Rugged Software Engineering
summary
Argues that adopting continuous deployment plus real-time instrumentation actually reduces security risk: a cloud scanner surfaces live attacks (shows SQLMap payloads), teams spot XSS/SQLi spikes and push one-line fixes within hours. Cites surprising figures: ~$2B cyber insurance market, 27% of gov sites fixed after a year, 150 days average time to fix vulnerabilities, and one‑third of gov vulnerabilities in security products. Recommends style tools (Breakman, linters), logstash/Splunk for visibility, fuzzing/GDB for exploit vetting, and small frequent releases — this workflow demonstrably speeds remediation.
AI-written summary · about
chapters (15)
- 0:00Introduction
- 1:56The changing world of software
- 3:55External threats and regulation
- 5:52Government software struggles
- 8:53Security industry vulnerabilities
- 11:48Liability and basic security
- 14:27Why security efforts fail
- 17:19Rethinking the development life cycle
- 20:13We are the cavalry
- 22:08Adopting a rugged mindset
- 25:21The importance of code style
- 31:05Static analysis and tooling
- 32:36Continuous deployment practices
- 37:11Real-time security monitoring
- 43:08Summary and actionable steps
related talks
41mSkillful, Scalefull Fullstack Security in a State of Constant Flux
36mHow to build continuous security and embed it in your product
57mBuilding a Modern Security Engineering Organization
27mHow to implement Security as Code?
37mPlatform and Security Engineering
52mContinuous Security
53mPractical tips for web application security in the age of agile and DevOps
33mBattle Tested Application Security