How Do I Secure My Micro-Services?
summary
Argues for concrete practices not theory: run dependency-check in CI for third‑party vulnerabilities, centralize secrets in HashiCorp Vault, automate TLS issuance (Let’s Encrypt) and rotate creds, and deploy a service mesh with envoy + spiffe for mutual TLS. Extract crypto and auth into hardened services (HSM/crypto‑anchors) and add lightweight runtime checks and chaos tests. Reports real wins and tradeoffs—monitoring becomes mandatory, tooling diversity bites, and an Adobe audit found roughly half of owned assets previously went undiscovered.
AI-written summary · about
chapters (30)
- 0:00Intro
- 0:50Questions
- 3:55Agenda
- 4:46Microservices
- 6:39Security in DevOps
- 7:51Challenges
- 8:53Benefits
- 10:19Success measurements
- 11:37Architecture
- 14:17Security Challenges
- 17:57Security Benefits
- 21:49Data Hiding
- 24:20Freedom and Responsibility
- 26:11Understanding your attack surface
- 28:13Challenges for developers
- 29:27Languages change
- 33:10Monitoring
- 34:33Security UX
- 35:33DomainDriven Design
- 37:52Michael Nygaard
- 38:18Exploit
- 40:56Have a conversation
- 43:06Challenges for Ops
- 46:36Containers
- 48:35Force Monitoring
- 49:25Vault
- 50:51Container Security
- 54:49CI Scanning
- 55:40Beyond
- 56:31Credits
related talks
51mInsecure Transit - Microservice
01h 02mPractical Microservice Security
53mSecurity And Microservices
51mAppSec and Microservices
49mPractical Microservice Security
38mTop 10 Security Best Practices to secure your Microservices
01h 00mInsecure Transit - Microservice Security
01h 02mInsecure Transit - Microservice Security