- ID
- b858d863-f407-4d21-8169-8f4a106975cf
- ROAM_ALIASES
- "Presenation: Secure Code Review Checklist Manifesto"
Secure Code Review Checklist Manifesto
#+OPTIONS: num:nil toc:nil
#+REVEAL_TRANS: fade
#+REVEAL_THEME: 15five
#+Author: Colin Powell
#+Email: colin.powell@15five.com
We are implementing a secure code review process
Security checklist
Notifications to SWG
Coming soon: Automated security analysis
Why security?
Security factors
What are we protecting?
Losing data
Leaking private information
Why ware we protecting it?
Legal
+ Ask an SDR what the legal process is for bigger customers
Business
+ Personal data is an asset
+ We keep various types of confidential information
+ If we leak personal data, it's almost everything we have as a business
DONE Get current count of users (150K) - constantly growing
CLOSED:
Security factors in to everything we do
Secure code review is one puzzle piece of building secure code
We're giving everyone a checklist
A compensation tool because human memory and attention are both terrible
Also an education tool, increase self-awarness of our code security
Checklists DO improve outcomes
No one flies without pre-flight checklists
Can we use a checklist to improve our security?
Security Working Group is here to help
The checklist is a first step to interacting with SWG
We are expecting, hoping you'll reach out with questions as a result of the checklist
Will a checklist really help?
Each PR will come with a short checklist
DONE Add screenshot of checklist
CLOSED:
Your Security Working Group is asking you to try
#+begin_notes
#+end_notes
We're not sure!
#+begin_notes
+ But we have reason to believe this is a good first step.
+ Security can't be one person's job, it has to be everyone
#+end_notes