DevOops: Redux
summary
Concrete checks and fixes replace vague DevOps warnings: OSQuery + Doorman fleet control is used to detect and remediate compromised developer hosts, and BlockBlock, Little Snitch, Carbon Black, sysmon catch persistence and PowerShell abuse on macOS and Windows. AWS defense configures CloudTrail → CloudWatch → SNS alerts, enforces MFA and STS temporary creds, and runs billing alarms to spot abuse. GitHub scanning (gitmonitor / scrumble / getRob) finds leaked keys; backups use separate AWS accounts.
AI-written summary · about
chapters (24)
- 0:00Background: CG
- 4:38Monitoring External Services
- 5:49Monitoring GitHub
- 8:22AWS Access Keys Example
- 9:01Monitoring Goals
- 11:56Host Protections
- 21:22Hardening Checklist
- 21:50Don't Use Root Account
- 27:29Example Password Policy
- 27:43Hardening Recap
- 29:54AWS Cloud Trail
- 30:28AWS Monitoring (SNS)
- 31:32AWS Config
- 33:21AWS CloudWatch
- 33:58AWS Monitoring (CloudWatch - Billing)
- 35:49AWS Monitoring (CloudWatch - Root Login)
- 37:26AWS Monitoring (CloudWatch - Failed Logins)
- 38:38AWS Monitoring (Unauthorized Activity)
- 40:00AWS Monitoring (CloudWatch) - Filter Patterns
- 40:16AWS + Splunk
- 43:13Monitoring Recap
- 47:06AWS Restoration & Recovery
- 48:36AWS Incident Response
- 50:05View this Presentation Here
related talks
40mDevOoops (Increase awareness around DevOps infra security)
30mDevSecOps State of the Union
38mAdventures in Cloud Security: What DevOps Can Learn from a Security Engineer
51mSecDevOps: Current Research and Best Practices
49mLessons from DevSecOps Trenches
39mSecurity in a DevOps World
20mDeveloper’s security survival guide
48mThe Quick Wins of DevSecOps