Practical Microservice Security

on YouTube ↗01h 02m

" summary

Covers concrete risks and fixes for real microservice setups: token/JWT misuse and a base64 pitfall, fragmented auth across legacy services, and how auto-scaling abused for crypto mining amplifies compromise. Calls out orchestration dangers like impersonation, SSL interception, and lack of two‑factor, and gives tools to use now — NIST CVE lookup, Google Vendor Security Assessment Questionnaire, Docker Bench, AWS Inspector, Security Monkey — plus logging, immutable infra and testing to detect and contain breaches and the 987 fine-grained permissions nightmare.

AI-written summary · about

" chapters (21)

1. 0:00Intro
2. 4:14Security fundamentals
3. 8:38Spoofing Tampering Repudiation Information Disclosure Denial of Service Escalation of Privilege
4. 11:33OWASP Open Web Application Security Project find good trusted, peer reviewed sources
5. 14:44Consistent Planned Authentication
6. 18:42Storage, Quality, Length, Lifecycle the keys to token success
7. 20:37validation required:: every header every field every format every method
8. 22:05Service decomposition
9. 27:49scaling and resource exhaustion
10. 29:29Orchestration layer attacks
11. 32:29features that scare me 1 impersonation 2 investigation mode 3 demo accounts on production 4 SSL interception and analysis 5 many password sins
12. 36:56the golden rule never assume a security vendor is better at secure development than you are
13. 41:26Identity and access
14. 43:05Roles V.S. Fine Grain Permissions
15. 46:07Immutable architectures matter in microservice security
16. 46:41Auditable host configurations are a good thing but you might not be the right person to audit them
17. 48:15Avoids configuration creep including those changes made by an attacker
18. 51:06Choose the right tools for the job you are doing
19. 51:28not all technologies have mature libraries, frameworks and documentation
20. 53:14Detection
21. 54:22Poorly managed logs are a simple way to create denial of service attacks

" related talks

• 49mPractical Microservice SecurityLaura Bell · GOTO Chicago 2016
• 57mHow Do I Secure My Micro-Services?John Melton · CodeMash 2018
• 53mSecurity And MicroservicesSam Newman · NDC Sydney 2017
• 41mSecurity Patterns for Microservice ArchitecturesMatt Raible · SpringOne 2020
• 01h 06mMicroservice Authentication and AuthorizationNic Jackson · DevOpsCon Berlin 2018
• 38mTop 10 Security Best Practices to secure your MicroservicesChintan Jain · AppSec USA 2017
• 51mAppSec and MicroservicesSam Newman · JavaDay Ukraine 2017
• 30mTopics of Interest: Attacking the microservice systems: methods and practical tipsA. Barabanov · OWASP 20th Anniversary 2021