Defending against SRE with SRE
summary
Argues that SRE must embed security from day one, not bolt it on later, and documents a repeatable workflow: PASTA: Process for Attack Simulation and Threat Analysis with stages — business objective, technical scope, application decomposition, attack modeling, threat analysis and remediation. Cites industry figures: 70% of vulnerabilities are at the application level and cloud misconfiguration often causes >80% of breaches, warns serverless (AWS Lambda/Azure Functions) are not inherently safe, and recommends threat modeling plus red‑team simulation as actionable steps.
AI-written summary · about
chapters (13)
- 0:00Introduction
- 1:56Security teams isolation blame
- 4:47Missing security role in DevOps
- 7:15Cloud services not secure
- 9:02Profit versus security trade-offs
- 10:29SRE and security shared goals
- 13:59Empowering developers safely
- 14:43Threat modeling collaboration
- 17:11PASTA methodology overview
- 21:27Attack simulation analysis
- 23:33Vulnerability analysis process
- 25:17DevSecOps implementation steps
- 27:23Q&A
related talks
35mRole of SRE in DevSecOps
33mSecurity and SRE: Natural Force Multipliers
32mIs the S in SRE for “Security”?
30mIntegrating cloud native security into the SRE culture
39mWhen SRE and Security Teams Meet to Face a Crisis
35mSRE for [cyber]security
39mPragmatic Security for SRE
32mHow Can SRE Help Security Governance?...