Including security in your engineering culture
summary
Starts teams-first: use existing staff and knowledge to map where data flows and why decisions were made, then lock down accounts and CI with MFA and repo scanners in GitHub or GitLab. Bake secure defaults into cloud templates (example: CloudFormation hardening) and add logging for oh crp events to Datadog. Run focused threat models on big changes using frameworks like Microsoft STRIDE and follow security hardening guidelines* so fixes scale without a separate security org.
AI-written summary · about
chapters (11)
- 0:00Prae introduces Erica
- 0:26Erica introduces herself
- 1:31Security's rough reputation
- 3:56When is the right time to think about security?
- 9:40Starting with the team you have
- 12:37Secure the tools you use
- 14:25Configuring and deploying infrastructure securely
- 16:38Security test cases and built-in tools
- 18:33Logging: Include your "oh cr*p" security events
- 20:07Threat Modeling
- 22:39Leading the team
related talks
16mDevOps and Security
20mBuilding security culture on infrastructure teams
24mBeing secure by design: Engineer-led security
03mImplementing security into an organization
30mHandling Security Objections to DevOps
43mDeveloper Driven Security In High-Growth Environments
24mSecurity by default
45mDevSecOps : add Security to your DevOps!