Back to the Future in the Space of Cloud Native Security
summary
Highlights specific incidents and concrete defenses: attacker-modified CI install script in a 500-line bash file that exfiltrated environment variables from pipelines; supply‑chain compromise of Orion that reaches 18,000 customers by tampering build pipelines; account takeover enabled by social engineering in a 10-minute phone conversation and detection signalled by a double registered phone number; recommends runtime verification with eBPF tooling like Tracy, artifact signing and policy enforcement, and prioritizing vulnerability triage rather than chasing every CVE.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 2:55Cloud native security
- 5:45DevSecOps principles
- 11:42Major security incidents
- 13:26Codecov supply chain attack
- 15:55SolarWinds supply chain attack
- 21:31Account takeover attacks
- 23:35Breach patterns
- 26:44Securing cloud native environments
- 29:12Culture in security
- 31:00Q&A
related talks
17mThe Future of Cloud-Native Security
09mKeynote: Supply Chain: The New Threat Vector in Cloud Native Security
46mApplication security from start to finish
56mNavigating the Cloud Native Security Landscape
18mSecuring cloud innovation: Lessons learned
21mMake threats visible in your cloud environment — Eric Jung
46mStories from the cutting edge: Cloud security in 2023
33mIn the Trenches During a Software Supply Chain Attack