~/talk

Going with the (work)flow? Incident Response for Vicious Workflows

on YouTube 26m
Talkat 34th Annual FIRST Conference 2022 · 2022-06-26..07-01· [security, frontend-architecture]

speakers

name:Ryan Robinson
links:none on file
name:Nicole Fishbein
bluesky:nicolefishbein.bsky.social

resources

video:https://youtu.be/9nzIeDRnB4I
slides:none on file

summary

Researchers scan Internet-indexed Argo and Airflow instances and find concrete failures: thousands of exposed credentials and API keys (AWS, Azure, GCP, PayPal), a Monero miner running eight months inside an exposed Argo cluster, and attacker-controlled images or a crypto-mining container via Airflow’s code editor. Misconfigurations include Argo’s default server off mode inheriting pod permissions, exposed quickstart.yaml and visible connection extras. Recommended fixes: patch, lock down kubeconfig/quickstart, apply least privilege, and run git-secrets, custodian and magpie.

AI-written summary · about

chapters (8)

  1. 0:00Intro
  2. 0:34Who are we
  3. 1:10What are workflows
  4. 3:12Argo Workflows
  5. 9:37Airflow
  6. 16:07How to protect yourself
  7. 22:01Open source security
  8. 23:47Favorite open source security tools

related talks

~/search
type to search 6,249 conferences, 138,987 speakers and 185,172 talks
~/help
cmdctrl k
search every conference, speaker and series
/
focus the filter search
h
home
c
conferences
s
speakers
e
series
t
light / dark — the status bar button does the same
?
this help
esc
close this, then clear every filter — or just the search, while you are typing in it

Ignored while you are typing. Pages without a filter rail have no search to focus.