The Boring Security Talk
summary
Covers concrete failures and fixes for CI/CD, email, DNS and third‑party packages: Jenkins instances are found internet‑exposed and abused to install miners that netted 3 million dollars mining Monero, Docker Hub images silently mined about $90k, and npm package compromises with over three million downloads a week force token revokes. Recommends HTTPS, SSO and MFA, least‑privilege AWS keys, regular patching, SPF/DKIM/DMARC validation, monitoring via MX Toolbox/Postmark, and using DNS control with Git for auditable, automated DNS changes.
AI-written summary · about
chapters (5)
- 0:00Start
- 10:21reduce the surface area of attack on our servers
- 11:27exposing your ci cd systems to the internet
- 22:55define a list of authorised ip addresses
- 37:14identify all the domain registrar accounts within your organization
related talks
32mContainer Security: Exploits, Vulnerabilities and Defense
46mApplication security from start to finish
38mAdventures in Cloud Security: What DevOps Can Learn from a Security Engineer
32mDo This, Not That – Lessons from 7 Headline Grabbing Security Breaches
20mStop Doing Stupid $%^--How Not to Secure Your Environment
32mHacking the OSS Supply Chain
40mDevOoops (Increase awareness around DevOps infra security)
30mHow Secure Is Your Build/Server?