DevOps: Securing without Slowing

(TEK Keynote) We turn to DevOps for speed. We turn to Cloud for flexibility. We adopt faster, leaner, more collaborative processes to drive change. And then? We turn to information security for protection. But can we secure the technology without slowing the pace? This session presents an entirely fictional development organization adopting DevOps. We will discuss which traditional software security processes work, and which ones fail entirely. Awareness training, muscle memory, culture shifts, all will be brought together. The presentation will conclude with take-aways for applying security to your DevOps team without slowing down.

Watch more videos on my YouTube channel.

Who do we need to include to successfully PoC a security product? Let’s look to Walt Disney for inspiration. Seems like a stretch, but trust me, cartoon animals are a success criteria.

Watch more videos on my YouTube channel.

Acknowledging the black swan in the room, how can we make a flexible BCP/DRP? Quick summary of strategy, tactics, and disaster scenarios.

Watch more videos on my YouTube channel.

Zero Trust is a lot like Blade Runner. Everything looks fine. But if we ask a few questions, things can turn out to be completely different.

Watch more videos on my YouTube channel.

What can we learn from people who develop title sequences which start our favorite television shows? And what does good look like, for starting projects?

Watch more videos on my YouTube channel.

Considerations when implementing password resets. What factors do you verify the person with?

Watch more videos on my YouTube channel.

An ongoing attack has wiped data on more than 15,000 ElasticSearch servers. That’s about a third of all the Internet-facing ElasticSearch instances. Good time to review how to secure this resource.

Watch more videos on my YouTube channel.

The architect Robert AM Stern once said, “architects don’t copy, they quote.” Perhaps our problem is when we copy best practices. So here’s a way to quote when designing a security capability.

Watch more videos on my YouTube channel.

Contrast the RSA Conference’s theme of the Human Element and the vendors’ theme of AI/ML appliances. This debate between intelligence augmentation and artificial intelligence has a long history, going all the way back to Douglas Engelbart versus Marvin Minsky. Let’s look at the history and look at the use cases for AI/ML in today’s security operations.

Watch more videos on my YouTube channel.

During the Windows login process, a cleartext password will get shared with the password filters. Sure, this can be used for defense. But it can also be used by criminals to steal passwords.

Watch more videos on my YouTube channel.