Pragmatic Security Automation and DevSecOps in the Cloud
summary
Shows concrete risks and fixes: AWS examples (EKS + EC2 with Cloud9 in a public subnet), serverless flaws (Lambda + API Gateway vulnerable to code injection and denial‑of‑wallet attacks that can balloon $50 bills to ~$1,000,000), ML‑specific threats (membership inference, model inversion), and CI/CD automation pitfalls (pipeline poisoning). Demonstrates using automated pipelines with secured IAM and least‑privilege, gives the expected time split (35–38h building vs 1–2h security) and when automation pays off versus manual checks.
AI-written summary · about
chapters (6)
- 0:00Welcome
- 2:02Security deprioritization
- 10:52Automation reduces risks
- 15:07Cloud attack overview
- 23:37ML and serverless risks
- 25:01Security automation strategies
related talks
33mAutomating Cloud Security and Incident Response (DevSecOps)
50mAutomated Serverless Security Testing: Delivering secure apps continuously
39mPerils of the cloud
30mServerless Security Top 10
38mAdventures in Cloud Security: What DevOps Can Learn from a Security Engineer
25mDevSecOps: Security Automation at Scale
33mServerless Security: New Risks Require New Approaches
15mDevopsec: Rapid Security in the Cloud with AWS and CIS