A Matter Of Trust: When Security Is Not Enough
summary
Explains why certifications and marketing don’t equal assurance and lists concrete signals: a public security.txt, published penetration tests and threat models, GitHub repos and technical blogs (Obsidian, Netflix, Arch Wiki examples), SSO pricing traps (SSO.tax) and a decision log plus infra‑as‑code/no‑SSH policies. Gives a 10‑item checklist, cites Ivanti’s five or six critical vulnerabilities over three years as a red flag, and shows that automated updates, supply‑chain automation and active bug‑bounty/response practices are the things that actually build measurable trust.
AI-written summary · about
chapters (15)
- 0:00Introduction
- 1:30Audience poll setup
- 2:37Talk trigger story
- 6:14Why we trust software
- 9:47Defining security trust
- 11:35Security reality vs feeling
- 13:47Trust checklist for vendors
- 25:51Trust checklist expanded
- 26:14Security features red flags
- 28:23Evaluating tech stacks
- 30:12Trusting updates and supply chains
- 31:15Documentation quality
- 34:30Secure development top 5
- 37:42Building software trust
- 38:46Question and answer session
related talks
26mBuilding and Verifying Security Trust in Today’s Complex Tech Stacks ...
47mBuilding Trust in Open Source: A Practical Guide to Securing Your ...
38mPrioritizing Trust While Creating Applications
20mEstablishing a Language of Trust
41mSecurity: The world is broken and you are guilty
47mThe Only Reason Security Really Matters for DevOps
38mDo You Feel Secure?
21mOn Trust: Stories from the Front Lines