Change is Hard - Securing the Future Today

Explore the challenges of implementing modern security practices in organizations through this thought-provoking conference talk. Delve into the socio-technical aspects of security, examining the interplay between human resistance to change and technological advancements. Learn how to overcome organizational inertia and foster a more holistic approach to security that integrates developers, operations, and security teams. Discover insights on evolving security practices, the concept of 'securability', and the importance of addressing both technical and human factors in creating effective security solutions. Gain valuable perspectives on navigating the complex landscape of security in the age of DevOps, microservices, and serverless architectures.

Change is Hard - Securing the Future Today Andrew Clay Shafer, Red Hat
not a security expert
aspiring pattern matcher and puzzle solver
security: a goal and a constraint
who, what, when
Legacy applications
So you wanna change the world?
continuously devops microserverless
software is eating the world
software is eating software security
developers AND operations AND security can and should work together • Security is evolving to include and be included in software development
SRE builds framework modules to implement canonical solutions for the concerned production area. As a result, development teams can focus on the business logic, because the framework already takes care of correct infrastructure use.
What is the equivalent negotiation for securability?
What are the principles of 'securability'?
good devops copy
Embracing Risk? Eliminating Toil? Security Level Objectives?
Security engineers build framework modules to implement canonical solutions for the concerned production area. As a result, development teams can focus on the business logic because the framework already takes care of security considerations.
simple is not always easy
seek advantage
The problem isn't technical. The problem isn't people. The problem is socio-technical.