Security as a Service
summary
Facebook Production Engineering Security starts as four people and scales across two continents while supporting a 12-deploys-per-day production model. The team runs security services like LDAP, Kerberos and SSH, builds an internal security/secret broker and hands code to owning engineering teams; those services stay live in production and are adopted when they remain cheap (often a one-line flip or trivial config) and battle-tested. Work focuses on CIA triage, threat modeling and defense-in-depth rather than unattainable metrics.
AI-written summary · about
chapters (11)
- 0:00Introduction to SRE in security
- 1:56Modern security challenges
- 3:46Bridging SRE and security
- 7:05Operational engagement models
- 8:38Service-based security engagement
- 12:22Dependencies and design strategy
- 14:33Core security thinking models
- 18:11Threat modeling and assessment
- 20:57Defense in depth
- 22:13Promoting security to engineers
- 25:31Getting started with security
related talks
24mBeing secure by design: Engineer-led security
28mSecurity as a Service: Work where You Engineers Live
57mBuilding a Modern Security Engineering Organization
21mSecuring a Security Company
26mSecurity Is an API: Evolving to a decentralised security culture
20mSecurity Culture & Scaling Your Security Humans
16mMeet our Security Engineers
31mDevSecOps, or How to Integrate Security into DevOps Practices