DevSecOps Archives - Jean-Christoph von Oertzen https://jeanchristophvonoertzen.com/tag/devsecops Exploring the intersection of cybersecurity, psychology, and resilience. Sun, 27 Jun 2021 10:46:04 +0000 en-US hourly 1 https://wordpress.org/?v=6.9.4 https://jeanchristophvonoertzen.com/wp-content/uploads/2020/10/favicon-4.png DevSecOps Archives - Jean-Christoph von Oertzen https://jeanchristophvonoertzen.com/tag/devsecops 32 32 Event takeaways: BSidesMeSh21 – day 2 https://jeanchristophvonoertzen.com/event-takeaways-bsidesmesh21-day-2 https://jeanchristophvonoertzen.com/event-takeaways-bsidesmesh21-day-2#respond Tue, 22 Jun 2021 16:05:01 +0000 https://jeanchristophvonoertzen.com/?p=511 My key takeaways 11 min from publishing credentials (accidently) to github till pwn 2019: ~200k credentials in Github ; 2021: +20% runtime secrets go to application secrets managers AWS Secrets Manager GCP Secrets Manager Hashicorp Vault Azure Vault InfoSec’s dirty little secret: We can’t know all the options, but we still need to help secure […]

The post Event takeaways: BSidesMeSh21 – day 2 appeared first on Jean-Christoph von Oertzen.

]]> https://jeanchristophvonoertzen.com/event-takeaways-bsidesmesh21-day-2/feed 0 Event takeaways: BSidesMeSh21 – day 1 https://jeanchristophvonoertzen.com/event-takeaways-bsidesmesh21-day-1 https://jeanchristophvonoertzen.com/event-takeaways-bsidesmesh21-day-1#respond Mon, 21 Jun 2021 16:34:29 +0000 https://jeanchristophvonoertzen.com/?p=507 My key takeaways Security in sprints vs whole security sprints? Smaller activities from the very beginning. It is not full time, but always ongoing. And maybe, if the situation is very tricky, entire sprints might be necessary, too. — Thomas Fricke Kubernetes does its best to be secure inside. Unfortunatly it is not configured so […]

The post Event takeaways: BSidesMeSh21 – day 1 appeared first on Jean-Christoph von Oertzen.

]]> https://jeanchristophvonoertzen.com/event-takeaways-bsidesmesh21-day-1/feed 0 Workshop takeaways: Scaling Your Security Program with Semgrep https://jeanchristophvonoertzen.com/workshop-takeaways-scaling-your-security-program-with-semgrep https://jeanchristophvonoertzen.com/workshop-takeaways-scaling-your-security-program-with-semgrep#respond Thu, 17 Jun 2021 18:16:49 +0000 https://jeanchristophvonoertzen.com/?p=486 My key takeaways Detecting the lack of using secure defaults is much easier then finding bugs "You can get amazing security wins if you can get a bit draconian about coding standards" Blue teams can win, if they outmaneuver attackers in the OODA loop: 👀 🧠 👍 💪 generic checks can provide a lot of […]

The post Workshop takeaways: Scaling Your Security Program with Semgrep appeared first on Jean-Christoph von Oertzen.

]]> https://jeanchristophvonoertzen.com/workshop-takeaways-scaling-your-security-program-with-semgrep/feed 0