$30 off During Our Annual Pro Sale. View Details »

Building Security Culture on Infrastructure Teams

Building Security Culture on Infrastructure Teams

Security is an increasingly important aspect of software development, especially for services that process and store sensitive data.

In rapidly growing and dynamic organizations, infrastructure teams need to balance building features to support product growth and business goals while maintaining a secure platform. At Stripe we believe that security is a collective responsibility, and it’s especially important to closely collaborate with security teams to continually improve the quality of decisions and changes that affect sensitive systems.

In this talk, we’ll discuss strategies for building a culture of security so infrastructure and security teams can each play to their strengths while maintaining high development velocity. We’ll walk through some examples of both how we typically run security-sensitive projects at Stripe as well as processes that help to extend security awareness (and interest!) through the rest of your organization.

Franklin Hu

June 12, 2019
Tweet

More Decks by Franklin Hu

Other Decks in Technology

Transcript

  1. Building Security Culture
    on infrastructure teams (or any engineering team)
    Franklin Hu
    @thisisfranklin
    [email protected]

    View Slide

  2. View Slide

  3. Image of payments happening

    View Slide

  4. Challenges
    Building & Maintaining Trust
    Scaling with Growth

    View Slide

  5. What do we want in our security culture?
    Learning & Growth
    Empathy
    Responsibility

    View Slide

  6. Learning & Growth
    Create a safe space where people can:
    ● Build expertise over time
    ● Ask questions
    ● Try things and fail in a supported way

    View Slide

  7. No Shaming.

    View Slide

  8. “Shame erodes our courage and fuels
    disengagement” – Brené Brown

    View Slide

  9. Learn from mistakes, don’t shame
    Learning & Growth

    View Slide

  10. Diverse & Dynamic → Disagreements
    Empathy

    View Slide

  11. Thou shall not use ...

    View Slide

  12. Security is Everyone’s Job
    Responsibility

    View Slide

  13. ...with shrinking surface area over time
    Responsibility

    View Slide

  14. What do we want in our security culture?
    Learning & Growth
    Empathy
    Responsibility

    View Slide

  15. How do we do this?
    Practices
    Environment
    Process

    View Slide

  16. Practices

    View Slide

  17. Find security-interested people
    Practices

    View Slide

  18. Rotations!
    Practices

    View Slide

  19. Security advocates
    Practices

    View Slide

  20. Environment
    Fostering a positive culture of learning

    View Slide

  21. Make space for learning

    View Slide

  22. Discussion & Presentation Forums

    View Slide

  23. Tabletops & Game Days

    View Slide

  24. Tabletops
    Tabletops: Talk through response to a scenario

    View Slide

  25. Tabletops
    Scenarios can be cross functional: Legal, Engineering, Regulatory

    View Slide

  26. Game Day:
    What happens if we `kill -9 redis`?

    View Slide

  27. shipped@ / fixed@

    View Slide

  28. security-shipped@
    pre-shipped@

    View Slide

  29. Increment

    View Slide

  30. Increment

    View Slide

  31. Processes

    View Slide

  32. Security review?
    Classic Programmer Paintings, Their First Code Review

    View Slide

  33. Security Review:
    Context, Context, Context

    View Slide

  34. To conclude...
    Elements
    ● Responsibility
    ● Learning & Growth
    ● Empathy
    Tools
    ● Rotations
    ● Security Advocates
    ● Tabletops, Gamedays
    ● shipped@, fixed@
    ● Security Review

    View Slide

  35. Thanks!
    Franklin Hu
    @thisisfranklin
    [email protected]
    Appendix
    Daring Greatly: How the Courage to
    be Vulnerable Transforms the Way
    We Live, Love, Parent, and Lead
    (Brené Brown)
    Increment.com
    https://stripe.com/blog/game-day-e
    xercises-at-stripe

    View Slide