Skip to content

Included risk appetite for white belt #129

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
vbakke wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Included risk appetite for white belt #129

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions white/onboard-management-in-security.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,11 +7,13 @@ Software vulnerabilities might be exploited when shipped into production. This r
- Convince your Product Owner to spend some time to roughly assess the current security of your product (e.g., collecting all security-related incidents and bugs).
- Identify the persons who are judging "risks vs. revenue".
- Raise the awareness of these persons (e.g., show how easy it is to exploit software).
- Ask about their "risk appetite". It is a language then might be more familiar with, and gives you another view point to understanding what risk is aceptable and where to focus.
- Convince these persons that security is a continuous effort and that Security Belts are a cost efficient solution (e.g., by showing the results of your assessment).

## Benefits

- The Product Owner is aware that software can have security vulnerabilities.
- Understanding the management's risk appetite, it is easier to translate your concerns to the mindeset of the management.
- Resources are allocated to improve in security - to avoid, detect and fix security vulnerabilities.
- Management can perform well informed decision when judging "risks vs. revenue".
- The Product Owner has transparency on how secure the product is.
Expand Down