How Can SRE Help Security Governance?...
summary
GRC functions are stuck in spreadsheeted, command‑and‑control workflows and often codify liabilities: ICO reports note 100% non‑adherence to written policies. Proposal: treat security like reliability — push security requirements into team backlogs, instrument them with error budgets and automated governance, surface security artifacts in CI/CD, and apply observability, readiness reviews and chaos engineering with a security flavor so teams can measure trade‑offs, learn from normal work and scale compliance without manual toil.
AI-written summary · about
chapters (18)
- 0:00Introduction
- 1:50What is GRC
- 3:15The problem
- 3:42Where we are stuck
- 7:05Risk Management
- 8:54Summary
- 9:19What does it have to do with SRE
- 10:59The problem with artifacts
- 11:34How can SRE help
- 15:12Compliance Objectives
- 16:44Feedback Loops
- 17:57The Black Line
- 19:37The Risk Model
- 22:11Application to SRE
- 23:55Risk Model
- 26:05Risk Management Strategies
- 27:47Learning
- 30:06Wrapping up
related talks
35mRole of SRE in DevSecOps
32mIs the S in SRE for “Security”?
20mImplementing SRE in a Regulated Environment
45mClearing the Way for SRE in the Enterprise
28mDefending against SRE with SRE
33mSecurity and SRE: Natural Force Multipliers
30mIntegrating cloud native security into the SRE culture
25mSRE Guiding Principles & Transformational Framework