Andreas Grabner - DevSecOps
summary
Log4Shell becomes a case study: file scans flood teams with 1522 alerts but process inspection and especially instrumentation and distributed tracing show whether vulnerable functions actually run, capture call origins, and reveal attack paths. Risk prioritization asks four concrete questions—is the code loaded is the vulnerable function executed is the service internet-exposed does it touch sensitive data—and continuous production scanning plus SLO-driven automation tied to tools like Falco Keptn and others prevents shipping exploitable artifacts.
AI-written summary · about
chapters (20)
- 0:00Introduction
- 4:04Alarm went off
- 5:18Why is this important
- 6:16Security is hard job
- 7:17Agenda
- 8:26Quick recap
- 9:03Timeline
- 10:11Log4J
- 11:42InsecureBank
- 12:43Log for Shell
- 13:52Vulnerability detection
- 15:28Instrumentation
- 17:33Risk Analysis
- 18:59Summary
- 20:52Continuous Security Scanning
- 23:00Automate through tooling
- 24:18What does Captain do
- 27:06Captain overview
- 29:54The big picture
- 33:43Wrap up
related talks
25mDevSecOps by Default: What have, can and must we learn from Log4Shell?
32mHow to fit Sec into DevOps without Security team
28mDevSecOps - Security from Scratch
49mLessons from DevSecOps Trenches
48mThe Quick Wins of DevSecOps
38mDevSecOps Panel "AppSec Would Never Catch Me"
45mDevSecOps : add Security to your DevOps!
38mDevOps Meet Sec: Your Journey To Delivering Secure Code Fast