Kevin Riggle
An introduction to approachable threat modeling
In this tale of two threat models, we explore how pairing our existing knowledge and experience with a few simple questions can help us build better systems and keep them safe.
This issue explores technical, tactical, and empathetic ways to make the systems we build more secure.
Emily Cain
Why don’t we follow password security best practices?
From broken password change pages to conflicting best practices, users face a host of challenges when making password decisions. How can we remove the obstacles and help them use the systems we build securely?
Sha Sundaram and Lucie Lozinski
How to practice privacy without slowing down
No matter how lean your team, or how fast-moving your startup, you can—and should, and must—enact privacy principles. Here we discuss the difference between privacy and security, and what you can do to make good privacy practices the default.
Shraya Ramani and Logan McDonald
The process: Open sourcing BuzzFeed’s single sign-on experience
When BuzzFeed’s microservice ecosystem began to outgrow their existing auth patterns, they faced a common conundrum: Build or buy a solution? They chose the former—and to share it with the world.
Serena Chen
Design for security
Applying design thinking to security practices can create a better, more secure experience for your users.Kathy Wang
Ask an expert: How can companies develop a culture of security?
Security is everyone’s job, but tension between engineering teams and security teams persists. Kathy Wang, director of security at GitLab, weighs in on how to defeat the “us vs. them” mentality.Alice Goldfuss
They know where you live
How we can better protect users by considering the impact of our technical and product decisions on their privacy—and safety.David J. Lumb
The story of Signal
Whether mitigating active privacy concerns or protecting communications on principle, for many in journalism and tech, Signal is the go-to for secure messaging. Here’s a look at its history, use cases, and how it fits into the messaging ecosystem.
Patrick O’Doherty
How automation can raise the bar on security
Leveraging automation can contribute to an orderly production environment—and make the secure path the path of least resistance for your engineers.
Chris Stokel-Walker
The mystery of steganography
Modern, nefarious interpretations of the age-old technique of covert communication have stoked the fires of curiosity—but is steganography really a major security concern?
Glenn Fleishman
Free certificate authorities and the rise of the encrypted web
To fully encrypt the web, you need to make certificates free and easy to obtain. Enter Let’s Encrypt.Hannah H. Kim
Security, weaponry, and the ethics of trust
Can an autonomous weapons system be trusted? This interview with Professor David Danks explores the ethics of lethal autonomous weapons systems (LAWS), and the security risks these AI systems face.
