Four Steps to Build a Customer-Centric Security Program

Summary

Semgrep’s Clint Gibler recommends making security a service for developers: provide self-service resources with security built in, embed staff across teams, make secure choices easy, and build capabilities that benefit the wider organization.

Key points

• Gibler argues security teams should work with developers as customers and help them build securely, rather than acting mainly as gatekeepers.
• Create self-service tools and resources that incorporate security-by-design into development workflows.
• Embed security staff in engineering or DevOps teams, and consider reciprocal job swaps to build collaboration and empathy.
• Make secure behavior easy to understand and adopt, minimizing extra steps for developers.
• Build shared capabilities, such as asset inventories and code scanning, that provide value to security and other teams.

People

Vendors