Attacking the microservice systems: methods and practical tips
summary
Claims that microservice architectures reshape the attack surface and shows concrete assessment patterns: run SAST (bandit), dependency scans (safety), secret scanning (trufflehog), container scans, then deploy a vulnerable Django demo via GitHub Actions and run DAST with OWASP ZAP to catch runtime issues. Demonstration finds many findings and false positives, filters exclusions, and updates rules and WAFs. Notes DAST full scan ~40–50 minutes versus baseline 2–10 minutes and recommends pipeline time limits.
AI-written summary · about
chapters (8)
- 0:00Start
- 3:16Challenges in Devops
- 3:34Tools People and Processes
- 10:36Compliance Testing
- 12:42Threat Modeling
- 15:39Continuous Monitoring
- 20:48The Feedback Loop
- 26:18Phases in the Development Process
related talks
41mDevil is in the details: Microservices, Security and DevOps
39mSecurity Tooling in Your DevOps Pipeline
39mAutomating Your Security Checks: Stop Hiding Your Flaws Next to the Monsters...
48mMonitoring Application Attack Surface and Integrating Security into DevOps
01h 02mPractical Microservice Security
53mSecurity And Microservices
58mOpen Source Pentesting and Security Analysis Tools: the DevOps way
52mApplication Security at DevOps Speed and portfolio scale