Cutting to the chase: Security Design and Guidance at scale

## Overview Ninad Dello, a security engineer at Datadog, presents a comprehensive framework for implementing security design and guidance across fast-paced, engineering-heavy organizations at scale. The talk addresses how lean security teams can effectively guide product development through intentional design practices rather than reactive security measures.

## Scale and Security Design Context Dello defines scale not just as organizational size or volume, but as the compounding effect of growth in fast-paced, cloud-native environments. At organizations like Datadog, this means new services and features ship frequently, creating a disproportionate ratio of engineers to security practitioners. Security must therefore operate via calculated bets guided by value, impact, and ROI rather than attempting to audit everything.

## Secure SDLC Framework The secure development lifecycle integrates security across five phases: requirements (security requirements and assessment plans upfront), design (RFC and specification reviews with threat modeling), coding (secure code review using SAST/SCA), testing (security testing and pen tests), and release (monitoring, audit logs, and incident response readiness). This "shift left" approach proactively identifies vulnerabilities before they become costly to fix.

## The Trio of Success Plus Constraints Dello identifies three core pillars—tools, processes, and people—but emphasizes that effective implementation requires understanding organizational constraints (budget, culture, team expertise). Tools automate intake and determine service criticality; processes define when and how security reviews occur; people execute the work. The cost-value proposition must be clear: developers gain clear security expectations, product owners understand necessary actions early, and security engineers gain visibility into overall risk posture.

## Security Design Reviews These are mandatory at service launch, major updates to existing services, and for security-sensitive changes. Dello categorizes reviews into four levels: Level 1 (lightweight consult), Level 2 (RFC or code review), Level 3 (full security assessment), and Level 4 (partner-led, quarter-long engagement). A tailored intake process collects upfront information on data stores, internet exposure, authentication/authorization usage, untrusted inputs, and service interfaces—enabling the team to prioritize effort and create baseline threat models.

## Decentralized Security Model Instead of centralizing security decisions, organizations should deploy security partnerships for high-priority initiatives and train security champions within product teams. Champions use a worksheet-based approach covering application logic, SDLC practices, access control, cryptography, auditing, and data protection—enabling incremental skill-building through learning-by-doing rather than top-down mandates.

## Developer Experience as a Foundation Drawing on DevX research, Dello frames security activities through three dimensions: Flow State (minimize friction by automating intakes, streamlining meetings, providing async-first communication), Feedback Loops (quick responses to code reviews, transparent reasoning for findings, no unnecessary blocking), and Cognitive Load (provide paved roads like standard images and signing, auto-remediate where possible, maintain searchable security knowledge bases). The core principle is: "thou shalt not block" unless absolutely necessary; design adds value faster than it adds cost when properly executed.

## Key Takeaways Decentralize security functions; build rich security context by collecting information upfront; minimize blockers and leverage tools, processes, and people effectively; adopt an iterative, culture-focused approach since meaningful change takes time and sustained effort.