEAL_TRANS: fade
#+REVEAL_THEME: 15five
#+Author: Colin Powell
#+Email: colin.powell@15five.com

* We are implementing a secure code review process
** Security checklist
** Notifications to SWG
** Coming soon: Automated security analysis
* Why security?
** Security factors
** What are we protecting?
*** Losing data
*** Leaking private information
** Why ware we protecting it?
*** Legal

+ Ask an SDR what the legal process is for bigger customers

*** Business

+ Personal data is an asset
+ We keep various types of confidential information
+ If we leak personal data, it's almost everything we have as a business

**** DONE Get current count of users (150K) - constantly growing
CLOSED: [2022-07-29 Fri 22:24]

** Security factors in to everything we do
** Secure code review is one puzzle piece of building secure code
* We're giving everyone a checklist
** A compensation tool because human memory and attention are both terrible
** Also an education tool, increase self-awarness of our code security
** Checklists DO improve outcomes
*** No one flies without pre-flight checklists
*** Can we use a checklist to improve our security?
** Security Working Group is here to help
*** The checklist is a first step to interacting with SWG
*** We are expecting, hoping you'll reach out with questions as a result of the checklist
* Will a checklist really help?
** Each PR will come with a short checklist
*** DONE Add screenshot of checklist
CLOSED: [2022-07-29 Fri 22:24]

** Your Security Working Group is asking you to try

#+begin_notes
#+end_notes

** We're not sure!

#+begin_notes
+ But we have reason to believe this is a good first step.
+ Security can't be one person's job, it has to be everyone
#+end_notes

*** The success will depend on everyone in Engineering helping to improve the process
*** Checklists get better with constant criticism and input from users
*** You can send us feedback via Slack and a Google Form we'll be sending out
** How can I learn more about the entire secure code review process?
*** Glad you asked!
*** Quip doc with documentation on particular efforts
*** Details of specific types of threats