Building a World Class Security Team

1. Michael Stoppelman
SVP of Engineering at Yelp
stop@yelp.com
@stopman
Building a World Class Security Team
“One Engineer at a Time”

2. Yelp’s Mission
Connecting people with great
local businesses.

3. Yelp Stats
As of Q2 2016
92M 3272%108M

4. $`whoami`
Michael Stoppelman
●Purdue Alumni, BS in CS;
graduated in 2003
●2003 - 2007 - software engineer -
Google
●2007 - now() - SVP of
Engineering - Yelp (9.5+ years)
@stopman

5. 2005-2009 - not a big target yet

6. 2010 - Now we’re a target…

7. Our first security audit…

8. Security Czar - 2011

9. V0 Hiring

10. V0 Early mistakes…

11. V0: 2FA Everywhere

12. XSS protection by default

13. Evil Redirects!

14. V1 Hiring

15. Getting Good at Basics - Corp
● Malware detection
● Full Disk Encryption - lost or stolen hardware
● Building up “RunBooks” for incident response
● 3rd party auditing
● Phishing education/response
● VLANs

16. Getting Good at Basics - Corp Cont’d
PHISHING EXAMPLE

17. Getting Good at Basics - App
● Remove secrets from your code base!
● Secure the cloud, VPCs/IAMs in AWS
● Make it hard for developers to leak sensitive fields
display_name(full_lastname=True)
● Rotating credentials
● Secure your source code

18. V2 Hiring

19. Getting Professional - Corp
SIEM

20. Getting Professional - Apps
Public Bug Bounty
Program DDoS attacks

21. Q&A
Bug Bounty Program
DDoS attacks
SIEM
Phishing
Hiring
Team Structure
PII

22. @YelpEngineering / @stopman
fb.com/YelpEngineers
engineeringblog.yelp.com
github.com/yelp