Securing the Cloud
summary
Cloud security starts with developers: a survey of 130 engineers surveyed finds about 15% uninterested in security, 23% skip static analysis, and dependency scanners nearly absent (roughly 49% run Sonar but only 3 use Black Duck and 2 use Snyk). The proposal is Security Chaos Engineering: run controlled experiments (inject latency into security controls, disable MFA, create unencrypted S3 buckets, force permission collisions) and bake checks into CI/CD, enforce encryption, avoid cleartext logs, use short-lived artifacts and minimal container privileges.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 2:02Cloud security foundations
- 9:43Security versus reliability
- 12:11Developer security survey
- 15:43Security adoption challenges
- 18:32Security chaos engineering
- 21:01Game days for security
- 23:52Security incident analysis
- 26:44Secure development collaboration
- 28:51Security best practices
- 37:28Q&A
related talks
46mAre Developers the New Front Line of Security?
38mAdventures in Cloud Security: What DevOps Can Learn from a Security Engineer
34mDevelopers do care about security: Building a more collaborative path
24mCracking the Code of Cloud Security
15mWhat’s next for security, development, and CloudSec teams? (PRT063-R)
21mSecurity That Enables: Breaking Down Security Silos in the DevOps Ecosystem
52mContinuous Security
47mSecurity is Everybody's Job