Security incident monitoring, mitigation & metrics using feature flags
summary
Demo shows a working pipeline that detects an authenticated SSRF to a container metadata server, triggers Datadog ASM and Cloud Workload Security alerts, sends the JSON event to EventBridge/Lambda, and uses a LaunchDarkly API call to disable flags per-user and inject decoy data. Platform scale cited: 20 trillion evaluations a day from 4,000+ customers. A live exploit in the demo yields a reverse shell executed; response options shown include tarpitting (slow responses), adversary engagement, and full incident declaration with metrics: time to detect, time to respond, and postmortem closure.
AI-written summary · about
chapters (21)
- 0:00Intro
- 1:33The world is changing
- 8:10What do feature flags do?
- 8:50What is feature management?
- 10:12LaunchDarkly scale
- 12:06Cloud workload security
- 14:43Development and security in the same system
- 15:20Benefits of breaking down silos
- 18:37Mapping phases of incident response
- 19:45Use case
- 20:27Travel Dog architecture
- 22:57For transparency to the user community
- 25:50Answer: Lightweight Threat Modeling
- 27:05Detection rule for high risk
- 31:23Endpoint detections for zero days
- 33:45How does it work?
- 35:42What is adversary engagement?
- 36:23For a great talk on engagement
- 44:13When things escalate
- 48:47Metrics to measure
- 49:36Summary
related talks
21mRecognizing and avoiding cloud security survival mode
01h 02mSecuring data and democratizing the alert landscape
44mCloud Metadata Abuse
57mPreventing Attacks at Scale
28mPatterns for scalable security detections on AWS
37mOptimizing Cloud Detection & Response With Security Chaos Engineering
57mBuilding a Modern Security Engineering Organization
49mEnhance container security with CrowdStrike Falcon Cloud Security