Oftentimes motivating security champions is a challenge. Most of the time, they're not willing to dedicate the time and effort to the invisible part of security. The product owners themselves focus on pushing the developement of features therefore the nessecity of security is often neglected or almost completely overlooked.
That is why there is a need to visualize the investment in security, made by a champion or an entire team. One solution would be to give out corresponding buttons for every security event the champions attend. Those events could be something along the lines of a threat modeling session with OWASP Cornucopia or any other relevant topics.
The buttons can be seen as a reward given to the representatives of each team, showcased in the team rooms. Preferably on a white hat or a sash. This concept could also be implemented with stickers. As an alternative to reward the attendency of a meeting, the actual implementation (e.g. using of a hardened image) might be rewarded.
Benefits:
- A teams effort in security is visible and therefore measureable
- teams are able to compare each others achievements, especially with different skill levels (e.g. XSS Basics and XSS Advanced events)
- Security Champions are able to get some kind of certification
- This project could help engange others in the topic of security
When exporting SVGs files, try to export the text as objects to preserve the format and style of the text even when the computer doesn't have installed the font you used.
In case you want to create pins by yourself, you want to have multiple pin images printed on one page and use a pin machine afterwards. To create PDFs with multiple pin images on it, see https://github.com/wurstbrot/security-pins-pdf.
- Download https://fonts.google.com/download?family=Hind
- Install the font, e.g. https://gist.github.com/lightonphiri/5811226a1fba0b3df3be73ff2d5b351c (Ubuntu)
- Install Inkscape
The following are just example providers, any other sticker provider will also be ok. This are experiences from Timo
Sticker mule provides the payed service to order stickers and pins (called buttons).
It is fun to create some stickers on your own. A badge/pin machine is needed. I am using 25mm radius. For example Buttonmaschine 900. In this case, the following process is recommended:
- Creation of PDFs with a black border to easily adjust the paper on the machine
- Printing the PDF with the desired design
- Using the machine to create pins
- Timo Pagel aka
wurstbrot - Katharina Treptow aka
ktreptow
The license is declared in the file LICENSE. Pins with unknown licenses or commercial licenses are available in the branch license-issues
You want to support the project but you are not a designer? You can donate money so that we can buy pins/stickers for conferences at https://owasp.org/donate?reponame=www-project-security-pins&title=OWASP+Security+Pins
