Making Security Approachable for Developers and Operators
summary
Argues that castle‑and‑moat perimeter assumptions fail and proposes zero trust as the model, with concrete changes: centralize secret handling with HashiCorp Vault or KMS, push encryption into the application instead of transparent disk, and terminate mutual TLS with a service mesh or platform proxy so callers get identity and authorization. Recommends using platform features, middleware APIs, frameworks and tools like Terraform, Nomad, and Kubernetes to externalize security concerns and reduce developer burden.
AI-written summary · about
chapters (30)
- 0:00Intro
- 1:53Security Mindset
- 2:30Castle & Moat Security
- 2:55Castle & Moat Mentality
- 3:50Network Teams
- 4:26Operations Teams
- 6:00Castle & Moat Model
- 7:51Consider: Network Integrity
- 9:21Castle & Moat in Practice
- 13:06Zero Trust Model
- 14:04Secret Management
- 16:25Data Protection
- 19:41Traffic AuthN / Authz
- 22:15Complexity of Security
- 22:59Java 7: Cipher Class Documentation
- 23:33Java Documentation
- 25:12Path Forward
- 26:56Splitting the Problems
- 28:53Platform Layer
- 31:13Application Middleware
- 32:43Vault for Cryptographic Offload
- 34:15Frameworks
- 34:55Application Logic
- 36:06Division of Labor
- 36:21Security Teams
- 38:15Developer Teams
- 39:03Practitioner Education
- 39:58Teaching Security
- 41:20Traditional Security
- 41:50Growing Application Concerns
related talks
57mHow Do I Secure My Micro-Services?
31mModern Security With Microservices And The Cloud
27mLeveraging Infrastructure as Code to Create Zero Trust Access to Your Apps and Infrastructure
01h 02mIntroduction to Zero Trust Security
35mCloud Native Security for the Rest of Us
36mManaged Zero Trust Security With HashiCorp Cloud Platform
32mRugged Building Materials & Creating Agility with Security
49mZero Trust Security