<https://www.youtube.com/watch?v=s5PmzGGf-mU>
<http://schema.org/description>
"Security as a Whole System\n\nWe often think about security as the ultimate deep-technical problem, but like all serious engineering work, it's as much about people as technology.  We care about human and business outcomes, not (just) the technical components used to drive those outcomes.  Much like qualities like accessibility and performance, understanding whether a piece of software will result in an effective and secure outcome for a user requires us to take a whole-systems approach.  This sounds great in theory, just like slogans that say \"security is everyone's responsibility\", but when you try to put it into practice, you run into some big gaps.\n\nWhat is a security outcome?  How do they appear in the design process? How do we capture that understanding and make sure it moves all the way through a development lifecycle?  What demands does a practical whole-systems approach place on the relationship between security teams and the rest of the organization?  If we're trying to design outcomes for humans, how much of that design work is really about the task, not the tool?  If we treat users as experts on the outcomes they need like we do for many high-impact tools, what can we learn from looking at high-reliability user interactions, and how does that change what we try to help users do and what we expect them to learn?  If we remember that our engineers are human too, how does that shape the technical security countermeasures we build?\n\nBy the time you leave this talk, you'll understand why these are the questions you should be asking, a bit about where the answers are, and what to do next to build a new vision of security for your products and your users.\n\nAbout the Speaker\n\nEleanor Saitta was until recently the security architect for Etsy, Inc., and is currently consulting while she's between roles.  At Etsy, she kept an eye on the security implications of all development work and worked to improve both the systems built and the processes and culture across engineering and the larger company.  She was also driving the creation of product security design as a discipline inside and outside of Etsy, bringing sevice design, UX, and product teams into the effort to bring better security outcomes to users and companies.  Prior to Etsy, Saitta was a freelance security consultant specializing in architectural security for large-scale systems, integrating security into the development lifecycle, and cross-domain security for news organizations and NGOs targeted by nation states, and before that worked for a number of commercial consultancies, including Bishop Fox, IOActive, Security Innovation, and iSEC Partners.  Saitta is a co-founder and developer for Trike (http://octotrike.org/), an open source threat modeling methodology and tool which partially automates the art of security analysis and has contributed to the Briar (https://briarproject.org) and Mailpile (https://mailpile.is) secure messaging projects.  She's on the advisory boards of the Freedom of the Press Foundation (https://pressfreedomfoundation.org), the International Modern Media Institute (https://immi.is), and the Calyx Institute (https://calyxinstitute.org), all organizations that look at freedom in the media and security online.  Saitta is a regular speaker at industry conferences; past venues include O'Reilly Velocity, KiwiCon, ToorCon, CCC, Hack in The Box, and HOPE, among others.\n\nThis keynote was given at DevCon, Cerner's internal engineering conference. Check us out at http://engineering.cerner.com/\n\nCerner DevCon 2017\nJune 9, 2017"
<https://foghornconsulting.com/2022/04/07/send-attackers-phishing-somewhere-else/>