Building security culture on infrastructure teams
summary
Concrete practices and outcomes: a three-part framework — learning and growth, empathy, responsibility — plus concrete practices like rotations and security champions, tabletop exercises and live game days that kill a database master to validate alerts, and a lightweight security review process (design doc pre-read + 15‑minute meeting). Examples include Stripe’s Shipped/Fixed mails, an Increment security issue, and recurring projects spun up from review findings, with emphasis on building tools and processes that actually reduce repeated mistakes.
AI-written summary · about
chapters (11)
- 0:00Start
- 3:03No Shaming
- 4:36Diverse & Dynamic Disagreements
- 5:15Thou shall not use.
- 6:08Security is Everyone's Job
- 7:43Find security-interested people
- 9:25Security advocates
- 10:31Make space for learning
- 10:41Discussion & Presentation Forums
- 11:22Tabletops & Game Days
- 17:29Security Review
related talks
51mBuilding Security Champions
24mConcrete Steps to Create a Security Culture
27mIncluding security in your engineering culture
57mBuilding a Modern Security Engineering Organization
52mContinuous Security
46mCultivating a Security-First Culture in Tech Organizations
48mHow to build a security mindset
47mSecurity is Everybody's Job