Information security is often perceived as the surly gatekeeper of I.T. whose iron grip chokes software delivery. Infosec commands the stage in this security theater, instituting punitive policies, procedures, and controls masquerading as security strategy. The negative side effects created by these “strategies” are traditionally overlooked when measuring security outcomes, resulting in superficial progress at the expense of organizational growth and productivity.
In this talk, we will unmask security theater and explore how it leads to increased organizational friction, especially in the realm of software delivery, rather than promoting safety. We will contrast these dramatics with a security chaos engineering approach – one which embraces the importance of convenience, alignment with organizational goals, and the wisdom derived from failure. Finally, we will conclude by exploring pragmatic approaches to security approval patterns that accelerate software delivery, level up security, and foster a collaborative culture between dev, ops, and infosec.
