Security Without Friction
summary
Coinbase secures billions in assets while keeping deploys fast: 12M users, ~250 projects, 80 engineers, 70 deploys/day and median prod request-to-prod under an hour. Security relies on a consensus model enforced by tools like Heimdall and a self-service deploy UI so changes need peer approvals and 2FA. Secrets use Shamir's secret sharing (Vault unseal patterns) for multi-person access. Continuous scans use bundler-audit, Brakeman and CI integration; a small Slack bot pong board enforces laptop locking and changed developer behavior.
AI-written summary · about
chapters (14)
- 0:00Introduction and background
- 1:02The ShapeShift security breach
- 4:09Lessons from the breach
- 5:54Security recommendations
- 7:41Two-factor authentication benefits
- 8:06Balancing security and friction
- 11:05Coinbase’s security approach
- 12:31Consensus model for security
- 15:43Reducing deployment friction
- 16:46GitHub security measures
- 17:49Shamir’s secret sharing
- 20:20Continuous security tools
- 22:07Cultural security practices
- 24:13Developer happiness and security
related talks
53mFuture Banks Live in The Cloud: Building a Usable Cloud with Uncompromising Security
21mSecuring a Security Company
46mSecuring Coinbase’s Edge Payments Infrastructure
39mSecurity in a DevOps World
16mSecure Your GitOps - How to Implement a Robust Security Strategy
37mA Secure Continuous Delivery Pipeline
24mBeing secure by design: Engineer-led security
07mCI/CD Evolution: Ensuring Security and Overview During Rapid Growth