Security on a Shoestring: A Low-Budget Security Revival Tour (Jared Casner)
summary
Argues that a credible security program is possible on a tiny budget by prioritizing basics: passkeys and phishing-resistant MFA, SPF/DKIM/DMARC, short‑lived credentials, least privilege, SSO where possible, and regular user audits. Recommends concrete tools and costs: AWS SSM session logging instead of SSH, CSPM and EDR bought per‑host, SCA (Dependabot/Snyk), ZAP/Burp for OWASP testing, and centralized logging at $2.50 per million logs/month. Claims a working bootstrap stack can run for less than $5,000 per year and points to real failures from poor offboarding and unchecked supply‑chain risk.
AI-written summary · about
chapters (18)
- 0:00Introduction and speaker intro
- 1:04Building a security program on a budget
- 5:54Choosing a security framework
- 7:18Policy ownership and job descriptions
- 8:43Threat modeling basics
- 9:47Staff education strategies
- 11:33Identity and access management
- 13:19SSO and MFA implementation
- 15:24Third-party risk management
- 18:51Reading SOC 2 reports carefully
- 21:20OWASP Top 10 and secure coding
- 22:41Software composition analysis tools
- 23:44Logging and alerting essentials
- 25:51Endpoint detection and response
- 26:53Asset inventory and risk registers
- 27:56Cost-saving security resources
- 29:22Start small and build over time
- 30:44Q&A session
related talks
24mBootstrapping Security
30mEffective security on a tight budget
29mDoing More with Less: DevSecOps on a limited budget
50mCybersecurity for “Have Nots”
29mAppSec on a budget
42mBuilding an AppSec Program with a Budget of $0: Beyond the OWASP Top 10
48mSecurity from zero
58mDIY Security for the Amateur Superhero