#8 - Application Security

DevOps Topeaks

Content provided by Omer Hamerman & Meir Gabay, Omer Hamerman, and Meir Gabay. All podcast content including episodes, graphics, and podcast descriptions are uploaded and provided directly by Omer Hamerman & Meir Gabay, Omer Hamerman, and Meir Gabay or their podcast platform partner. If you believe someone is using your copyrighted work without your permission, you can follow the process outlined here https://player.fm/legal.

1+ y ago 23:30

MP3•Episode home

In this episode we discussed all-things application security; from scanning, to designing with security in mind, through OWASP and sources of information we feel engineers in the world of dev / ops should be aware of and familiar with!
We talked about:

OWASP Top 10 - https://owasp.org/www-project-top-ten
Git leaks - https://github.com/zricethezav/gitleaks
12 Factor - https://12factor.net
Scanners: [Python Bandit: https://bandit.readthedocs.io/en/latest, Go: https://pkg.go.dev/golang.org/x/vuln/cmd/govulncheck]
Clair static analysis for containers: https://github.com/quay/clair
Bug Bounty platforms: HackerOne, Bugcrowd, Intigrity
BGP repo cleaner - remove secrets from git history: https://rtyley.github.io/bfg-repo-cleaner
Harden EKS - https://github.com/aws-samples/hardeneks

Meir's blog: https://meirg.co.il
Omer's blog: https://omerxx.com
Telegram channel: https://t.me/espressops

Chapters

1. Intro to the episode (00:00:00)

2. OWASP Top 10 (00:00:44)

3. Bug bounty programs (00:01:29)

4. Javascript files, leaks, BGP history leaks cleaner (00:04:10)

5. Thirdparty libraries scanning (00:09:56)

6. Security design and considerations, 12 Factor apps (00:11:16)

7. Application secrets (00:14:07)

8. Vulnerability Static Analysis for Containers (00:15:40)

9. Configuration & Secrets - should be dynamic or static? (00:17:57)

10. This week's random finding: HardenEKS (00:22:00)

46 episodes

#Tech #Omer & Meir #Engineering #Dev #Security #MBA #Business #Podcasting Education #DevOps #Coop #SRE #Cloud IT #AWS