Automating Cloud Security and Incident Response (DevSecOps)
summary
Argues that automation is a requirement not a feature and shows concrete work: uses terraform modules for consistent, auditable infrastructure-as-code, pipes CloudTrail, VPC flow logs and SSH bastion logs into Elasticsearch/Kibana for dashboards, runs awspec tests in CI, and installs lambda remediation that calls the AWS SDK to start logging and write an audit to DynamoDB. Demonstrates automatic quarantine of a tainted EC2 by swapping its security group and reports CloudTrail re-enabled in seconds.
AI-written summary · about
chapters (39)
- 0:00Introduction
- 1:13Agenda
- 2:00Joe Bond
- 3:05Public Cloud
- 3:34AWS
- 4:32Infrastructure as Code
- 5:07Terraform
- 5:29Visibility
- 6:09Accountability
- 6:36Code Reviews
- 7:23Audit Trail
- 8:17Reusability
- 9:04Consistency
- 9:54I Am Access
- 10:05API Access
- 10:33Adding Users
- 10:51Automatic Login
- 11:15Tests
- 12:13AWS Aspect
- 12:46Logs
- 13:04Audit Trails
- 13:28Elastic Search
- 13:43Termination
- 13:56PPC Flow logs
- 14:47Collecting metrics
- 14:58Graphing API calls
- 15:59AWS Config
- 17:00Terraform Config
- 17:43Alerts
- 18:27Remediation
- 18:46Cloud trail logs
- 19:08Cloud event rule
- 19:22Lambda function
- 21:21example
- 21:59notification
- 22:34custom rules
- 24:52whats next
- 26:42takeaways
- 27:48end of talk
related talks
29mPragmatic Security Automation and DevSecOps in the Cloud
50mAutomation in action: Strategies for risk mitigation
51mAWS Security Essentials
22mLaunch Control - Automating a Security Baseline...
38mBuilding Security at Speed
25mDevSecOps: Security Automation at Scale
34mLayering AWS security services to automate incident response
25mTransform Your Security Practices With DevOps