Metasecurity: Beyond Patching Vulnerabilities
summary
Claims a higher‑level “meta security” that defends against exploitation rather than just vulnerabilities, noting Rails averages ~7 CVEs yearly (recently double digits) and private zero‑days stay hidden ~6 months. Implements hooks inside the app to watch SQL queries and template rendering, learns SQL structure from stack traces to block anomalous queries and monitors HTML safe calls to catch XSS, plus brute‑force mitigations. A product called amuno is in beta and the system reports learning on first execution and disseminating rules to other processes.
AI-written summary · about
chapters (17)
- 0:00Intro
- 1:19Anatomy of a security attack
- 3:49How fast can you spin this wheel?
- 5:25Web Application Firewalls
- 7:04Field Trip! Castle Gaillard
- 11:43Metasecurity: Blocking Exploitations
- 16:06Cross Site Scripting (XSS)
- 19:04String.html_safe
- 20:16Rails Rendering
- 25:39How to Fix?
- 26:17How to Fix SQL Injection
- 28:05Metasecurity for XSS
- 30:34Metasecurity for SQL Injection
- 31:54Every Query is Executed at the Top of a Call Stack
- 32:44Match Call Stack to a Learned Structure
- 33:01Verify Structure
- 34:20Immunio is Metasecurity
related talks
41mSkillful, Scalefull Fullstack Security in a State of Constant Flux
43mSecurity Vulnerabilities Decomposition: Another way to look at Vulnerabilities
37mThe Evolution of Rails Security
39mSoftware Security Engineering (Learnings from the past to fix ...)
36mSecurity is hard, but we can't go shopping
33mInterview with
27mHow to implement Security as Code?
41mSecurity Vulnerabilities Decomposition: Another Way To Look At Vulnerabilities