徹底的なセキュリティ対策：安全なアプリケーションを構築するための大原則 – Anastasiia Voitova, Cossack Lab

Any security controls you use to build applications will eventually be broken (or fail). How do we build our systems in a way that security incidents won’t happen even if some components fail? How to prevent data leaks if penetration tests succeed? “Defense in depth” is a security engineering pattern that suggests building an independent set of security controls aimed at mitigating more risks even if the attacker crosses the outer perimeter. Anastasiia Voitova models the threats and risks for the modern distributed application, and improves it with multiple lines of defense. She overviews high-level patterns and tools from the security engineering world, and explain them for DevOps practitioners and architects. Discussion includes practical security engineering approaches, and covering security controls from complex encryption schemes to modern DevOps tools.