We Come Bearing Gifts - Enabling Product Security with Culture and Cloud

Explore a revolutionary approach to product security in this APPSEC Cali 2018 conference talk. Discover how Netflix's Application Security team balances security impact with engineering enablement by embracing cloud-centric automation and discarding traditional security behaviors. Learn about innovative techniques such as provable application identity, immutable and continuous deployment, and secret bootstrapping. Gain insights into replacing heavy-handed gating with an automation-first approach, building powerful security capabilities on cloud deployment primitives, and fostering a culture of enablement. Delve into topics including threat modeling, automating vulnerability detection, static analysis scans, and the challenges of implementing this security philosophy. Understand how this approach supports high-velocity engineering teams and addresses the question: "What if security never had to say 'no'?"