"Defense in depth": trench warfare principles
summary
Covers applying defense-in-depth to modern web applications and microservices by modeling threats and risks and adding multiple independent security controls so incidents or data leaks are mitigated even when some components fail. Names security engineering patterns and maps them to concrete tools and high-level patterns usable by web developers.
AI-written summary · about
chapters (21)
- 0:00Start
- 13:09Why care anyway?
- 18:52OWASP Top-10 web risks
- 20:27Data & risks
- 22:53Typical web architecture
- 27:15Potential attacks
- 30:50Band-aid security model == Perimeter security
- 31:24Example Attack Graph
- 32:06Band-aid security model: risks
- 34:43Defense in Depth
- 37:02Decryption proxy
- 37:59Predictable data flow
- 38:22Writing data flow
- 38:43Reading data flow
- 39:33Key model
- 44:48System compromise
- 46:29Lines of defense
- 47:53How to build?
- 51:54Covered Top-10 web risks
- 54:59Building Defence in Depth for your data using Acra
- 57:11Talks & training
related talks
14mDefense in Depth Is Dead, Long Live Depth in Defense
01h 00mDefense-in-depth engineering
47mImplement defence in depth for your Java API:s
21mDefense-in-Depth Security for Mission-Critical Service
47mD2T2 - Defense-in-Depth Techniques for Modern Web Apps
01h 00mApplying Security Engineering Principles to Complex Composite Systems
46mThe Swiss Cheese Security Pattern
20mDefense in Depth: Securing your new Kubernetes cluster from the challenges that lurk within