Prioritizing Security correctly
summary
Argues that security features must be prioritized like any product feature by converting risk into the same currency as other work (users or money), using threat models, abuse stories, and cost/value mapping to choose cheaper, targeted controls before heavy ones. Describes building a PlayReady SDK for iOS/Android, producing an obfuscation tool that becomes the COP obfuscating preprocessor, and shipping an OTT product in 2013 that reaches 380 customers, 140M subscribers before a 2014 acquisition for ~1.5B NOK.
AI-written summary · about
chapters (24)
- 0:00Start
- 2:03Once upon a Time (ca 1984)
- 3:27The Basics of a content DRM
- 10:02The Analogue years
- 10:131997-2000 Going digital
- 11:29The little company who wanted to see the world 2000 to 2011
- 13:15So what did we do right?
- 16:332010 Dawn of internet streaming
- 20:21How to stay relevant
- 21:30A sidenote
- 21:55Closed vs open devices
- 23:54Secure from what?
- 24:43The backlog, at the beginning
- 25:53Control flow flattening
- 27:00The problem
- 29:09Back to the drawing board
- 30:48Example Data encoding
- 32:50Re-do the threat model
- 35:09Product Prioritization 101
- 36:52The Eureka noment
- 40:32Recap
- 41:11Final tip
- 44:15MultiDRM takes over
- 46:07What about the obfuscation tools?
related talks
31mPrioritizing Trust while Creating Applications
38mPrioritizing Trust While Creating Applications
15mApp Security from Necessary Evil to Performance Advantage
47mThe Only Reason Security Really Matters for DevOps
26mHow to become your app's 'security champion'.
57mMaking Security Priority Zero
18mDesigning for Security Outcomes
37m(Ab)User Experience.