Lesson 4.55: Running a security champions programme
A security team of five can't review the work of two hundred engineers. A champions programme gives every development team one person who cares about security, knows when to ask for help and does the first review. Programmes fail quietly: teams without champions, champions with no time, activity that fades after the launch. In the lab you measure Northwind's programme from its own data: coverage, activity per champion, overloaded champions and the charter's missing incentives, and write next year's plan.
16 min
You will learn to
- Explain what security champions do and don't do
- Measure coverage by engineers, not teams
- Find inactive and overloaded champions
- Spot missing time and recognition in the charter
- Write a programme plan from data
Key terms
- Security champion
- A team member who promotes security in their team and links it to the security team.
- Coverage
- The share of engineers (or code) with a champion.
- Threat model
- A structured look at what can go wrong in a design (Intro 201).
- OWASP SAMM
- Software Assurance Maturity Model; includes education and guidance practices for programmes like this.
- Programme charter
- The document defining a programme's purpose, roles, time and rewards.
← Incident reporting deadlines · All lessons · Blameless post-incident reviews →