Running your program

Once you have established your program’s goals and identified your stakeholders, you can start running your program. To do that, first and foremost, you need a team composed of the right people for the job. The trick is to find the right people; let’s look at some approaches.

Building your teams

First up, you need to build your own team who will work to achieve your objectives. Adam Shostack has written an excellent blog on the topic (see Further reading), and his perspectives reflect my reality of having built several large-scale AppSec programs. The key point is the hardest one to grasp: to build an AppSec team, you do not need a team of AppSec specialists. Shostack expresses it perfectly: “by using exceptional talents doing over-specialization.” While securing software has an obvious technical element to it, by far, the biggest challenges are human-centric. You will, above all else, require the buy-in and cooperation of your...