Building a Modern Security Engineering Organization
Talkat AppSec California 2015 · on Wednesday, 2015-01-28· at 14:00· Annenberg Community Beach House: Track 4, 415 Pacific Coast Hwy·
summary
Describes concrete practices: migrating AppSec to continuous deployment at Etsy scale with feature flags and production ramping, building visible dashboards pushed onto engineering TVs so teams notice SQLi spikes, and an SSH strategy that alerts then phases out shared keys so access is removed but capability remains. Reports actual outcomes: a bug‑bounty launch spikes reports in 13 minutes and causes intense two‑to‑three‑week triage, Hall of Fame listings attract researchers without big pay, and scripted attack simulations use cutouts to exercise remediation times and detection gaps.
AI-written summary · about
chapters (59)
- 0:00Intro
- 1:00How is technology changing
- 1:20Cost of the attack
- 2:32Near instantaneous deployment
- 3:07Etsy
- 3:30Waterfall
- 4:41Feature Flags
- 7:29Security vs Control
- 8:09The system isnt dangerous
- 8:46Deployment time
- 9:51Old methodology
- 10:33What makes it safe
- 10:43Invisibility instrumentation
- 12:12Security insight
- 12:33The key
- 14:05Binary events
- 14:30The two worlds
- 14:52The shift around
- 15:04Function by removing blockers
- 15:25We are the blocker
- 15:49Mindset shift
- 16:32Being a jerk
- 17:48Making realistic tradeoffs
- 19:20The security chart moment
- 19:52How easy it is to exploit
- 20:13Reward behavior
- 20:23Bad days
- 20:53Dont be a jerk
- 21:21National responses
- 22:46How to scale
- 24:23Access control in startups
- 24:37Pressure from different points
- 24:49Whether its regulatory compliance
- 24:59You can take away access but
- 25:21This is a hard step
- 25:34The key lesson learned
- 26:26Destroy your credibility
- 26:39Magic
- 27:13Central Locking
- 28:41End State
- 29:30Budget Concerns
- 31:08Above Bounty
- 32:10Cost of Discovery
- 34:13Metrics
- 34:51Mark
- 38:01Quality and Credit
- 41:02Pen Testing
- 41:39Vulnerability Enumeration
- 42:11Pentest
- 42:57Feedback Loop
- 43:25GoalOriented
- 43:53Scope
- 46:03Realistic
- 47:36Logistical
- 48:38Data
- 49:02Why
- 49:38Behaviors Patterns
- 50:01Attack Profile
- 51:17Life Against Death
related talks
33mDevSecOps: How to Use DevOps to Make You More Secure
34mDevSecOps: How to Use DevOps to Make You More Secure
24mBeing secure by design: Engineer-led security
47mSecurity is Everybody's Job
46mRugged Software Engineering
49mLessons from DevSecOps Trenches
33mLearning from Past Security Breaches: Strengthening AppSec Efforts and Focus
52mContinuous Security