Securing a Security Company
summary
Describes concrete steps taken at Threat Stack to tighten production security: replacing long‑lived AWS keys with short‑lived credentials via Vault and a one‑command helper mr. manager, moving SSH public keys into LDAP+PAM (offkeys) and gating elevated access with PagerDuty/Slack integration (deputize), shipping a JIRA-driven merge/approval checker for SOC 2 compliance, and running controlled host terminations via a weekly chaos button — all implemented and actively reducing risky access patterns.
AI-written summary · about
chapters (7)
- 0:00Start
- 0:06Securing a Security Company Patrick Cable Threat Stack, Inc.
- 6:14Access Control makes onboarding safer
- 7:03Security Tooling is Fun to Build
- 13:26Sometimes compliance and security can lead to better outcomes
- 18:30Figure out your context Be aware of how it changes, and how events may change it
- 19:07Questions?
related talks
45mHow Leading Companies Are Scaling Their Security
57mBuilding a Modern Security Engineering Organization
24mBeing secure by design: Engineer-led security
52mContinuous Security
39mSecurity in a DevOps World
22mSecure it yourself
01h 03mBe your own Threatbuster!
24mConcrete Steps to Create a Security Culture