The needed Information for AppSec Purposes?
summary
Proposes a lightweight, sprint-friendly checklist to collect microservice architecture details for AppSec: unique service IDs, repo links, short business descriptions, infra services, storage software, messaging platforms, and prioritized data assets with protection levels; map relations (service→service, service→storage, asset→storage) and required access types. Stores data in a spreadsheet or Confluence or as dot language architecture-as-code to auto-generate diagrams. Uses these artifacts for OWASP ASVS checks, threat modeling, least-privilege audits and to catch misconfigurations such as a DB account granted write when only read is required.
AI-written summary · about
chapters (15)
- 0:00Introduction to AppSec challenges
- 1:45Who I am and presentation goal
- 3:51Security-specific architecture info needed
- 4:13Step 1: Identify business services
- 6:21Step 2: Identify infrastructure services
- 7:45Step 3: Identify data storage
- 8:28Step 4: Identify messaging systems
- 9:08Step 5: Identify data assets
- 10:30Collecting relations between components
- 14:47Documenting architecture visually
- 16:53Using info in security practices
- 17:57Use case: Threat modeling
- 20:48Use case: Least privilege enforcement
- 21:51Use case: Sensitive data identification
- 24:18Key takeaways and conclusion
related talks
45mSecurity Architecture, An Adventure?
51mAppSec and Microservices
33mLearning from Past Security Breaches: Strengthening AppSec Efforts and Focus
33mWhy Developers Struggle with API Security
27mThe Architect's Guide to Fortifying Software Security
38mFree security resources that your competitors use!
39mHandling of Security Requirements in Software Development Lifecycle
55mBuilding a sustainable security requirements process with the ASVS