2

I have been toying with the idea for a while now about doing my first talk, on my last project I was building a Risk Management portal for information security so I had to read all about Risk Management frameworks like NIST & COBIT etc I then had to learn about stuff like PCI & ISO27001.

I kept finding articles from NIST about password policies, user management etc and it really helped with building the application and making it more secure. You can find a lot of this infomation over at OWASP but again do developers know about OWASP ?

Now my question is would a developer be interested in me talking about how you could use the NIST documents to apply a good password policy or user management policy among other cool stuff into there application to make it more secure ? It wouldn't be code specigic more the principals....

If you want any more info to give me a better answer I would gladly edit, but right now I am at work and wanted to do a brain dump

closed as primarily opinion-based by Xander, TildalWave, schroeder, AJ Henderson, AviD Nov 20 '14 at 20:00

Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 2
    This is primarily opinion based, so I'm not sure how long it will stay open. I think it depends on the developer and their role. Some developers care about security, and others just do what's easy. I think overall it's a good step to make them listen anyway. Maybe subconsciously later they'll at least retain some of the information, and make them think twice when encountering those types of policies. – RoraΖ Nov 20 '14 at 14:22
  • Yeah, it's kinda tricky to ask such a thing on the stackexchange. Thanks for you help though, it's tricky though if I did the talk I don't want to tell people how to suck eggs. – OliverBS Nov 20 '14 at 14:27
  • 1
    I would try and keep them engaged. The best way to make people aware of good security practices/policies is to explain to them why they should care about it. For example, "If you don't implement good security practices you'll kill a puppy." And nobody wants to kill puppies. – RoraΖ Nov 20 '14 at 14:29
  • haha I like it, I guess I could show them the NIST way of implementing a good password policy and do some automated password cracking whilst I am talking about it and try and shock them with the results. – OliverBS Nov 20 '14 at 14:32
  • 2
    Highly opinion based. My personal take would be put together something short and sweet. Talk about bad issues you've seen. No names of course but the personal stories are more interesting. Then talk about how to fix the issues you found. End on a note of asking the audience for feedback. If they liked it they'll want you back for a bigger talk where you can go into details. – Paraplastic2 Nov 20 '14 at 15:16

Browse other questions tagged or ask your own question.