there are many potential avenues for hackers to attack. And thanks to its tremendous global reach, there are also many well-funded bad guys who would take advantage of any chinks in Facebook's armour. Given that Facebook has a well-known mandate to "move fast and break things", this presents a dilemma.
"Security" and "moving fast" are usually exact opposites. Developers want to move fast, but the security team needs to make sure that the code they're writing isn't introducing new risks into the system. So Facebook turned the usual security process on its head, so its developers can keep moving fast without breaking anything too serious.
"You still have to move fast, there's now just a cost to moving fast," says Facebook open source software engineer Christine Abernathy.
A CRACK TEAM
Facebook software and security engineer Ted Reed says that the goal is to make security part of the normal workflow. If every developer at Facebook came to him whenever they got a suspicious email, that would be ideal. But the next best thing is to lock everything down behind the scenes.
"We put the burden on ourselves," Reed says.
Facebook's sheer size and scale makes it a target. There's a team of security pros at Facebook, Reed says, whose main job is to stand by until a call comes in.
When a developer flags a piece of the code they're working on as requiring review in Facebook's project management tracking tools, a security engineer rushes off to do a review as soon as they possibly can while the developer is free to keep on hacking away at the code. In a more proactive sense, Facebook's security squad is always working to protect the underlying infrastructure, making sure that the data that developers are working with is secured on every level.
The goal is to make the underlying security completely unnoticeable to the developer. "It becomes very hard to build insecure things," Reed says.
The security team also has to build a strong relationship with Facebook's developers. Often, Reed says, a member of the infrastructure security team will join a Facebook project team to help them solve a problem and end up joining that team permanently. Facebook encourages that kind of team-jumping flexibility, and the security team loves it it means that the product team in question now has someone devoted to preventing hacks.
Another big way that the secu- rity team wins over Facebook developers is by giving them something that they can't get enough of: Data.
After the notorious Hacking Team cybersecurity startup data breach incident, Facebook used Osquery to make sure they weren't compromised the same way. Reed's claim to fame at Facebook is leading the development of a tool called "Osquery"
"Security" and "moving fast" are usually exact opposites. Developers want to move fast, but the security team needs to make sure that the code they're writing isn't introducing new risks into the system. So Facebook turned the usual security process on its head, so its developers can keep moving fast without breaking anything too serious.
"You still have to move fast, there's now just a cost to moving fast," says Facebook open source software engineer Christine Abernathy.
A CRACK TEAM
Facebook software and security engineer Ted Reed says that the goal is to make security part of the normal workflow. If every developer at Facebook came to him whenever they got a suspicious email, that would be ideal. But the next best thing is to lock everything down behind the scenes.
"We put the burden on ourselves," Reed says.
Facebook's sheer size and scale makes it a target. There's a team of security pros at Facebook, Reed says, whose main job is to stand by until a call comes in.
When a developer flags a piece of the code they're working on as requiring review in Facebook's project management tracking tools, a security engineer rushes off to do a review as soon as they possibly can while the developer is free to keep on hacking away at the code. In a more proactive sense, Facebook's security squad is always working to protect the underlying infrastructure, making sure that the data that developers are working with is secured on every level.
The goal is to make the underlying security completely unnoticeable to the developer. "It becomes very hard to build insecure things," Reed says.
The security team also has to build a strong relationship with Facebook's developers. Often, Reed says, a member of the infrastructure security team will join a Facebook project team to help them solve a problem and end up joining that team permanently. Facebook encourages that kind of team-jumping flexibility, and the security team loves it it means that the product team in question now has someone devoted to preventing hacks.
Another big way that the secu- rity team wins over Facebook developers is by giving them something that they can't get enough of: Data.
After the notorious Hacking Team cybersecurity startup data breach incident, Facebook used Osquery to make sure they weren't compromised the same way. Reed's claim to fame at Facebook is leading the development of a tool called "Osquery"
Go test it!