Stop Doing Stupid $%^--How Not to Secure Your Environment
summary
Lists concrete failures and fixes: shared credentials and credential stuffing, service accounts granted domain admin privileges, and VMs with 1433 open to the internet that get compromised after seven attempts. Shows bots scraping public S3/Azure blob containers, examples of MongoDB/Elasticsearch instances left without passwords, leaked private keys in GitHub, and old SMB1/Exchange clusters mistaken for “no need for backups.” Recommends MFA (U2F/number matching), managed identities, and Azure Key Vault as practical remediations.
AI-written summary · about
chapters (11)
- 0:00Modern security threats
- 2:29Common security mistakes
- 5:01Credential reuse and MFA
- 8:29Spear phishing risks
- 10:16Cloud storage bucket flaws
- 12:26Legacy systems and databases
- 13:50SMB1 and encryption risks
- 14:53Storing secrets securely
- 16:36SQL injection attacks
- 17:39Security versus productivity
- 18:23MFA best practices
related talks
31mLog In Through the Front Door: Automating Defense Against...
07mDon't Go There! Horrible Devops Security Blunders
22mTreat the Problems, Not the Symptoms
29mGet the Freaking Basics Right!
55mAzure Attacks Unpacked: Real-World Threats & Lessons
19mThe toplist of securing your developer workstation
41mUncovering Azure's Silent Threats: A Journey into Cloud Vulnerabilities
26mCloud Security Lessons