Duration: 0:00

32 views

0

Software development teams are facing a tsunami of new EU cybersecurity regulations, such as the Cyber Resilience Act and the NIS2 directive. In addition, there are increasing requirements to comply with cybersecurity standards, such as ISO 27001 for information security management systems or IEC 62443-4-1 for secure development lifecycle requirements in industrial product development. In this talk, an experienced cybersecurity consultant will demystify what these regulations and standards mean in practice for software teams, why it is often tedious and expensive to implement them, and why especially open-source projects lack realistic tools and practices for compliance. We will also discuss recommended ways to survive in the middle of this complexity. An emerging approach is to automate cybersecurity compliance by representing it in a plain text content format that can be managed in software version control similarly as code. We will discuss several examples of this emerging approach, including the Open Policy Agent, the NIST OSCAL ecosystem, and an open-source project that the speaker has co-founded. For whom: software developers, open-source project maintainers and contributors, product owners and other software project leaders. Previous cybersecurity knowledge is not required.