Catch Me If You Can: Hunting Misconfigurations Before They...
summary
ING builds a scalable "drift radar system" that detects misconfigurations across CI/CD and runtime, ingesting sensor events via Kafka and evaluating them with Open Policy Agent with Rego; results land in a verdict store for auditing and automated actuators that run IaC/Ansible fixes or raise PRs. Current scale is about 400,000 policy checks/month across 30,000 repos and 17,000 monthly changes, targeting 500+ policies by 2026, and enforcement follows three‑month audit then block rollout.
AI-written summary · about
chapters (13)
- 0:00Misconfiguration risks
- 1:24Critical misconfigurations
- 4:11From firefighting to prevention
- 6:22ING’s scale challenges
- 7:26Reliability by design
- 9:53Closed control loop
- 13:51Policy as code
- 14:53Governance and deployment
- 17:42Scaling guardrails at ING
- 18:48Key takeaways
- 20:10Challenges faced
- 25:01Autonomy versus enforcement
- 26:50Q&A
related talks
25mPaC in Jenkins for DevOps Pipelines
30mDetection as Code: Detection Development Using CI/CD
48mWhy checking your infrastructure-as-code for misconfigurations is not enough – How ...
15mStatic Detection of Silent Misconfigurations with Deep Interaction Analysis
47mDetection as Code: The Engineering-Focused Future...
26mStandard Classification: Introducing graph theory to Policy-As-Code
25mSecurity Automation for DevOps
57mStable, Safer, Faster: AKA How to Avoid K8s Misconfig with Automation