The Future of AppSec is Cloud-Native

on YouTube ↗56m

" summary

Argues appsec shifts from scanners to platform work and shows concrete tooling and failures: builds an auditable GCP Kubernetes cluster with terraform TF files and KMS encryption in under 200 lines, demonstrates admission controls using OPA Gatekeeper and pod security policies, advocates runtime detection with Falco and sandboxing (gVisor, Kata), and recounts an SSRF to AWS metadata chain that escalates to full account takeover. Links to hands‑on labs (securekubernetes.com, cube‑goat) that reproduce container breakout and cluster compromise.

AI-written summary · about

" chapters (10)

1. 0:00Start
2. 7:12DevSecOps is the process of incorporating and enforcing meaningful security controls without slowing down
3. 9:05Modern software teams must focus on speed, agility, security, and stability.
4. 12:04Loosely coupled services are often API-driven and allow applications to run, scale, and interact as an independent entity.
5. 12:43Policy driven infrastructure gives operators the ability to define the desired state of applications and underlying infrastructure using definition files.
6. 18:53Cloud native infrastructure is about creating reliability out of chaos and useful abstractions for applications. It forces engineers to write applications that are controlled by software and expose the necessary operability hooks in the application instead of through typical infrastructure or human processes.
7. 21:09Your job description is changing.
8. 32:08Platform Security
9. 33:30Kubernetes is an open-source platform built to automate deployment, scaling, and orchestration of containers.
10. 47:06The challenge going forward will be balancing security with deployment efficiency.

" related talks

• 41mPanel: Securing Cloud Native ApplicationsJohn Field, Joe Grandja, Kamala Dasika, Tyler Shields, Joe Pindar · Cloud Foundry Summit Silicon Valley 2017
• 10mKeynote: CloudNativeDevSecOpsHillel Solow · Cloud Native Security Day Europe 2021
• 35mCloud Native Security for the Rest of UsTiffany Jernigan · CloudOpen @ Open Source Summit Europe 2022
• 35mKubernetes Security - Challenge and Opportunity?Marc Nimmerrichter · KCD Austria 2023
• 19mHow to Secure Your Kubernetes ClustersCindy Blake · Kubernetes Day India 2019
• 32mHacking the Cloud Native Renaissance: Lowering Risk of Kubernetes AdoptionAndrew Martin · Open Source in Finance Forum London 2022
• 36mPanel Discussion: Modern App Security Requires ContainersSean Michael Kerner · KubeCon + CloudNativeCon Europe 2018
• 34mCloud Native Security: A New Paradigm for a New WorldMario Fahlandt · ContainerDays Conference 2024