Scalable security: how to win friends and not burn...
summary
Describes running security at Google scale: building controls in audit mode to measure breakage, rolling out to 1%, 2%, 10% to limit tickets, and flipping defaults to reach ~80% compliance over years. Uses telemetry and remediation SLOs instead of panic nights, tracks exceptions in group management with expirations, and applies a two‑page rapid risk assessment template. Reports ripping out more controls than deployed, handling Log4j as a week‑long event, and warns against user‑facing blame.
AI-written summary · about
chapters (12)
- 0:00Introduction and team background
- 1:45What scale means in security
- 3:52Why you can’t work harder at scale
- 5:37Measurement as the foundation
- 8:45Good controls vs bad controls
- 11:09Secure by default, insecure by exception
- 13:38Exceptions as a positive tool
- 15:05Proactive vs reactive security
- 16:51Communication over jargon
- 18:57Rigorous risk assessment frameworks
- 20:22Security and company culture
- 21:47Lessons learned and closing
related talks
43mTitans of Scale: Strategies to Scale Security in Expanding Organizations
45mHow Leading Companies Are Scaling Their Security
58mBalancing Security and Agility While Scaling Your Company
24mHow Can You Scale It If You Don't Trust It
01h 04mShifting Security Everywhere
24mConcrete Steps to Create a Security Culture
43mSecurity By Design
40mBuilding Secure and Reliable Systems at Scale