Web application compromise mitigation with crypto anchoring
summary
Claim: move encryption keys and operations off app servers into a dedicated microservice so keys never leave the data center, decryption is logged, and offline decryption is impossible. Implements as an HSM, AWS KMS, or HashiCorp Vault backed crypto anchor using authenticated cipher logging. Targets app-server RCE attacks that exposed Equifax’s ~300 million records. Built as a choke point that returns ciphertext only, records context (record ID, type, who, when), and enables thresholds/alerts — proof of concept runs and logging-driven alerts show practical detection and mitigation.
AI-written summary · about
chapters (5)
related talks
21mBecome a hero to your DevSecOps team
47mData at Rest Encryption Going Beyond the Basics to Address Modern Attacks
51mKeynote: Data is a new security boundary
24mSafeguarding Sensitive Data Access At Scale with Privacy-Enhancing Technologies
01h 07mIntroduction to cryptography
45mData Security: Building Architecture When Integrating Encryption Algorithms
50mBuilding Production-Grade End to End Encrypted App...
29mBe nice, help the person who hacks your servers to get your data