Defensive Coding Bootcamp
summary
Shows the Codecov supply-chain breach where a tampered Docker image exfiltrated CI env vars, warns that kubernetes secrets are base64 and not encrypted, recommends operational changes like rotate keys monthly and keep keys rotatable on demand, cites OWASP Top 10 as covering OWASP Top 10 covers ~80% of common issues, calls out Java deserialization and PHP serialized-object escalation, advises replacing weak hashes like avoid SHA-1 and adding security-focused tests and password managers.
AI-written summary · about
chapters (28)
- 0:00Introduction and welcome
- 1:03Why this talk matters
- 3:53Don’t always build it yourself
- 4:56Plan to rotate your keys
- 6:43Be skeptical of new libraries
- 8:07OWASP top 10 vulnerabilities
- 9:10Raise your hand on security
- 11:18Understand framework limits
- 13:24Test for vulnerabilities
- 14:47Secure your data, not just the app
- 16:54Authentication methods matter
- 17:59Encoding vs encryption
- 19:06Serialization vulnerabilities
- 21:11Avoid insufficient hashes
- 23:00Code becomes insecure over time
- 25:09Use NIST cybersecurity framework
- 26:12Validate everything every time
- 28:39Be lazy and secure
- 29:20Cultural threat assumptions
- 31:2780% of security is common knowledge
- 32:31See the big picture
- 34:15Get a trusted second opinion
- 35:44Start with security, not after
- 37:09Secure your environment
- 38:56Password managers reduce risk
- 39:17Sound the alarm on breaches
- 40:19What to wish you knew earlier
- 42:47Challenge assumptions respectfully
related talks
51mDefensive Coding Bootcamp
28mCode, Dependencies and Security: Where Is the Risk
45mDefensive Coding Bootcamp
44mOpen Source Security: The World Needs Our Help
24mCracking the Code of Cloud Security
01h 24mCode Red: Navigating the Minefield of Security Programming Blunders
37mSecuring Containers by Breaking In
51mShifting Knowledge Left: Keeping up with Modern Application Security