What We Want Is 90% the Same: Using Your Relationship with Security for Fun..
summary
Claim: SRE and security want about 90% of the same outcomes and can combine levers to avoid surprises. Evidence: random failures scale with size (law of large annoying numbers), a botched RPC rollout and Gmail hash collision made outages security problems, FedRAMP rules delayed a Zoom patch. Concrete overlaps: access controls, observability and logs, patching, release engineering, feature flags, egress protection and data taxonomies. Ask: merge priorities, give security log access, codify infra in Terraform, use hardware 2FA and feature flags so one system solves both teams’ problems.
AI-written summary · about
chapters (12)
- 0:00Introduction
- 3:37Security and SRE goals
- 6:45Law of large numbers
- 9:55Access control and observability
- 12:23Release and testing priorities
- 14:30Toil and incident response
- 16:40Perverse metrics dangers
- 18:08Security vs SRE differences
- 22:00Respect for collaboration
- 25:30Respect and executive priorities
- 27:17Combining priorities
- 29:45Working with CISO
related talks
33mSecurity and SRE: Natural Force Multipliers
32mIs the S in SRE for “Security”?
43mSecurity By Design
47mThe Only Reason Security Really Matters for DevOps
32mHow Can SRE Help Security Governance?...
39mWhen SRE and Security Teams Meet to Face a Crisis
27mSecurity: The Thing That Everyone...
23mScalable security: how to win friends and not burn...