We Are All Equifax: The Data Behind DevSecOps
summary
A post‑mortem of the Equifax chain of failures: a Struts2 flaw (CVE‑2017‑5638) is exploited within three days to exploit, attackers execute ~9,000 transactions and access ~48 databases, and an expired SSL decryptor sits unpatched for 18–19 months. Modern apps borrow 80–90% of code; a study finds ~170,000 Java components with ~18,000 vulnerabilities and roughly half of 60,000 popular JavaScript packages vulnerable, an average JS package pulls 79 dependencies. Practical fixes: inventory via Maven Central/NPM, enforce SBOMs and automated pipelines to stop known defects from going downstream.
AI-written summary · about
chapters (11)
- 0:00Introduction to Equifax breach
- 2:34Equifax’s infrastructure complexity
- 8:13Lessons from Equifax breach timeline
- 11:05Open source software risks
- 16:24Cyber hygiene and personal anecdote
- 21:41Equifax’s post-breach improvements
- 27:42DevOps security controls
- 30:52Software supply chain management
- 33:22OWASP and component hygiene
- 34:42Final security recommendations
- 37:12Q&A session
related talks
32mBuilding a secure future using DEVSECOPS practices and technologies
40mEmbracing Security - A Changing DevOps Landscape
46mLive hacking: Breaking into your Java web app
41mThe Divine and Felonious Nature of Cyber Security
50mStranger Danger: Your Java Attack Surface Just Got Bigger
56mThe Anatomy of Java Vulnerabilities
40mSecuring your dependencies
46mThe Supply Chain Conundrum: Why Traditional Application Security Is...