Secure and Reliable Systems for Designers, Implementers, and Maintainers

From the Publisher and Preface

Why We Wrote This Book

We wanted to create a book that focuses on integrating security and reliability directly into the software and system lifecycle. Our aim was to highlight technologies and practices that protect systems and keep them reliable, as well as illustrate how those practices interact with each other. This book provides insights about system design, implementation, and maintenance from practitioners who specialize in security and reliability.

We acknowledge that some of the strategies recommended in this book may require infrastructure support that may not exist in every organization. Where possible, we suggest approaches that can be tailored to organizations of any size. However, we felt it was important to start a conversation about how we can all evolve and improve existing security and reliability practices, as members of our growing and skilled community of professionals can learn a lot from one another.

We hope other organizations will be eager to share their successes and war stories with the community. As ideas about security and reliability evolve, the industry can benefit from a diverse set of implementation examples.

Security and reliability engineering are still rapidly evolving fields, and we constantly find conditions and cases that cause us to revise or replace previously firmly held beliefs.

Who This Book Is For

Since security and reliability are everyone's responsibility, we're targeting a broad audience: people who design, implement, and maintain systems. We're challenging the dividing lines between the traditional professional roles of developers, architects, Site Reliability Engineers (SREs), systems administrators, and security engineers. While we'll dive deeply into some subjects that might be more relevant to experienced engineers, we invite you, the reader, to try on different hats as you move through the chapters, imagining yourself in roles you (currently) don't have and thinking about how you could improve your systems.

We argue that everyone should be thinking about the fundamentals of reliability and security from the very beginning of the development process, and integrating those principles early in the system lifecycle. This is a crucial concept that shapes this entire book. There are many lively active discussions in the industry about security engineers becoming more like software developers, and SREs and software developers becoming more like security engineers. We invite you to join in the conversation.

When we say "you" in the book, we mean the reader, independent of a particular job or experience level. This book challenges the traditional expectations of engineering roles and aims to empower you to be responsible for security and reliability throughout the whole product lifecycle. You shouldn't worry about using all of the practices described here in your specific circumstances. Instead, we encourage you to return to this book at different stages of your career or throughout the evolution of your organization, considering whether ideas that didn't seem valuable at first might be newly meaningful.

product information: