Insecure Transit - Microservice Security
summary
Microservice security focuses on concrete fixes: use Vault or cloud KMS plus consul template to rotate time-limited credentials and avoid checked‑in API keys; expect ~80% of breaches to involve weak/stolen credentials, remember Code Spaces lost everything when attacker used compromised AWS keys and backups lived in the same account, and Equifax exposed 143 million records from an unpatched CVE scored 10. Defend transport with mutual TLS, push user identity downstream via JWT tokens to prevent confused‑deputy leaks, and consider a service mesh (sidecar proxies) to centralize TLS, tracing and auth.
AI-written summary · about
chapters (39)
- 0:00Introduction
- 0:10Welcome
- 1:35Sam Newman
- 8:18Assessing risk
- 9:29Verizon Data Breach Report
- 10:20NIST
- 10:43Longer passwords
- 11:38Short passwords
- 12:11Password managers
- 13:42Code Spaces
- 15:27API Keys
- 16:40Credentials
- 17:24Passwords
- 18:05Secret Stores
- 20:11Console Template
- 21:16Known vulnerabilities
- 21:55Equifax
- 25:54Russian Doll
- 26:07Modern Deployment Stack
- 30:31Snick
- 32:25Threat Modeling
- 35:00HTTPS Everywhere
- 35:10Server guarantees
- 35:47Serverside certificate management
- 37:11Clientside certificate management
- 37:32Certificate management
- 38:00Mutual TLS
- 38:18Neutral TLS
- 39:16The Problem
- 42:05Demo
- 44:07Confusing Deputy Problem
- 47:09JWT Tokens
- 50:28Service Mesh
- 54:31Netflix
- 55:28Sidecar
- 56:47Service meshes
- 57:57Common concerns
- 58:11MutualTLS
- 58:43Summary
related talks
01h 02mInsecure Transit - Microservice Security
51mInsecure Transit - Microservice
59mInsecure Transit - Microservice Security
53mSecurity And Microservices
51mAppSec and Microservices
57mHow Do I Secure My Micro-Services?
31mModern Security With Microservices And The Cloud
38mTop 10 Security Best Practices to secure your Microservices