Dev!SecOps – real life incidents and lessons learned
summary
An internal web app exposes sequential IDs in the URL and writes directly to the production database with no input validation or data normalization, allowing a registered user to enumerate and exfiltrate 150 records using a Python script at about 35–40 records/sec over roughly 10–15 minutes. Logs show predictable URIs and no rate limiting, no dev ownership of security, and no separation of development and production access, so fixes are input validation, auth checks, DB parameterization and clear DevOps responsibility.
AI-written summary · about
chapters (6)
- 0:00Introduction
- 1:01Data leak via ID manipulation
- 3:15Flaw in Microsoft Forms app
- 6:38DevOps misunderstandings
- 9:09Devs' cyber security role
- 9:52Conclusion
related talks
22mDevSecOps - The Story of 3 Security Breaches
36mThe Road To Being Rugged
40mI Break Your Prod Live with 15 Security Flaws
58mOpen Source Pentesting and Security Analysis Tools: the DevOps way
44mDevSecOps: Balancing Agility, Security & Stability in a Continuous Software Business
52mDevSecOps
50mHacking Exposed - Hacking the Sec into DevOps
40mDevOoops (Increase awareness around DevOps infra security)