Designing secure architectures, the modern way
Most of the design thinking for preventing security incidents and performance bottlenecks focuses on avoiding known risks in a known way. However, most of the time this approach leads to cost-efficient systems that are prone to unexpected failures and attack chaining.
Instead, taking security into account on architecture design phase, learning to accept and manage security risks appropriately on each level of systems design and implementation, typically results in resilient systems that can fail to update a small component – but that barely matters, because the risk is well-managed.
This talk will try to cross the bridge between modern DevOps/SRE practices, systems architecture design and traditional security/risk management. It is driven by lessons learnt from building systems the modern way in high-risk environments with high reliability and security demands, drawing from experience of protecting governmental secrets, critical infrastructure and preventing banking fraud at scale.