Practical Microservice Security

on YouTube ↗49m

" summary

Covers concrete failures and fixes for service-based systems, showing that prevention alone fails and detection is essential: recommends centralized logging with long retention, aggressive monitoring of tokens and orchestration layers, and immutable deployments to frustrate attackers. Calls out real mistakes seen in the wild: stale tokens stored insecurely, mixed-quality auth across services, package-manager supply chain risk (eg left-pad incidents), and orchestration as single point of failure. Examples include 50% of time split between dev and security, customers with 300+ microservices, use of JWT tokens and breakage from left-pad.

AI-written summary · about

" chapters (44)

1. 0:00Intro
2. 0:45Who am I
3. 2:12Fundamentals
4. 2:59The monolith
5. 4:00The basics
6. 5:59Types of threats
7. 7:49Stack Overflow
8. 9:18WASP
9. 10:31Authentication Authorization
10. 11:35Microservices
11. 12:46Planning
12. 13:43Authorization
13. 14:47Publicfacing API
14. 15:11Tokenization
15. 17:05Input Validation
16. 18:38First Time Round
17. 19:12Application Security
18. 20:22Monster Microservice
19. 21:40Coupling
20. 23:21Its not your code
21. 24:26Orchestration layer
22. 24:47Tiny components
23. 25:00Is this worrying
24. 26:02We are incredibly lazy
25. 26:53Features that scare me
26. 28:46How do we do this
27. 30:25Challenge us
28. 31:50Principle of Least Privilege
29. 32:32Define Your Roles
30. 33:14Finegrained Permissions
31. 33:59Logging and Monitoring
32. 37:06Mutable Architecture
33. 37:23Compliance
34. 38:26Perspective
35. 40:23Security benefit
36. 41:02Languages
37. 41:40Tools
38. 42:17Interdependency
39. 44:25Puppy analogy
40. 45:02Logging
41. 45:45Denial of Service
42. 46:01Hacking Team
43. 46:47Logs
44. 47:40Wrap up

" related talks

• 01h 02mPractical Microservice SecurityLaura Bell · NDC Sydney 2016
• 57mHow Do I Secure My Micro-Services?John Melton · CodeMash 2018
• 53mSecurity And MicroservicesSam Newman · NDC Sydney 2017
• 41mSecurity Patterns for Microservice ArchitecturesMatt Raible · SpringOne 2020
• 38mTop 10 Security Best Practices to secure your MicroservicesChintan Jain · AppSec USA 2017
• 01h 02mInsecure Transit - Microservice SecuritySam Newman · NDC Oslo 2018
• 51mInsecure Transit - MicroserviceSam Newman · GOTO Berlin 2018
• 59mInsecure Transit - Microservice SecuritySam Newman · NDC Porto 2019