DevSecOps by Default: What have, can and must we learn from Log4Shell?
summary
Log4Shell (reported December 10 2021) exposes that vulnerable libraries can sit for years and only become exploitable when specific methods and arguments are invoked; an insecure‑bank demo downloads a Java payload when a malicious username is logged. Runtime instrumentation, distributed tracing and argument capture reveal whether the vulnerable methods run and trace attacker origin. Prioritize by four triage questions to reduce mass alerts (example: 1,522 → ~7–10 critical targets). Captain (open source, CNCF incubation) enforces SLO-driven orchestration to score builds, call scanners (Falco, scanners, OpenTelemetry inputs), and automate remediation.
AI-written summary · about
chapters (8)
- 0:00DevSecOps introduction
- 2:51Log4Shell impact recap
- 7:27Deeper flaws revealed
- 13:24Assessing vulnerability risk
- 14:09Automating security detection
- 16:13Captain for DevSecOps
- 21:09SLOs for security validation
- 23:59Summary
related talks
36mAndreas Grabner - DevSecOps
46mAre We Ready For The Next Cyber Security Crisis Like Log4Shell?
33mLog4J, SpringShell and all that Jazz (or why bad things can happen to good software)
46mAre We Ready For The Next Cyber Security Crisis Like Log4Shell?
18mIT Security – Don’t let Open Source Software become the next menace
27mLog4Shell - The Open Source World on Fire
47mAre We Ready For The Next Cyber Security Crisis Like Log4Shell?
46mAre We Ready For The Next Cyber Security Crisis Like Log4Shell?