Building and scaling a security detection platform: A Netflix Original

Description

The combination of Netflix’s culture of freedom and responsibility and the sheer size of its worldwide operations sets a unique stage for enterprise security. The need to detect potentially malicious activity along a growing attack surface has become paramount. This in turn translates into the need for greater velocity to deploy end-to-end data-driven detection pipelines across a wide range of endpoints that produce actionable insights for security analysts.

John Bennett and Siamac Mirzaie share an approach that enables Netflix teams to deploy brand-new detection pipelines using a variety of analytical techniques, ranging from simple rules to machine learning, in a matter of hours with relatively minimal code work. John and Siamac discuss some of the business considerations that propelled the project forward before exploring some of the rationale behind the architecture of this platform. They then dive deeper into the capabilities of the system with technical insights into the implementation itself. They conclude by reflecting on the lessons learned throughout this journey.