Security Is an API: Evolving to a decentralised security culture
summary
Claims that security becomes a scalable interface by treating engagements as APIs backed by templated threat models and baseline security controls, with enforcement via security tooling that exposes APIs integrated into CI/CD. Product teams own remediation and telemetry while a central team owns the process, reducing bottlenecks; examples cite Amazon growing 38 times and hundreds of service teams to show this model scales in practice.
AI-written summary · about
chapters (8)
- 0:00Security culture and APIs
- 3:15Software evolution and APIs
- 7:28Security challenges and evolution
- 10:15API security maturity
- 12:45Security with microservices
- 18:24Product teams and security
- 21:17Key takeaways
- 23:25Security resources
related talks
38mKeynote: Dumping Traditional Security Teams
28mSecurity as a Service: Work where You Engineers Live
23mSecurity As Code - The New Model Of Achieving Security At Scale
24mSecurity by default
32mSecuring Value in API Ecosystems
24mAPI Security in DevSecOps: Built-In, Not Bolted On
03mImplementing security into an organization
03mGreat software is secure software