Software security as a force of nature
summary
Argues that software security becomes resilience not prevention and demonstrates concrete practices: CI/CD and IaC to enforce invariants, caching and backups to blunt L7 DoS, immutability and ephemeral infrastructure for rapid amputation and reprovisioning, time‑limited credentials and time based access tokens to limit stolen keys, deception and Canary tokens to detect credential stuffing, and modular swapability for rapid component replacement noting cheetah success rates near 60% and cicada cycles to 2037 as analogies for attacker agility and unpredictability.
AI-written summary · about
chapters (18)
- 0:00Introduction
- 1:27Why security feels impossible
- 3:14Problems with cyber security
- 4:15Resilience from biology
- 7:02Adaptation for security
- 9:10Automation in nature
- 12:18Buffering and caching
- 14:03Immutability and isolation
- 16:33Modularity for security
- 19:03Invisible security
- 20:27Open source resilience
- 21:11Deception strategies
- 22:56Agility against attackers
- 24:23Autoscaling infrastructure
- 26:08Functional diversity
- 29:18Swapability and regularity
- 31:01Adaptive security
- 31:44Conclusion
related talks
51mThinking Differently About Security
03mGreat software is secure software
40mClosing Keynote: New Era of Software with modern Application Security
45mFast, Ever-Evolving Defenders: The Resilience Revolution
40mMaking Security an integrated part of the SW Dev Lifecycle
24mSecurity by default
52mContinuous Security
41mSkillful, Scalefull Fullstack Security in a State of Constant Flux