How to Build a Product Security Roadmap

Summary

In this episode of Nucleus Shortcuts, host Adam Dudley discusses the concept of product security with Anshuman, a seasoned information security professional. Anshuman, currently a principal security engineer at 30 Madison, shares insights on building a product security roadmap, emphasizing the importance of prioritization and collaboration with stakeholders. He outlines key areas such as vulnerability management, security partnerships, and tooling and operations, advocating for a multi-year strategic plan. Anshuman's advice on ruthless prioritization and leveraging small wins to enhance security culture is highlighted as crucial for a successful product security program.

Takeaways

• 😀 Adam Dudley hosts the 'Nucleus Shortcuts' show, discussing product security and roadmaps for success with expert Anshuman.
• 🔒 Anshuman has over a decade of experience in information security, working at companies like Atlassian, Intuit, and Dell, and is currently a principal security engineer at 30 Madison.
• 🛡️ Product security is defined as a set of functions within an organization that ensures the protection of customer data and information against unauthorized access.
• 📈 Anshuman emphasizes the importance of establishing a shared understanding of risks among stakeholders and the role of a product security engineer in addressing these risks.
• 🚀 A product security roadmap is crucial for a successful product security program, helping to align stakeholders and prioritize security initiatives.
• 🔑 The product security function is divided into three major categories: vulnerability management, security partnerships, and security tooling and operations.
• 🔍 Vulnerability management focuses on dealing with discovered vulnerabilities, while security partnerships involve working closely with engineering teams to integrate security into the development lifecycle.
• 🛠️ Security tooling and operations involve deploying security scanners and ensuring the collection of valuable data to drive continuous improvement in security measures.
• 📝 A roadmap should be a multi-year plan, prioritizing smaller tactical projects that contribute to the overall strategic goals of improving the organization's security posture.
• 🤝 Anshuman suggests the term 'work streams' to describe the collaborative efforts of individuals representing various functions within an organization working towards a common project.
• 🌟 The key takeaway from the conversation is the importance of ruthless prioritization, thoughtful planning, and leveraging small wins to improve security strategy and culture.

Q & A

What is the main topic of the 'Nucleus Shortcuts' episode featuring Anshuman?

The main topic of the episode is product security and how to build a roadmap for success in this domain.

What is Anshuman's professional background according to the transcript?

Anshuman is an information security professional with over a decade of experience. He has worked as a principal security engineer at 30 Madison, a healthcare company, and has also worked for major companies like Atlassian, Intuit, and Dell.

What does Anshuman believe in with respect to the security community?

Anshuman believes in giving back to the security community. He has open-sourced several security tools and is a strong advocate for innovation and solving challenging security problems using new technologies and automation.

How does Anshuman define product security in today's modern enterprise?

Anshuman defines product security as a function within an organization that establishes processes and activities to set up tooling and security scanners to ensure that customer data or information handled by the company's products is protected against unauthorized access by malicious actors.

What are the three major categories that Anshuman suggests dividing the overall product security function into?

The three major categories are vulnerability management, security partnerships, and security tooling and operations.

What is the significance of having a shared understanding of risks among stakeholders in a product security program?

A shared understanding of risks is crucial for a founding product security engineer to align different stakeholders on what the organization faces and how the product security engineer plans to address these risks in a prioritized order.

What does Anshuman mean by 'work streams' in the context of product security?

Work streams, as described by Anshuman, refer to teams of individuals representing different functions within an organization working towards a common project or goal, which in this case is improving product security.

What advice does Anshuman give for successfully building a product security program?

Anshuman advises not to get overwhelmed, to practice ruthless prioritization, and to bring all stakeholders along on the journey for a successful product security program.

How does Anshuman suggest leveraging smaller wins to improve overall security strategy and culture?

Anshuman suggests being thoughtful about what to do and when, using smaller wins to progressively enhance the security posture of the organization and its culture.

Where can interested individuals find more information about Anshuman's work and thoughts on product security?

People can visit Anshuman's blog at anshumanbartia.com, follow him on Twitter at @anshuman_bh, or email him for collaboration and sharing ideas.

What is the key takeaway Anshuman wants people to have from the conversation about product security?

The key takeaway is the importance of ruthless prioritization and including all stakeholders in the journey to build a successful product security program.