Security, security, security. Everywhere we look there seems to be a new security breach, poorly developed architecture, and honest mistakes which cost companies millions of dollars. Agile teams often struggle on how and when to do security assessments, how to spend their limited security budget, or understand how to work with non-agile security teams. Wouldn't it be great if there was a way to teach agile teams with little to no security expertise how to understand threats and prevent costly development oversight?

In this workshop, I will introduce Microsoft's open source card game called "Elevation of Privilege". The game is played by software developers, architects, and security engineers as a fun exercise which helps expose security threats and critical design flaws in the software your teams develop. We'll play though a couple of rounds, showing how effortless teaching people core security design concepts is, all while having some fun with your co-workers.

Considering how much more security fixes cost after features have been deployed to production, it makes a lot of sense to shift-left and build security in. We'll show how this game can help engineers adopt security well before it turns into an expensive bug that'll sit in the backlog, causing risk to your users. Let's have some fun!