Building a Culture of Security at The New York Times
summary
The New York Times runs security with a three-person InfoSec group protecting ~1,300 reporters and 3.3M paid subscribers by mixing policy and hands-on practice: one-hour newsroom onboarding for every hire, mandatory two-factor by default, regular phishing exercises with individual non‑shaming followup, and a public tip pipeline (email, Signal, WhatsApp) with malware vetting. Teams ship legacy-to-cloud work (site rewritten in Swift, reactive Relay/GraphQL, some services deploying 20×/day) while offering clean travel laptops (reinstalled, full‑disk encryption) and embedded InfoSec for fast, contextual decisions.
AI-written summary · about
chapters (21)
- 0:00Intro
- 3:18What got you into security
- 5:53The newsroom
- 6:32The New York Times
- 8:11Are we failing
- 10:58Challenges
- 14:01Fake News
- 15:44Securityfulton
- 18:57InfoSec visibility vs newsroom privacy
- 20:11Technology changes
- 20:56How to fit in
- 22:58Training
- 23:26Recruiting
- 24:41Brand Bag Sessions
- 25:31External Speakers
- 28:49Learning Reviews
- 31:14Embedded InfoSec
- 34:00Tips Page
- 35:33Conclusion
- 36:19Training Mentoring
- 37:23Workstation Security
related talks
03mBuilding a culture of security at the New York Times
43mSecuring Journalists
50mWhen Your Threat Model Is "Everything": Defensive Security in Modern Newsrooms
44mSecuring Journalists in 2022
24mConcrete Steps to Create a Security Culture
33mRapid-Fire Stories of Creative Solutions to InfoSec Problems
01h 00mBuilding Safe Systems at Scale - Lessons from Six Months at Yahoo
41mSRE by Influence, Not Authority: How the New York Times Prepares for Large Scale Events