Threat Modeling for O11y: From Blind Spots to Actionable Insight
summary
Claims concrete attack chains and fixes: a Grafana exploit leads to exposed dashboards, API keys appear in plain logs, then Prometheus lateral movement gives cross‑environment access and stealthy exfiltration. The presentation demonstrates STRIDE applied to collectors, transport and storage, prescribes TLS everywhere, MFA for dashboards, 30‑day credential rotation, immutable logging and zero secrets and logs policies, and shows how alert‑resilience (rate limits, correlation, severity routing) reduces blind spots and recovers observability as usable security intelligence.
AI-written summary · about
chapters (12)
- 0:00Introduction to Observability Security
- 0:36Understanding the Observability Blind Side
- 1:51The Traditional Observability Triad
- 2:54Security Risks in Observability Pipelines
- 4:17Threat Actor Motivations
- 5:49Mapping the Attack Surfaces
- 7:11Applying the STRIDE Framework
- 8:42Real-World Attack Scenarios
- 10:20Securing Observability Pipelines
- 11:27Building Alert Resilience
- 12:42Action Plan: From Blind Spots to Insight
- 13:55Conclusion
related talks
53mThreat Modeling: uncover vulnerabilities without looking at code
57mUnlocking Threat Modeling
46mThreat modeling is on the rise
38mThreat Modelling Kubernetes: A Lightspeed Introduction
22mEmpowering Developers through Threat Modeling Excellence
27mBridging the Dev-Sec divide: Three tips for agile developers
37mThreat Modelling: How to Improve Your Kubernetes Security Posture with Threat Mod...
43mThreat modeling