In Search of Security Shangri-la
summary
Argues the security industry profits from fear while underdelivering, and shows concrete alternatives: replaces internal phishing click-rate metrics with measure report rate and prioritizes one-person fail-safe controls over expecting everyone to be perfect. Describes hands-on work at Etsy, a Duo acquisition by Cisco, a book codifying agile-friendly security, and low-cost outreach (standing candy order ~$350/month) that increases reporting. Defines a useful security team by three behaviors—enabling not blocking, transparency, and blameless—and warns against hiring toxic engineers.
AI-written summary · about
chapters (8)
- 0:00Start
- 6:41The Security Industry Generates Fear Uncertainty and Doubt in Order To Sell Hope
- 16:17Usable Security
- 17:57The Relationship between Devops and Security as a Marriage
- 32:42Internal Phishing Test
- 39:34Measure of a Security Team Success
- 40:52Blamelessness
- 44:46Hold Your Security Partners To Account
related talks
51mThinking Differently About Security
01h 04mShifting Security Everywhere
38mKeynote: Dumping Traditional Security Teams
48mLevel Up Your Security Mindset
36mHow to build continuous security and embed it in your product
42mImperfect Security: Doing Less to Achieve Better Security
57mBuilding a Modern Security Engineering Organization
39mProactive Security, less buzzword, more action