A Journey in Building an Open Source Security-as-Code Framework
summary
An open source security-as-code framework called Tython lets teams write reusable reference architectures as a Python SDK, run local tests against Terraform/CloudFormation/K8s, and produce automated PRs that flag or auto-remediate issues; a FinTech pilot reports a 50% reduction in design validation time. The framework abstracts cloud services into typed components, integrates into CI/CD and IDEs for early feedback, and ships as a CLI + Community Edition for repo and pipeline visibility.
AI-written summary · about
chapters (23)
- 0:00RSAConference 2023
- 1:13Software & Infrastructure Delivery
- 1:40Modern Infrastructure Development
- 2:51Complexity and size of architectures is growing
- 3:28Rapid changes to the architecture
- 4:33Cloud native capabilities are rapidly evolving
- 5:29Security resource constraints
- 6:16Modern Security Practices
- 9:40Security As Code
- 10:37Our Journey
- 12:18Defining the Problem
- 15:24Requirements
- 17:54Guiding Principles
- 19:49Decision Framework
- 20:59Design Options - Build vs Extend
- 25:36Design Options - Language
- 26:30Design Options - Level of Abstraction
- 31:28Overview of Tython design
- 44:38A Case Study (Large Fintech)
- 45:56Shared Security Infrastructure
- 46:32What is the "right" design pattern?
- 47:10Emergent properties
- 47:42Summary and Takeaways
related talks
23mSecurity As Code - The New Model Of Achieving Security At Scale
30mEnabling Developer Autonomy through IaC and Policy-as-Code: A Case Study
47mAutomating Architectural Risk Analysis with the Open Threat Model format
01h 04mTransformation Blueprint for Developer-Centric Application Security
22mSecurity vs Dev Experience Threat … or Opportunity
24mSecurity as Code A SecDevOps Use Case
20mSecurity Initiatives in Community Driven Projects: Looking Ahead with Python and Rust
40mSecurity-as-Code to Accelerate DevSecOps, a Practical Guide to Get Started