DevSecOps - The Story of 3 Security Breaches
summary
Three real breaches: a unicorn startup where a public Django debug page leaks 6,000 password hashes leading to a couple hundred cracked accounts, VPN access, Jenkins abused via Google SSO domain-check bug and a pipeline that exfiltrates reversible credentials; GitHub API enumeration bypasses 2FA and reveals repos with hardcoded AWS keys and SSH keys, yielding root and a production DB of 45 million users; a consulting firm and a cloud bank where an exposed ticketing SQL and a staged office attack using Raspberry Pi staged phishing and an off‑the‑shelf RFID reader produce 80 credentials and Citrix access.
AI-written summary · about
chapters (6)
- 0:00Introduction to DevSecOps breaches
- 2:11Startup breach chain reaction
- 11:27Tech firm single point failure
- 14:17Bank social engineering attack
- 19:11Security testing real-world impact
- 20:55Stress testing security controls
related talks
07mDon't Go There! Horrible Devops Security Blunders
40mDevOoops (Increase awareness around DevOps infra security)
39mSecrets Management: How to (not) help the person who hacks your servers get your data
35mDevSecOps in practice. Tools vs People!
48mNine Cloud Security Reasons for Resting Breach Face
38mAdventures in Cloud Security: What DevOps Can Learn from a Security Engineer
44mDeveloper Productivity Shouldn’t Breach Security
32mDo This, Not That – Lessons from 7 Headline Grabbing Security Breaches