With the growth of cloud and API-driven infrastructure, came infrastructure as code. This movement shifted the management of configuration from a mainly hidden part of IT, to a larger and more explicit part of software development. If you’re not writing YAML files you’re probably writing tools to write YAML files.
But an incorrectly configured application can have an outsized impact on the common security challenges of confidentiality, integrity and availability.
In this discussion we’ll look at:
-
Examples of real-world hacks related to configuration issues
-
The problems found in projects like Kubernetes that have a large configuration surface area
-
What it looks like to apply application security approaches to infrastructure as code
-
Demos of tools that are emerging to help test configuration
This session should be of interest to developers and operators struggling with the explosion of configuration as well as security analysts interested in the higher level emerging problem of configuration security.
