LISA18

Security is hard. Organizations and businesses tend to sacrifice security for speed, which often leads to undesirable security outcomes for organizations. There's good news though: system engineers, administrators, ops professionals of the world are in a unique spot to make security in their organization better! This is especially true for engineers in smaller organizations and startups, because you don't need to be a Security Person™ to make an organization more secure.


In this talk we'll dig into how a security company thinks and acts about security internally - and the lessons you can take away from it. What did we start with? Where are our pain points? Where are we going? We'll talk about threat models, the pain of constraints, how you can get into trouble with cryptography, the importance of UX, vendor assessments and incident response. At the end, you'll have cultural, engineering, and architecture ideas to take back to your organization and implement.