Scaling Application Security Program

Automating Software Security at Capital One, is an excellent articulation of the scaling application security program by wrapping the code assessment tools through API abstracted system and making it available as-a-service to developers in a polyglot environment.

Other key aspects that need to be considered in building scalable software security program:

• Make threat intelligence available for developers as it helps to democratize threat intelligence and helps track vulnerabilities in the software supply chain
• Enable everyone in the dev team (including coders, testers, technical writers, architects, product owners, scrum masters), to have access to a portal powered by Jupyter Notebook as threat testing workbench, to write a threat-model inspired test cases and linking that to security assessment tool (similar to what is attempted with BDD security). This would help keeping the threat model current and can help build a risk registry for the software product