If security is hard, you are doing it wrong
summary
After an SQL injection leads to a parent company mandate that forces unnecessary upgrades, audited advice proves misaligned with actual versions (OpenSSL 1.0.1e patched by Red Hat, PHP 5.3.3 unaffected) and costs pile up. A PCI DSS rush on ~50 EC2 instances closes SSH and makes MTTR 30 minutes→8 hours and releases go from two days to one month. Container rollout shows the danger of scale with 327 images and 13 base OS variants. Use config management, automated tests, and destroy and rebuild to detect drift.
AI-written summary · about
chapters (20)
- 0:00Introduction
- 0:44Big corporations
- 6:56What is security
- 11:18No one solution fits all
- 11:38PCI DSS compliance
- 13:23Procedures for updates
- 14:17Maintenance
- 14:48Testing
- 15:35Think security first
- 18:02Drop in security
- 19:12Use configuration management
- 20:29One trick
- 21:49Trust by track
- 24:26Code versioning
- 27:53Containers
- 28:29What happened
- 31:25The problem with security
- 33:36Limit base images
- 35:41Ubuntu LTS
- 40:13People are unreliable
related talks
40mEmbracing Security - A Changing DevOps Landscape
37mA question of trust: When good containers go bad
52mContinuous Security
38mSo. Many. Vulnerabilities. Why are containers such a mess...
39mHard to Port! - A Snapshot of the Vulnerability Landscape in 2015
46mThe Supply Chain Conundrum: Why Traditional Application Security Is...
55mDip Your Toes in the Sea of Security
21mDevSecOops: 15 years of DevOps and patching is still horrible