Software security is vulnerability research conducted on the software you ship. The OWASP Top 10 is a software security artifact. Some people call this "appsec", though that tends to imply web software security, which is just a subset of software security.
Network/platform security is network access control rules, host configuration, to some extent cloud IAM†, and patching.
CorpSec is the stuff you do to address attacks targeted at your team and the computers and services you use to keep the company running --- laptop and endpoint security, Google Apps 2FA, single sign-on, onboarding/offboarding, and that kind of stuff.
† IAM and cloud access/monitoring can kind of bleed into both of the other buckets depending on the aspects you're thinking about, but like 80% of it belongs in the net/platform bucket for most companies.
Comments
Could you explain these terms a little more, perhaps with examples? In particular, what is corpsec? Google was unhelpful here.
Software security is vulnerability research conducted on the software you ship. The OWASP Top 10 is a software security artifact. Some people call this "appsec", though that tends to imply web software security, which is just a subset of software security.
Network/platform security is network access control rules, host configuration, to some extent cloud IAM†, and patching.
CorpSec is the stuff you do to address attacks targeted at your team and the computers and services you use to keep the company running --- laptop and endpoint security, Google Apps 2FA, single sign-on, onboarding/offboarding, and that kind of stuff.
† IAM and cloud access/monitoring can kind of bleed into both of the other buckets depending on the aspects you're thinking about, but like 80% of it belongs in the net/platform bucket for most companies.