Rise of the Machines Security Automation at Twitter
summary
Company faces an FTC order requiring a 20 year information security program after account compromises; by 2012 traffic hits ~300 million tweets/day and a tiny security team. Engineers build a Security Automation Dashboard called SadB that aggregates runs of Brakeman and bundler-audit, runs regex checks in Review Board/Gerrit to auto-comment on risky diffs, emails authors of new findings, and enforces secure‑by‑default libraries so vulnerabilities are prevented rather than manually fixed.
AI-written summary · about
chapters (15)
- 0:00Introduction
- 1:22Dont fix vulnerabilities
- 2:50FTC investigation
- 5:03Employee password
- 5:34What happened
- 6:42Second incident
- 7:00FTC order
- 10:03Automation cycle
- 11:31Getting the right information
- 14:13Build tools for yourself
- 14:36Sadbe
- 15:48Dashboards
- 16:44Historical Data
- 18:10Open Source
- 24:23Conclusion
related talks
45mHow Leading Companies Are Scaling Their Security
38mOpening Plenaries: Security in Automation
36mThe Road To Being Rugged
53mFlipping the Script on Application Security
10mBe Agile with Security
19mFlipping the script on application security
22mSecurity and Risks
01h 00mBuilding Safe Systems at Scale - Lessons from Six Months at Yahoo