10 Steps Every CISO Should Take to Secure Next-Gen Software

Foreword

My goal with this report is to ignite discussion and thought among a group of professionals who are hypervigilant about managing risk. Often managing risk takes a path of protecting the status quo. Yet, as the saying goes, no decision is a decision itself. Change will be necessary—and perhaps risky. Software development itself is changing rapidly and security programs must evolve if they are to be effective in this next generation of software. This report looks at the security implications involved in how software is changing: the code itself, the methodologies by which it is developed, and the infrastructure surrounding its use. I hope to provide some practical advice to help security leadership remain relevant—and maybe even become an innovative change agent—in this Agile world in which development speed is the holy grail.