We Come Bearing Gifts: Enabling Product Security with Culture and Cloud
summary
Claim: replace approval gates with automation-first guardrails built on cloud primitives so teams never need security permission to ship. Netflix shows new devs can deploy safely in 90 minutes, automated tooling surfaces 36% automated findings, and a private bug bounty spends only one third of projected cost. Concrete building blocks include a paved road plus Spinnaker CI/CD, immutable artifacts, provable application identity and secret bootstrapping tied into self-service dashboards (Security Brain pilot).
AI-written summary · about
chapters (29)
- 0:00Introduction
- 1:10Why is security hard
- 7:29Netflix culture
- 12:59Reducing risk
- 13:26Is this gonna work
- 14:05Challenges
- 15:48Are you strikes light
- 17:36Paved Path
- 19:13CICD Pipeline
- 20:09Security Tools
- 21:00Assess
- 23:35CI CD
- 24:30Spinnaker
- 25:19Security Nihilism
- 28:45How do we have enough people
- 29:30Quarterly planning
- 30:53What are we doing
- 32:06Its a technical journey
- 32:47Homestretch takeaways
- 34:05Questions
- 36:35Threat Modeling
- 41:13Automating finding vulnerabilities
- 42:13Static analysis scans
- 44:25Tools
- 45:08Code Hygiene vs Legit Vulnerability
- 46:43How do you respond to questions
- 47:01Why do you have reservations with thirdparty pentesting
- 47:45How do you compensate for reservations
- 49:44Are you also running analytics
related talks
40mConstruction Time Again: A Lesson in Paving Paths for Security
36mHow to build continuous security and embed it in your product
20mSecurity Culture & Scaling Your Security Humans
38mBuilding Security at Speed
43mThe art of secure software: Zero-trust delivery pipelines
07mInterview
24mSecurity by default
31mPractical Guide to Frictionless Cloud Native Security for DevOps