Insecure Transit - Microservice
summary
Argues that microservices can improve security if teams patch regularly and handle secrets properly, citing the Equifax breach (143 million records) and the CodeSpaces account wipe as failures. Recommends short‑lived credentials (e.g. 45‑minute API keys), secret stores like Vault that generate DB creds, mutual TLS for service-to-service auth, JWTs to prevent the confused‑deputy problem, and tools such as Snyk, Clair and Aqua for dependency and container scanning; mentions service meshes (Istio/Linkerd) for automated TLS and token handling.
AI-written summary · about
chapters (40)
- 0:00Intro
- 1:45Data Breaches
- 2:25Software Development
- 4:00Microservice Security
- 4:40Microservice Architecture
- 6:15Surface Area of Attack
- 7:27Assessing Risks
- 14:00Password Manager
- 14:50Advanced Persistent Threat
- 16:20Three pieces of advice
- 17:35Shortlived credentials
- 19:30Qi tools
- 20:15Credentials
- 21:05Secret Stores
- 21:50Vault
- 22:30Console Template
- 23:10Security Breaches
- 23:45Patch Your Stuff
- 24:10Equifax Data Breach
- 24:40Vulnerabilities
- 25:45Equifax
- 26:40Systems building on systems
- 27:10Normal running infrastructure
- 28:10Solutions
- 29:35Container Scanning
- 32:00Threat Modelling
- 32:30Network Communication
- 33:40Key Concerns
- 34:40HTTP and TLS
- 36:00HTTP TLS
- 36:40Mutual TLS
- 38:20Other protocols
- 39:00Authentication
- 40:05Authorization
- 41:40Confused Deputy Problem
- 43:40Making Decisions Upstream
- 44:25What We Want
- 44:40JWT Token
- 47:00Service Mesh
- 49:10Summary
related talks
01h 00mInsecure Transit - Microservice Security
01h 02mInsecure Transit - Microservice Security
59mInsecure Transit - Microservice Security
57mHow Do I Secure My Micro-Services?
51mAppSec and Microservices
31mModern Security With Microservices And The Cloud
53mSecurity And Microservices
49mPractical Microservice Security