Why security fails, and how we can solve for it
summary
Praetorian catalogs concrete failures and fixes: an exposed S3 bucket and a bespoke, nation‑state style takeover, nested SQL subqueries that produce broken access control, and Terraform local_exec leading to command injection. The response is tooling not platitudes — a free SaaS workflow called chariot that pushes findings into Jira in real time, a low‑noise Go scanner goku, and a service‑mesh checker snowcamp. Automation reduces noise, catches simple bugs so humans can triage complex ones, and these tools are published on GitHub.
AI-written summary · about
chapters (14)
- 0:00Intro
- 1:10About Praetorian
- 2:35Lessons from the real world
- 4:17Versioning
- 7:18Broken cycle
- 9:25Automation
- 11:20Broken access control
- 13:52Low noise tools
- 15:26Command injection
- 16:17What is LocalExec
- 17:10The moral of the story
- 18:21Introducing SnowCamp
- 20:08Closing thoughts
- 22:07Solutions
related talks
22mSecurity vs Dev Experience Threat … or Opportunity
46mApplication security from start to finish
26mSecurity Automation For GraphQL
38mBuilding Security at Speed
29mPragmatic Security Automation and DevSecOps in the Cloud
27mSecurity: The Thing That Everyone...
36mSaaC – Security as a Culture, the Distributed Advocacy
49mEverything is Terrible: Three Perspectives on Building, Configuring, and Securing Software