I'm currently working on SDLC security. There's lots of different pieces: peer review, secure code review, threat modelling, training, secure patterns, coding

I'm currently working on SDLC security. There's lots of different pieces: peer review, secure code review, threat modelling, training, secure patterns, coding standards, static and dynamic analysis, software composition analysis, build pipeline security, and pen testing! And a bunch of other things to think about. In terms of the developer facing stuff, I'm keen not to repeat the sins of the past where security teams dump a whole load of well-meaning but practically useless stuff on them. As I say, I've been on the other side of the fence. Management and compliance people want assurance that devs are aware of relevant secure coding techniques and pitfalls, but they tend to glom on to big, well known standards, even if half of it isn't useful. I like the idea of finding coding examples relevant to the tech they use, that demonstrates insecure and then secure patterns. For the things that actually make a difference... And then to link the secure coding standards to that as well. Join it up, keep it relevant and practical. Then I just have to demonstrate that this actually meets what the compliance people want to see...