As a community, we talk a lot about security goals and trade-offs and about the controls we may use to get there. What we don't talk enough about is first principles. Susan Sons shares the seven information security practice principles developed with her team at IU CACR and introduces a mental model for reasoning about security instead of trying to memorize for security.

Susan Sons demonstrates how to refactor complex and possibly very broken systems and software while in operation, covering architecture, project management, and security aspects.