Journey to Securing the Cloud: Detecting and Fixing Misconfigurations at Datadog
summary
Datadog monitors hundreds of Kubernetes clusters, tens of thousands of nodes and a 2,000+ engineer org, and detects misconfigurations at three points: Checkov PR mode for fast CI feedback, scheduled repo scans to map code locations, and runtime CSPM for active resources. Findings get enriched with service, classification and severity, appear on dashboards with trends and performance metrics, and remediation uses a security champion program, reusable Terraform modules for 80% of cases and selective Cloud Custodian automated remediation only for high-risk fixes.
AI-written summary · about
chapters (10)
- 0:00Introduction and speaker background
- 2:01Datadog's cloud scale and misconfigurations
- 5:55Challenges with misconfigurations
- 8:01Detection approach in development
- 13:19Runtime detection and CSPM
- 23:23Remediation challenges and solutions
- 28:02Security Champion program and processes
- 31:18Terraform modules for security
- 34:05Automated remediation strategies
- 36:11Key takeaways and Q&A
related talks
37mOptimizing Cloud Detection & Response With Security Chaos Engineering
21mRecognizing and avoiding cloud security survival mode
45mProtecting you from you: Misconfiguration-caused breaches
25mSecuring Your DevOps Transformation
19mKubernetes Security: Navigating the Real-World Challenges
53mEmpowering small teams with Amazon ECS Fargate and Datadog
27mCatch Me If You Can: Hunting Misconfigurations Before They...
47m3 steps to help mitigate cloud risks