Add security to architecture one step at a time
summary
Starts with concrete building blocks: ask who uses the data and whether it’s regulated, add TLS certificates for encryption in transit, use a managed identity provider instead of DIY username/password, encrypt data at rest (blob/field level as needed), log all requests but never credentials, add monitoring/alerts and WAF rules to block common bots, secure service-to-service calls with asymmetric keys or mTLS, and store keys as sealed encrypted secrets in source or production runtime rather than plain text.
AI-written summary · about
chapters (10)
- 0:00Introduction to security
- 2:27Planning and deployment
- 4:29Core security building blocks
- 7:13Building the security team
- 10:00Avoiding framework pitfalls
- 12:05Architectural considerations
- 15:20Advanced monitoring and WAF
- 18:44Expanding infrastructure
- 21:35Organizational security culture
- 25:41Q&A and closing remarks
related talks
45mSecurity Architecture, An Adventure?
29mTop 10 Tips of Architecting Secure-First Software
27mIncluding security in your engineering culture
01h 02mLock That Sh*t Down! Auth Security Patterns for Apps, APIs, and Infra
01h 02mStrong security made simple: Putting all the pieces together
16mSecuring your Cloud infrastructure: a first baseline
43mSecurity By Design
29mGraphQL Security Best Practices and Hardening