The One About Controls
summary
Argues that effective security comes from a controls lifecycle that identify, select, implement, validate, refine and from choosing controls against standards (NIST, ISO, PCI, CIS, MITRE) while accounting for capability, capacity, cost. Gives a startup example: require MFA for IT staff but not all users, screen outbound email, harden input validation to stop SQL injection, skip digital rights for now. Recommends OSCAL/JSON for automation, six–nine months to operationalize, and metrics that are clear, consistent and concise.
AI-written summary · about
chapters (11)
- 0:00Introduction to controls
- 3:11Maslow’s hierarchy priorities
- 6:23Control needs examples
- 8:50Control lifecycle selection
- 12:46Implementing controls
- 14:51Validating control effectiveness
- 16:58Control performance metrics
- 20:12Presenting metrics to management
- 23:25Refining controls feedback
- 25:12Control lifecycle summary
- 28:41Q&A on retirement standards
related talks
47mThe Only Reason Security Really Matters for DevOps
24mSecurity Compliance as Code
28mSecurity Basics: Burn It All and Start Over
28mImplementing Critical Cybersecurity Controls in a DevOps Environment
49mPragmatic Approaches To Building Secure Software
29mUsable Security: A Human-Centric Approach to Security
40mCybersecurity Controls: It Isn't Just Technical Controls That Need Testing
40mDesign Approaches for Security Automation