Security as a Service

In the game of security, defenders have to be lucky every single time, but just one time is enough for an attacker. Good news: by leveraging good practices one can tilt the scales significantly in their favor. Bad news: it's not always an easy and quick thing to do. PE and SRE teams have helped building reliable infrastructure and software across the stack, can their skills and experience be leveraged to improve security posture within an organization?

Facebook's Production Engineering Security team has proved that it's indeed possible. In this talk I'm going to give you a brief overview of the security landscape today (aka the battlefield), give you a simple framework for thinking about security in the context of a production environment and show ways in which we engage with others both internally and externally.