Reconciling Performance and Security in High Load Environments

Most perceive security fixes and improvements as a necessary evil, because security is much “less tangible” than primary product functionality in terms of potential revenue. On top of not bringing any “meaningful” value to the overall system, security comes at a cost of potential performance degradation, as it steals precious CPU cycles and memory from the overall resource pool.

Because of the above in a performance-driven environment product and infrastructure security are either heavily avoided altogether or forcibly imposed by security teams, excusing themselves with numerous legal and compliance requirements. The fear of potential performance penalty and the need to balance performance vs security often leads to insecure architectures and designs or unnecessary complexity.

All this usually makes the rest of the organisation dislike and distrust security in the long term. But what if we can show that security actually improves performance? This presentation explores how to drive security in a high performance environment and make it a welcome and natural part of the product lifecycle.