DIY Security for the Amateur Superhero
summary
Engineers get concrete tactics: run the OASP dependency checker or track packages with libraries.io to avoid “left‑pad” style supply‑chain worms (one six‑line dependency can cascade). Build cheap logging: a <20‑line Python LastPass Lambda Logs pulls LastPass events into S3/Glacier and forwards to Sumo Logic so alerts and PagerDuty trigger — it works but needs care (APIs flip JSON/XML, time granularity caused blind spots). Note surprises: WAFs spitting 67,000 reports/day and a $79B security industry.
AI-written summary · about
chapters (19)
- 0:00DIY SECURITY FOR THE AMATEUR SUPERHERO
- 1:14the internet is a festering pool of toxic waste
- 1:53somebody probably wants to do bad things to your computer
- 7:17You are part of the problem
- 13:03Listen to people (like OWASP and Troy Hunt)
- 13:38Admit your mistakes (perfect people are liars)
- 15:41Use a password manager (and here's why...)
- 20:25not all technologies have mature libraries, frameworks and documentation
- 22:21Oh noes.. a wild demo appears OWASP Dependency Checker Libraries.io
- 28:58You won't see it coming (if you're not looking)
- 29:34Choose the right tools for the job you are doing
- 33:22ALL the things... Application Database Operating system Border devices Cloud tools
- 34:24Which of your tools is you destruction?
- 37:17Be kind demo gods... please LastPass Lambda Logs Sumo Siemonster and ELK
- 41:24Other people's APIs make kittens cry
- 42:53Complexity and fragmentation can be the cost of DIY
- 44:43Custom filter languages are real
- 50:44You are not John McClane (Incident Response skill isn't innate)
- 55:38we need Blameless Security Culture
related talks
33mSecurity on a Shoestring: A Low-Budget Security Revival Tour (Jared Casner)
46mApplication security from start to finish
52mContinuous Security
49mLessons from DevSecOps Trenches
28mSecurity Does Not Need to Be Fun: Ignoring OWASP to Have a Terrible Time
15mSoftware Supply Chain Security for those in a rush
45mDon't Panic! A Developer's Guide To Security
26mThink Like an Adversary: OPSEC for Laravel Developers