Everything is Terrible: Three Perspectives on Building, Configuring, and Securing Software
summary
Concrete claims and tools: automated CI security checks (Breakman), a man in the middle SSL test harness, and config management that enforces firewall and service specs. Practices that matter: threat modeling early, team rotations and mini planning conventions, and spec tests for infrastructure changes. Measured result from the DevOp survey: teams that bake security into CI have 50% fewer security events. Mentions of Puppet, AWS security groups, and catching regressions like heartbleed show what actually gets built and fixed.
AI-written summary · about
chapters (20)
- 0:00Introduction
- 1:21State of the Industry
- 2:11DevOps
- 4:04Developers
- 5:04Operations
- 6:44Security
- 7:25Share the Love
- 10:16Security Starts With You
- 15:48Threat Modeling
- 17:03Coordinated Planning
- 24:11DevOps Culture
- 24:32Tools
- 30:58Wrapping Up
- 31:38QA
- 36:20Chris Barker
- 36:38Adrian Thompson
- 36:49Bill Wiese
- 41:42Dev Shop
- 43:15Security People
- 45:12DevOps Survey
related talks
29mThe SecDevOpronomicon
31mDevOps: You Build It, You Secure It
34mEmbarking on Your Security Journey
53mA DevSecOps Tale of Business, Engineering, and People
27mSecurity: The Thing That Everyone...
40mDesign Approaches for Security Automation
40mSecurity-as-Code to Accelerate DevSecOps, a Practical Guide to Get Started
40mMaking Security an integrated part of the SW Dev Lifecycle