Building Secure and Reliable Systems

Chapter 21. Building a Culture of Security and Reliability

By Heather Adkins

with Peter Valchev, Felix Gröbert, Ana Oprea, Sergey Simakov, Douglas Colish, and Betsy Beyer

Imagine a new employee joining your organization. Is that employee aware of the importance of security and reliability, and how they are prioritized among other organizational objectives? Do employees know what role they play in ensuring that systems can withstand errors coming from a bad push or malicious adversaries?

This chapter outlines aspects of a healthy culture of security and reliability. We also touch on how you can affect organizational culture by choosing good practices when it’s time to make changes. Finally, we provide insights into how to influence leadership and teams across the organization to build buy-in for security and reliability.

We share some practices here that we’ve found useful at Google and elsewhere, but keep in mind that no two organizations are exactly the same—you’ll need to adapt these techniques to the culture of your organization. You will also find that it’s likely not possible to adopt all of these strategies. This chapter is meant to be a guide and reference for continuous consideration. It’s worth noting that at Google, we don’t practice the recommendations we cover here perfectly every day, but rather seek to improve in each approach as part of building our overall culture.

Effective security and reliability flourish when organizations embrace their importance by building ...