Security Styles
summary
Compares type 1 vs type 2 security and argues that proactive, system-first choices outperform policing and checkbox compliance: phishing leaderboards and punitive simulations drive hostility, while YubiKey for everyone and U2F practically eliminate credential phishing. Recommends immutable, ephemeral containers with egress blocking, WAF plus rate limits, cheap Raspberry Pi canaries to detect intrusions, and automation that generates auditor-ready spreadsheets. Gives concrete fixes that work: wrapper libraries and commit-time tests to remove non-parameterized SQL, declarative configs, and documented decentralised decision-making to improve resilience.
AI-written summary · about
chapters (26)
- 0:00Intro
- 0:56How do you stop phishing?
- 4:04How do you work with other teams?
- 6:18How do we defend a service?
- 7:54How do you handle compliance?
- 11:27How do you fix vulnerabilities?
- 13:42How do you handle mistakes?
- 16:11How do you make decisions?
- 17:29Quick tips for starting from zero
- 20:33What is a system?
- 22:35Properties you care about
- 24:16What is security?
- 26:34What is resilience?
- 27:00Designing for resilient security
- 27:24Adversaries
- 28:28Personas to examine
- 30:10Component principles
- 30:32State & logic
- 30:55Immutability & ephemerality
- 32:02Minimal canonical state
- 33:12Unlikability
- 33:40Process principles
- 34:53Design for failure
- 35:25Decentralize decision-making
- 36:11Slack
- 37:35Outro
