Hack the Docs how security professionals use documentation
summary
Documentation becomes an attack surface with concrete failures: a Grafana integration in self‑hosted GitLab exposes repositories because of a documented default Grafana integration with default admin:admin, public Trello and Confluence pages and GitHub gists leak internal configs, and half‑configured AWS or default passwords let testers pop shells. Recommendations are specific: threat‑model docs, avoid insecure defaults, add tamper evidence (hashes, timestamps, logging), enforce MFA and least privilege on CMS, and alert on doc changes so published instructions don’t turn into exploits.
AI-written summary · about
chapters (7)
- 0:00Start
- 4:45How do hackers use docs?
- 15:49So if all that stuff is "bad", what does "good" look like?
- 17:382. Remember that hackers are part of your audience, and include documentation systems in your threat model
- 18:40Err on the side of making the risks visible
- 19:51Create tamper-evident systems
- 22:30Security professionals need good writers...
related talks
45mGo security pitfalls; 2 lessons from the battlefield at Grafana Labs
14mThreat Modeling for O11y: From Blind Spots to Actionable Insight
23mSecurity Considerations in API Docs
33mLearning from Past Security Breaches: Strengthening AppSec Efforts and Focus
07mDon't Go There! Horrible Devops Security Blunders
01h 24mCode Red: Navigating the Minefield of Security Programming Blunders
31mSharing Security Secrets: How to Encourage Security Advocates
36mDevOps Security - Is It Really So Difficult?