Adventures in Cloud Security: What DevOps Can Learn from a Security Engineer
summary
AWS-focused checklist of failures and fixes: public S3 buckets expose hundreds of thousands of records (one incident leaves 400,000 rows public and three days of IR), hardcoded secrets (including base64) leak via CI/CD until caught, and unpatched container images (Log4j-era) let miners inflate bills. Implements concrete tooling: TruffleHog / g-secrets pre-commit, Snyk/Bandit/SonarQube, Burp/ZAP, IAM Access Analyzer, Security Hub/GuardDuty, Prowler, and Secrets Manager. Measures include mean time to detection, high-severity predeploy misconfigs, secrets leaked per month, and CI/CD security coverage; outcome: pre-commit hook prevented a prod secret leak.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 1:25Cloud security challenges
- 5:00Common cloud pitfalls
- 9:00Incident response strategies
- 12:54Metrics that matter
- 17:55Building security culture
- 21:57DevOps lessons from security
- 25:07Final takeaways
- 31:12Q&A session
related talks
07mDon't Go There! Horrible Devops Security Blunders
39mSecurity in a DevOps World
39mPerils of the cloud
29mPragmatic Security Automation and DevSecOps in the Cloud
36mCloud Hacking Scenarios
46mStories from the cutting edge: Cloud security in 2023
38mSecuring the Cloud
22mDevSecOps - The Story of 3 Security Breaches