Defendable Products: How we try to improve security in our products
summary
Three-year effort from a three-person team builds an application inventory that auto-discovers subdomains hourly and pulls scanner ownership, powering an automated attack-surface view across ~55,585 domains and 100+ Kubernetes clusters; infrastructure hardening uses Bottlerocket, Cilium, EKS audit logs and GuardDuty; testing stack adopts Detectify for DAST, GitHub Advanced Security for SAST/secret scanning, and Wiz for CSPM. Training reaches ~1,000 developers with a 7.1/10 rating, private bug bounties surface four critical issues so far, and policies stay short and actionable.
AI-written summary · about
chapters (14)
- 0:00Security journey introduction
- 2:32Company context and challenges
- 9:39Product security principles
- 13:51Tools across lifecycle
- 16:19Kubernetes hardening
- 22:05Dynamic app security testing
- 24:36Cloud security posture management
- 26:29GitHub Advanced Security
- 29:21Cloud vulnerability management
- 34:01Private bug bounty programs
- 37:15Security culture training
- 44:16Practical security policies
- 46:27Achievements and learnings
- 50:14Q&A
related talks
52mApplication Security at DevOps Speed and portfolio scale
52mContinuous Security
33mBattle Tested Application Security
36mThe Road To Being Rugged
45mHow Leading Companies Are Scaling Their Security
36mThe Devil in the Details: Kubernetes’ First Security Assessment
58mHow to embed security into your process
49mFrom Application Security to Developer Security