AppSec and Microservices

on YouTube ↗51m

" summary

Microservice architectures trade a single perimeter for many networked boundaries, so adopt HTTPS everywhere (use Let's Encrypt ACME automation) and consider client certificates or Vault for bootstrapping secrets; use JWT tokens to carry caller identity so downstream services can enforce authorization. Do threat modeling (STRIDE/attack trees), automate container patching at host/container/app levels because 44% of breaches are from known unpatched flaws, and automate+test backups and restores — patch monthly.

AI-written summary · about

" chapters (13)

1. 0:00Introduction and context
2. 3:58Security hygiene basics
3. 7:08Microservices security overview
4. 11:40Threat modeling approach
5. 18:00Transport security in microservices
6. 24:22Authorization challenges
7. 30:08Data at rest encryption
8. 31:15Importance of patching
9. 35:05Detection of breaches
10. 38:10Response to security incidents
11. 44:12Customer empathy in breaches
12. 46:19Recovery and post-mortems
13. 49:25Summary and key takeaways

" related talks

• 53mSecurity And MicroservicesSam Newman · NDC Sydney 2017
• 53mAppSec & MicroservicesSam Newman · GOTO Copenhagen 2016
• 57mHow Do I Secure My Micro-Services?John Melton · CodeMash 2018
• 41mSecurity Patterns for Microservice ArchitecturesMatt Raible · SpringOne 2020
• 59mInsecure Transit - Microservice SecuritySam Newman · NDC Porto 2019
• 51mInsecure Transit - MicroserviceSam Newman · GOTO Berlin 2018
• 01h 00mInsecure Transit - Microservice SecuritySam Newman · NDC London 2019
• 38mTop 10 Security Best Practices to secure your MicroservicesChintan Jain · AppSec USA 2017