Security from zero
summary
Targeted at teams with ~10–200 engineers, this gives concrete starting moves: adopt YubiKeys (U2F) for phishing resistance, centralize logs and use canaries for low‑noise intrusion alerts, enforce immutable infrastructure with minimal canonical state and short‑lived creds, hire both IT and Ops before scaling security, and stop hosting auth or exposing GraphQL. Backups are missing in ~95% of cases seen, median detection is ~210 days, and Word/Excel/Acrobat remain ~90% of malware entry points.
AI-written summary · about
chapters (20)
- 0:00Building security teams
- 1:05System properties and security
- 3:57Reliability vs resilience
- 6:47Security through simplicity
- 11:27Segmentation and defense in depth
- 15:21Designing for compromise
- 17:48Human error and user safety
- 20:20Security in startups
- 23:52When to start security
- 27:41Security governance
- 31:13Security planning and incentives
- 33:00Collaborative security culture
- 34:27Compliance vs security
- 36:11Risk and adversaries
- 37:56Detection and monitoring
- 40:48Web security risks
- 42:57Audits and red teaming
- 44:00Product security impact
- 45:51High-value alerts
- 47:18Malware vectors and closing
related talks
52mPrinciples for Developing More Secure Systems
51mSecurity 101: A Beginner’s Guide to Cybersecurity and Zero Trust for Developers
38mSecurity Styles
01h 03mBe your own Threatbuster!
45mHow to win friends and influence your security team
24mBeing secure by design: Engineer-led security
19mThe toplist of securing your developer workstation
31mStartup Security, 2nd Edition