Auditing Your Automation's Access: Using More Automation
summary
Automation creates broad access and the concrete fix is audit everything: ingest audit logs from Datadog and secrets managers like Vault, log secure access sessions (Boundary-style) and trace service-to-service calls through a service mesh so proxies append metadata. Record secret reads, certificate issuance, Terraform reconciliation runs and authentication requests, then wire incidents to webhooks that create ephemeral production roles. This cuts mean time to detect and remediate by making anomalous access and blast radius visible.
AI-written summary · about
chapters (10)
- 0:00Introduction to auditing automation
- 3:36Why audit automation for security
- 6:06Automation relies on access
- 8:32Auditing local testing access
- 15:40Blocking unauthorized access attempts
- 16:01Tracking service interactions
- 24:26Auditing secrets and credentials
- 27:10Production access and automation
- 31:23Temporary access for incidents
- 37:01Summary and key takeaways
related talks
33mAutomation Best Practices for SRE and Security
50mOptimizing audits with automation
38mOpening Plenaries: Security in Automation
50mTraffic safety: Auditing and enforcing IAM best practices
33mAutomating Cloud Security and Incident Response (DevSecOps)
32mAutomating Security Compliance at Scale
51mAWS Security Essentials
22mThe Hidden Access Paths to Smaugs Cavern