Conf42 DevSecOps 2023
who it's for
security engineers, devops engineers, platform engineers, site reliability engineers, cloud architects, engineering managers, observability engineers
topics
IoT and 5G DDoS attacks; AIoT image-to-device pipelines; Kubernetes secrets management; Argo CD + HashiCorp Vault GitOps; Istio service mesh mTLS; decoupled ABAC authorization (Cerbos); npm and Python supply chain attacks; SAST, DAST, SCA, IAST integration; OpenTelemetry observability pipelines; ClickHouse + Grafana metrics pipeline (MetricCA); Kafka governance with Klaw; infrastructure as code security
| title | author | length |
|---|---|---|
| Premiere | 26m | |
Lineup shows concrete takeaways: analysis of how IoT and 5G devices amplify DDoS with real-world impact on internet backbone, demos of kubernetes secrets are… | ||
| The Role of IoT and 5G Devices in DDoS Attacks | Andrey Slastenov | 23m |
Average DDoS sizes climb from 300 Gbps (early 2021) to 800 Gbps (early 2023) and IoT-driven attacks rise 300% in H1 2023, with 90% of sophisticated incidents… | ||
| The Transformation of DevOps and InfoSec in AIoT | Susie Su | 31m |
Claims that AIoT pipelines convert images to device parameters using OpenAI models (mentions D E3/“DALL·E3” style image-to-text then hardware commands) and… | ||
| Understand & Where to use AI & Machine Learning 101 | Rich Niemiec | 54m |
Oracle claims its autonomous database uses ML to tune, patch and secure itself and offers a free cloud trial to spin up instances in minutes; AutoML produces… | ||
| Technical writing vs AI. Is still a worthy career path? | Tomas Fernandez | 14m |
Technical writing remains viable but depends on role and how writers use AI: five concrete points include the hype cycle, the 2023 Writers Guild strike and… | ||
| Cracking the Code of Cloud Security | Fouad Mulla | 24m |
Claims that 40% pulled from public registries and 12% run as non-root drive the risk story, with images framed as sensitive data and defaults described as… | ||
| Securing Kubernetes Workloads with Istio Service Mesh | Gufran Mirza | 42m |
Shows how Istio deploys an Envoy sidecar per pod, issues short lived X509 certs via the control plane SDS, and enforces service identities so mTLS strict drops… | ||
| DevSecOps: More Than Just Pipelines | Tanya Janca | 30m |
Argument: DevSecOps requires more than dumping scanners into CI/CD; it treats the three DevOps ways — flow, fast accurate feedback, continuous learning — as… | ||
| Modernizing Authorization: From Basic Roles to Decoupled ABAC | Alex Olivier | 25m |
Claims that a decoupled authorization service replaces duplicated if/else checks across languages by centralizing RBAC and ABAC as YAML policies, implemented… | ||
| Ten Ways to Doom Your DevSecOps | Gene Gotimer | 13m |
Lists ten concrete failure modes and gives actionable counters: slow onboarding that takes days or months and kills engagement; a pretend cloud that hides… | ||
| Simplifying Kafka Governance for Developers | Muralidhar Basani | 23m |
Klaw automates Kafka governance by enforcing a request/approval workflow for topic creation, ACLs, schemas and connector provisioning, stores ownership and… | ||
| Cheap DIY Monitoring with OSS Analytics & Visualization | Robert Hodges | 30m |
Builds a VM stat collector in ~100 lines of code that pipes vmstat JSON into ClickHouse and visualizes it with Grafana so you can query raw time series with… | ||
| How to architect for continuous delivery? | Romano Roth | 46m |
Gives concrete steps and numbers: adopt trunk-based development, remove change approval boards, and implement the 24 key capabilities from Accelerate; invest… | ||
| Instant Memory Training for Business Success | Chester Santos | 50m |
Promises a way to memorize a 16‑word random list forwards and backwards after about three minutes using the story method, and shows the same imagery trick to… | ||
| Coding with the lights ON - OpenTelemetry from code to prod | Roni Dover | 55m |
Shows that flipping on OpenTelemetry yields immediate, actionable traces with almost no code change using the Java agent and Jaeger and surfaces real issues in… | ||
| OpenTelemetry's Path to Observability's Future | Siddhartha Khare | 19m |
Claims around 4–6 tools per company for telemetry collection and that OpenTelemetry is the CNCF project ranked second most active provide context. The… | ||
| Git those secrets out your repos! | Daniel Oates-Lee | 35m |
Claims a repeatable workflow that finds and tracks leaked credentials across many repos, using SecretMagpie which runs git-leaks and trufflehog and emits an… | ||
| Keeping Kubernetes secrets secret | Alex Soto | 54m |
Kubernetes Secret is just Base64 not encryption and the demo shows creating a Secret, converting it to a sealed-secrets manifest that uses a controller public… | ||
| Hacking Demos, Dirty Secrets, Dangerous Lies, Asset Intelligence | Brian Contos | 38m |
Asset inventory gaps let attackers move from a compromised laptop into hundreds of unmanaged devices; the presenter demonstrates grabbing an exploit from… | ||
| CyberSecurity is too general: Why we need Security Domains | Michal Davidson | 28m |
Argues that cybersecurity must split into six domains — compliance, network, monitoring, cryptography, architecture, and hacking — because compliance… | ||
| Supply Chain Attacks: Focused on NPM attacks | Danish Tariq, Hassan Khan | 35m |
Automated scans of 2.1 million npm packages extract 6.7 million emails (600k unique), resolve 132k domains and find 675 expired domains that allow account… | ||
| Effortless Secrets Management in Kubernetes | Sam Gabrail | 48m |
GitOps with Argo CD deploys a sample “school app” (JS frontend, FastAPI backend, MongoDB) and then Vault is added using the Vault Agent Sidecar Injector which… | ||
| Who Goes There? Detecting Intruders With Honeytokens | Dwayne McDaniel | 34m |
Claims that decoy credentials catch intruders early and cut dwell time, backed by finding 10 million hard-coded credentials on public GitHub last year… | ||
| Detect known unknowns | Fulvio Colombrino | 24m |
Pandora Project builds a TTP‑focused hunting pipeline that avoids single points of failure by using both EDR and CMs plus three detonation VMs to reproduce… | ||
| Adding security for reliable continuous delivery | Jhonnatan Gil Chaves | 46m |
Built a multi-stage Docker image for the PetClinic sample and scanned both the full and “mini” images, finding about 40 issues reported by Snyk (mostly… | ||
| Securing the software supply chain | Marek Najmajer, Aleksander Baranowski | 36m |
A prototype web platform performs automated SBOM scanning and integrates into CI/CD pipelines, producing a composite risk score across contributor profile… | ||
| Configurations: The Weak Link in the Security Chain | Peleg Porat | |
Configurations regularly cause real breaches — one example exposes hundreds of millions of user records when files remain unencrypted. The talk claims a… | ||
| Fortifying Your Codebase with GitHub | Travis Gosselin | 38m |
Shows concrete steps to reduce supply‑chain and code risks using GitHub features: enable the dependency graph and Dependabot (configured via dependabot.yml) to… | ||
| Securing the endpoint with open software | Zach Wasserman | 19m |
Open-source osquery collects SQL-style tables from Windows Mac Linux and Chromebooks and Fleet manages it at scale across thousands to hundreds of thousands of… | ||
| Infrastructure as Code Security Best Practices & Strats | Joshua Arvin Lat | 18m |
Covers concrete IaC practices: use terraform or similar, enforce IAM role with admin avoidance and fine-grained tags, store secrets outside code, and keep… | ||
| DevOpsSup - Extended DevOps approach | Grzegorz Sztandera | 36m |
Case study of building an operations team that moves from a one‑person on‑call start to a multidisciplinary unit handling full lifecycle devops, 24/7 support… | ||
| Iterative Threat Modelling: Security in Agile Development | Jagdsh Chand | 38m |
Uses OWASP Juice Shop as a live guinea pig and claims iterative threat modeling fits into agile sprints with a 60‑minute workshop (or a 15‑minute backlog… | ||
| Your trusty Python package: TTPs of attacks on OSS in Python | Leonid Akinin | 01h 14m |
Publishes a fake package to Test PyPI and reuses starjacking (a repo with ~5,000 stars, ~2,000 forks) to make it look legitimate in under five minutes, then… | ||
| MetricCA: Revolutionizing Metrics Collection & Analysis | Timo Pagel | 14m |
MetricCA automatically pulls security evidence from Confluence, Jira, Dependency-Track and Azure AD and combines that with repository YAMLs — activities.yaml… | ||
| nothing matches | ||