Security As Code - The New Model Of Achieving Security At Scale
summary
Argues for moving security into policy as code with a concrete pipeline: author, test, deploy, monitor and remediate; names infrastructure as code examples Terraform and CloudFormation and endorses the open OPA framework; cites cyberlosses rising from about $1 trillion in 2021 to $10.5 trillion by 2025 to justify urgency; shows a working pattern that finds tagged service or user accounts and issues short-lived tokens to enforce access lifetimes, eliminating manual provisioning and enabling measurable, testable controls at scale.
AI-written summary · about
chapters (6)
- 0:00Policy-As-Code The New Direction for Security Controls
- 4:52Security Move to Code
- 5:15Codify the target A universel way of persing and implementing Iterget Apply software engineering practices to target across deployment Design, build, testing, deployment, and management An engineering pipeline to author/test/deploy/implement (target)
- 7:40No silent failures Explicit exceptions
- 8:47Starting Point: Policy As Code
- 20:56INDUSTRY TRENDS
related talks
40mSecurity-as-Code to Accelerate DevSecOps, a Practical Guide to Get Started
21mPitfalls of Infrastructure as Code (And how to avoid them!)
42mBeyond Code: Shaping Security in a Developer-Driven World
26mSecurity Is an API: Evolving to a decentralised security culture
23mSecure Your Systems the Better Way Using Policy-as-Code
27mHow to implement Security as Code?
18mInfrastructure as Code Security Best Practices & Strats
30mHandling Security Objections to DevOps