Securing Your Apps and User Data with Google Cloud
summary
A tiny Flask app (~20 lines) packaged in Docker and deployed to Cloud Run uses hundreds of dependencies and Container Registry vulnerability scanning flags 600 vulnerabilities, 38 fixes in the image. Replacing ImageMagick with Python Pillow and switching to an Alpine base drops the scan to zero after Pillow+Alpine at the cost of slower startup and higher RAM. Cloud Web Security Scanner finds a reproducible XSS in the admin login that is fixed by proper escaping, and enforced security keys via admin settings prevent phishing.
AI-written summary · about
chapters (17)
- 0:00Intro
- 1:32Add a Cat
- 2:59Demo
- 4:48Running in Production
- 6:25Threat Modeling
- 6:54Kill Chain
- 10:11Todays Agenda
- 11:26Dependencies
- 12:34Container Registry
- 13:01Vulnerability Scanning
- 14:05Vulnerability Analysis
- 14:50Vulnerability Experiment
- 16:00Vulnerability Results
- 17:52Cloud Security Scanner Demo
- 22:21How it works
- 23:45How to set it up
- 24:53Wrap up
related talks
24mCracking the Code of Cloud Security
29m5 Best Security Practices for your Production-Ready Containers
35mSecuring Containers by Breaking In
22mSecuring Containers Against Known Go Vulnerabilities
32mImprove container security with automated base image updates
40mSecuring Containers by Breaking in
35mDocker Security
41mIdentifying and Mitigating Cloud and Container Threats