44CON 2019

As many enterprises shift to a cloud first business model, asset visibility can become increasingly difficult for security. Cumbersome gated approval processes, a security mainstay for years, are now quickly bypassed in the name of developer agility and growth. Security practitioners need new approaches that move at the pace of this new DevOps driven world.

In this session, we will tell the story of a simple premise: can we discard a cumbersome approval process, throw open the gates, and build visibility for security by offering free “backdoored” server resources to developers. We’ll share the context that lead to our premise, the tooling we built to facilitate the experiment, our success criteria, 3 years of practical experience running the program, and lessons learned.