Making Security Priority Zero
summary
Argues security must be priority zero, treated as an ongoing process tied to reliability not a bolt-on feature, and shows concrete tactics: build threat models with an attack tree, rate threats using DREAD or expected-loss (impact × probability), prefer white‑lists, enable secure-by-default settings, use least privilege, and include security in code reviews. Cites LinkedIn’s 6.46M leaked hashes, praises GitHub’s quick private‑key response, recommends isolating and rebuild compromised systems (don’t patch in place), and outsourcing PCI data to transfer risk.
AI-written summary · about
chapters (17)
- 0:00Introduction
- 1:29What security is
- 4:19Security is CEO priority
- 5:22Human limits in security
- 7:06Blockers to security
- 9:39Security trade-offs
- 10:43Four pillars of security
- 11:25Secure system design
- 15:24Risk management
- 20:24Security risk assessment
- 23:39Secure-by-design systems
- 26:31Security vulnerabilities
- 29:22Security threats and exploits
- 31:29Security incident response
- 36:45Breach disclosure
- 46:06Good vs bad responses
- 49:14Conclusion
related talks
38mPrioritizing Trust While Creating Applications
31mPrioritizing Trust while Creating Applications
24mSecurity by default
48mLevel Up Your Security Mindset
52mContinuous Security
51mSecurity 101: A Beginner’s Guide to Cybersecurity and Zero Trust for Developers
33mInterview with
42mImperfect Security: Doing Less to Achieve Better Security