The Evolving Practice of Security

Michael Brunton-Spall Bruntonspall Ltd
The evolving practice of
security

InfoQ.com: News & Community Site
Watch the video with slide
synchronization on InfoQ.com!
https://www.infoq.com/presentations/
security-best-practices
• Over 1,000,000 software developers, architects and CTOs read the site world-
wide every month
• 250,000 senior developers subscribe to our weekly newsletter
• Published in 4 languages (English, Chinese, Japanese and Brazilian
Portuguese)
• Post content from our QCon conferences
• 2 dedicated podcast channels: The InfoQ Podcast, with a focus on
Architecture and The Engineering Culture Podcast, with a focus on building
• 96 deep dives on innovative topics packed as downloadable emags and
minibooks
• Over 40 new content items per week

Purpose of QCon
- to empower software development by facilitating the spread of
knowledge and innovation
Strategy
- practitioner-driven conference designed for YOU: influencers of
change and innovation in your teams
- speakers and topics driving the evolution and innovation
- connecting and catalyzing the influencers and innovators
Highlights
- attended by more than 12,000 delegates since 2007
- held in 9 cities worldwide
Presented at QCon London
www.qconlondon.com

Michael Brunton-Spall
He/His/Him
michael@bruntonspall.com
https://tinyletter.com/cyberweekly

Why is security evolving
Where we’ve come from
Where we are going

How to rethink security
practices in organisations

Some Context

08/05/2019 6
2005

08/05/2019 7
2010

08/05/2019 8
2013

08/05/2019 9
20182018

Maginot Line

1930 France
“We’d really like the
Germans not to invade”

In WW1, they came slowly
overland and built trenches

The Germans had invented
Blitzkrieg “Lightning Strike”
which simply went around

The French were fighting a
war from 1920 against an
adversary using 1939
techniques

The evolution of compute

From on premise to cloud

Physical machine

Remote hosted machine

Virtual machines in a data
center

Virtual machines at scale

Side note: Wardley Mapping

Why Wardley Maps?

We can see changing
landscapes

We can discuss strategies

A map isn’t reality, it’s just an
abstraction

Things evolve

As servers move from
physical to virtual, single to
multiple, practice evolves

Coevolution of product and
practice

From pets to cattle

How do we administer
servers?

Worries about hard drives,
CPU’s, power etc

Cloud providers give us
abstractions

We stop worrying about
whether a hard drive fails in
a server

This results in changing
operations practice

DevOps, SRE

This results in different
developer consumption of
operations

Kubernetes, Serverless

What does this mean for
security?

How we think about security
has to change

Security practices are
evolving

Traditional security is about
assurance

Where will my data sit

Where does the data go

This works when you have
individual servers

This doesn’t work with
modern cloud

This doesn’t work the same
with modern cloud

“Skate to where the puck is
going, not where it has
been”
Wayne Gretsky

Where the puck was
yesterday

What are solved problems?

Commonly solved the same
way

Productionised processes

SDLC, Assurance of suppliers,
network assurance,
hardware assurance

All cloud customers have
similar concerns in this area

Buy don’t Build

Compliance via certificates
ISO27001, CSA, ISO27017,
SOC, FISMA, HIPAA …

Where the puck is today

Continuous Integration,
Continuous Deployment,
DevOps

Patching

How quickly can you patch?

DevOps

How secure is your code?

Code review and Pull
requests

Staff identity and single sign
on

Zero Trust Networking

But where is the puck going?

Adversary thinking

ATT&CK Framework

Goals, Restrictions

No adversary has unlimited
funds, time and energy

Anti Personas

Han Solo
Motivation
Han Solo is motivated primarily by money, but
also works with the rebel alliance.
Han is capable of using common tools as well
as modifying existing tools on the fly
Han doesn’t want to be caught and so takes an
effort to avoid head on confrontations
Capabilities
Resources: 2/5
Capability: 4/5
Bravery: 2/5
Criminal connections: 3/5
Connections
Rebel Alliance, Hutts

Red Teams

Internal pentesting

Threat Hunting

DevSecOps

Security as code

Compliance as Code

Cloud configuration as code

Pull requests = audit trail

AWS System Manager

Azure Policy

Final thoughts?

How to get value from your
existing security teams?

Empathy first

“Regardless of what we discover, we
understand and truly believe that
everyone did the best job they could,
given what they knew at the time, their
skills and abilities, the resources available,
and the situation at hand.”

Michael Brunton-Spall
michael@bruntonspall.com
https://tinyletter.com/cyberweekly

Watch the video with slide
synchronization on InfoQ.com!
https://www.infoq.com/presentations/
security-best-practices

The Evolving Practice of Security

Recommended

Recommended

More Related Content

More from C4Media

More from C4Media (20)

Recently uploaded

Recently uploaded (20)

The Evolving Practice of Security