Stranger Danger - Your Java Attack Surface Just Got Bigger

This course demonstrates how to secure Java cloud-native applications across code, open-source dependencies, containers, and infrastructure. It uses live hacking to examine vulnerabilities and misconfigurations, then presents remediation practices and DevSecOps workflows.

Syllabus

- Stream Start
- Intro
- Understanding DevSecOps
- What are the problems in DevSecOps?
- How bad is the situation?
- Java Demo Application
- Snyk Plugin Alerting to Security Issues in Your Code
- Path Traversal Issue in Code
- Open Source and How Things Can Go Wrong
- Example of Open Source Problems in the Demo App
- What Your App Consists Of
- Open Source Usage Has Exploded
- Understanding Log4j Vulnerability
- Demo of Exploiting Log4j Vulnerability
- Java Serialization Issues
- I am root
- How Confident are Open Source Maintainners in Security
- Who is responsible for security?
- Next Layer of the Modern App Iceberg
- Vulnerabilities per Docker image
- Let's Hack Containers
- I am root again!
- Infrastructure as Code and what security concerns to consider
- What is the solution?
- Snyk Demo
- DevSecOps Recap
- Closing