Building Safe Systems at Scale - Lessons from Six Months at Yahoo
summary
Six months running security at a billion-user web company yields specific lessons: tens of thousands of front-end servers and 200+ petabytes of storage break single-box security (250 Palo Alto units per 10G switch is non‑starter), so software-smearing and Hadoop-backed logging become mandatory; backbone TLS between servers replaces fragile IPsec boxes; a bug bounty spends ~$670k/year and needs automated verification so reports can be Selenium-replayed and autopaid; a privacy team builds end-to-end mail encryption with key infrastructure and phased web integration for 2015 rollout.
AI-written summary · about
chapters (10)
- 0:00Introduction to web scale
- 2:44The definition of scale
- 8:11Financial vs. web security
- 12:16Zombie apocalypse metaphor
- 14:01Critique of security vendors
- 24:31Future industry needs
- 29:34Overcoming industry nihilism
- 36:11Security strategy at Yahoo
- 45:50Privacy and future outlook
- 50:12Q&A and closing
related talks
48mSecurity from zero
57mBuilding a Modern Security Engineering Organization
45mHow Leading Companies Are Scaling Their Security
47mWhy keeping your system secure is a bit like decluttering
23mScalable security: how to win friends and not burn...
24mBeing secure by design: Engineer-led security
52mContinuous Security
58mBalancing Security and Agility While Scaling Your Company