Security Observability 101: Thinking Inside the Box!
summary
Claims that runtime instrumentation exposes real behavior: an open source JOT Java Observability Toolkit lets teams add YAML sensors to Java apps at startup without coding, detect unsafe SQL, weak ciphers, expression‑language injection, and enforce sandboxes at runtime. Measured facts: tens of thousands of apps show an average of 30 vulnerabilities and 13,000 attacks per app per month with 1% attacks connect; using IAST/RASP via instrumentation cuts median remediation to seven days and enables surgical runtime prevention.
AI-written summary · about
chapters (16)
- 0:00Start
- 5:25Instrumentation
- 11:08Runtime Reality
- 20:02Define Multiple Captures
- 20:31Capture Syntax
- 25:09Access Control
- 28:42Access Control Matrix
- 31:09Generating Diagrams
- 32:58Expression Language Injection
- 33:24Example of a Command Injection
- 39:10Sandbox the Expression Language Engine
- 42:11Instrumentation To Detect Vulnerabilities
- 43:18Rasp
- 46:46Accelerating Devops
- 48:04Mean Time To Remedia
- 50:24Making Security in a Software Factory
related talks
01h 10mObservability For (Java) Devs - 2023 Edition
52mApplication Security at DevOps Speed and portfolio scale
33mUsing IAST to Unlock the Benefits of DevSecOps
52mAppSec at DevOps Speed and Portfolio Scale
27mRethinking Observability for Off-the-Shelf Tools
19mReal-Time Edge Observability: Security Monitoring
28mApplication Security: Inside Out
23mDeveloper Observability - the Forth Pillar