Minimum Viable Security
summary
Five-day sprint template that produces a usable security program: Day 1 Training establishes password manager use (LastPass or 1Password) and MFA, citing phishing data (10% click attachments, average 20 minute detection); Day 2 SDL yields an actionable virtuous cycle and self-service "twine" risk tool; Day 3 IR builds a plan with roles, SLAs and a Google Doc incident log for real-time notes; Day 4 lays basic GRC documentation (data classification, access checklists, exception process); Day 5 creates a privacy page, security FAQ and PGP contact for vuln reports.
AI-written summary · about
chapters (23)
- 0:00Start
- 1:36What Would a Minimum Viable Security Program Look like
- 6:43Phishing
- 8:14The Best Early Warning System for Phishing Attacks
- 11:52Basic Security Hygiene
- 15:39Security Mailing List
- 18:37Acceptable Risk
- 19:34What Does Doing Security Mean
- 19:54The Checklist Manifesto
- 21:06Three Kinds of Problems in the World
- 22:28Checklist for Vulnerability Management
- 27:38What Are the Roles and Responsibilities during during an Incident
- 29:50Customer Notification Requirements
- 31:02Incident Response
- 34:16Password Policy
- 34:40Tracking As Much as You Can
- 35:21A Data Classification Guide
- 35:45Checklists for Access Control
- 36:29What Is Your Exception Process
- 38:17Privacy Policy
- 40:44Report Vulnerabilities
- 41:33Security Faq
- 43:04Recap
related talks
31mStartup Security, 2nd Edition
24mConcrete Steps to Create a Security Culture
33mSecurity on a Shoestring: A Low-Budget Security Revival Tour (Jared Casner)
33mMinimum Viable Security
36mOvercoming Obstacles in Operationalizing Security
20mBuilding security culture on infrastructure teams
33mLearning from Past Security Breaches: Strengthening AppSec Efforts and Focus
38mBuilding a Security Assurance Program