Implementing security from day one at a fintech startup
summary
Covers how a fintech startup built security from day one across three areas: cloud (AWS-focused controls like least-privilege IAM, OKTA SSO across separate AWS accounts, CloudConformity rules, GuardDuty monitoring and alerting, secret management, and incident response), compliance (quickly meeting NPCI UPI guidelines, RBI data-localization/SAR needs and ISO 27001 while onboarding auditors and consultants), and product (secure mobile/app practices such as tracking alpha builds, pair code reviews, SSL pinning, ProGuard/DexGuard obfuscation, and reviewing OTP and other user-input flows). It describes specific challenges encountered (excess IAM permissions, temporary security-group access, integrating auditors, rapid code/design changes) and concrete operational responses used to address them.
AI-written summary · about
chapters (5)
- 0:00Start
- 15:00Case Study - Static Code Analysis
- 18:08Defense in Depth
- 23:03Infrastructure - Identity / RBAC
- 31:07Case Study: AWS Guard Duty
related talks
24mBootstrapping Security
20mBuilding security culture on infrastructure teams
22mFrom Risk to Resilience: How Security Can Shape the Future of Fintech
04mSecurity at the speed of innovation: Defensive development for a fast-paced world
58mBalancing Security and Agility While Scaling Your Company
27mIncluding security in your engineering culture
26mCloud Security Lessons
21mSecuring a Security Company