Construction Time Again: A Lesson in Paving Paths for Security
summary
Netflix describes a “paved road” approach that builds concrete tools: managed delivery for automated, asynchronous patching (used to remediate Log4Shell, patching 95% of apps twice in seven days), a Wall‑E API proxy for TLS/WAF/auth/DDoS on internet apps, data gateways and experiments with service mesh. Lessons: productize security, add guardrails and shared accountability, automate remediation and access right‑sizing (Repokid), measure real risk, and avoid building unnecessary bespoke platforms.
AI-written summary · about
chapters (7)
- 0:00Introduction and agenda
- 4:15Security strategy evolution
- 7:46What is The Paved Road
- 15:15Successes and scaling
- 19:59Key learnings and pitfalls
- 26:47Recommendations for security teams
- 35:14Final takeaways and Q&A
related talks
53mWe Come Bearing Gifts: Enabling Product Security with Culture and Cloud
52mPaving the Road to Effective Software Development
23mPaving a Secure Road
17mRelationship Therapy: Keeping Developers and Security Teams Happy
52mContinuous Security
45mFast, Ever-Evolving Defenders: The Resilience Revolution
46mApplication security from start to finish
38mBuilding Security at Speed