Peter, the May and the Must, and Lacework
summary
Lacework builds a cloud-scale security pipeline that combines static SCA of repos and container images, quick buildless source analysis plus deeper info‑flow checks, and a low‑overhead runtime agent that implements package-level code-coverage by monitoring filesystem opens. An experiment on 2,500 machines shows 1,300 unique packages with only 235 active and ~1,100 inactive, yielding a typical ~65% reduction in remediation effort (range ~10–90%). The agent uses throttled file breakpoints to keep cost and telemetry volumes very low and reports past execution, not predictions.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 1:28Lacework in cloud security
- 3:36Code security and Peter’s role
- 6:11Kware agent for code coverage
- 9:02Impact of inactive vulnerable packages
- 11:30Reflections on May and Must in bug finding
- 14:23Compositional May-Must analysis
- 19:26Closing remarks
- 19:52Q&A
related talks
24mObjects In The Rear View Mirror Are Closer Than They Appear
32mA Security State Of Mind: Compliance and ...
40mSoftware Supply Chain Aspects in Infrastructure as Code, and How to Secure it
28mDevSecOps - Security from Scratch
30mSupply Chain Security for OpenSource Projects
46mTurn CRA Awareness into Action
53mWhere The Wild Things Are: The State Of Open Source Supply Chain Risk Management In Three Stories
41mIdentifying and Mitigating Cloud and Container Threats