Security Starts With Plain Language
summary
Argues plain language functions as a security control and shows concrete tooling: uses ISO 24495 plain language and RFC 2119 keywords to codify requirements, builds a Claude skill that scans Terraform source and documentation, and finds many ambiguous phrases that hide risky behavior. Gives a concrete mismatch: the word "share" becomes an unauthenticated public link unless constraints are explicit, and a changelog entry "added document sharing" hides the creation of non‑expiring indexable links. Offers UX rules to set clear boundaries for AI agents and docs.
AI-written summary · about
related talks
54mPlain and Simple: The Art of Writing Clearly
57mWhat Could Possibly Go Wrong? Plain Language Threat Modeling in DevSecOps
22mSecurity vs Dev Experience Threat … or Opportunity
25mSecurity First
23mSecurity Doesn't Have To Be a Nightmare
23mSecurity As Code - The New Model Of Achieving Security At Scale
29mSecurity by(e) Design?
32mThe One About Controls