AppSec & Microservices
summary
Live Internet attacks run constantly and indiscriminately; treat prevention, detection, response and recovery as distinct responsibilities. Use HTTPS everywhere and automate certs with Let's Encrypt, consider client TLS or Netflix’s Lemur for PKI, pass identity with JWT to avoid confused‑deputy issues, encrypt service‑owned databases, keep backups off‑site and practice full rebuilds on immutable servers. Scan images (BanyanOps found 30% of Docker Hub images with critical vulns), aggregate logs into ELK, run ModSecurity/Snort, patch frequently, and prepare comms and post‑mortems before a breach.
AI-written summary · about
chapters (29)
- 0:00Intro
- 0:51Who are we
- 3:39Security Attacks
- 8:43Detection
- 11:39Attack Trees
- 13:47Attack Vectors
- 14:25Transport Security
- 15:56Lets Encrypt
- 17:05HTTPS
- 18:13Lemo
- 19:55The confused deputy problem
- 22:11Data at rest
- 23:15Docker
- 24:22Prevention tools
- 25:20Patching
- 26:27Detecting
- 27:32Logging
- 28:23Perimeter Security
- 29:46Polyglot Microservices
- 30:41Response Target
- 32:41Home Depot Breach
- 33:18Brian Krebs
- 35:45Tylenol
- 37:34Telstra
- 39:41Systems being to blame
- 40:28Root cause of failure
- 41:16Recovery
- 43:32Postmortems
- 46:37Questions
related talks
51mAppSec and Microservices
53mSecurity And Microservices
33mLearning from Past Security Breaches: Strengthening AppSec Efforts and Focus
57mHow Do I Secure My Micro-Services?
15mContainerization and micro-services in real life change security and vulnerability management
59mInsecure Transit - Microservice Security
38mTop 10 Security Best Practices to secure your Microservices
01h 02mPractical Microservice Security