Title: AWS re:Inforce 2024 - Developer’s security survival guide (COM321)

Insights:

• Incident Response Scenario: The speaker begins with a real-life scenario where they were unable to log into AWS, leading to production disruptions. This sets the stage for discussing incident response and threat mitigation.
• Speaker Background: Brian Huff, an AWS DevTools hero and former AWS community builder, transitioned from a non-technical background to a security engineer, emphasizing the importance of security in development.
• DevSecOps Primer: The talk covers a primer on DevSecOps, incident response, threat mitigation, and secure architecture patterns.
• Security Best Practices: Emphasizes common security practices like changing passwords, using two-factor authentication, password managers, VPNs, and the principle of least privilege.
• IAM Importance: Highlights the importance of Identity and Access Management (IAM) in DevSecOps, using JSON documents to control service permissions.
• Managed Services and OWASP: While not the focus, the speaker mentions the importance of understanding OWASP vulnerabilities and how managed services abstract some security concerns.
• Least Privilege Access: Stresses the importance of granting minimal necessary permissions to services and users to enhance security.
• Threat Modeling: Encourages conducting threat modeling exercises to identify potential security vulnerabilities in applications.
• Incident Response Checklist: Provides a detailed incident response resolution checklist, including using CloudTrail for tracking API activities and Security Hub for scanning vulnerabilities.
• Proactive Security Measures: Discusses the importance of planning ahead and being proactive in threat mitigation, using tools like Security Hub, CloudWatch, and IAM policies.
• Infrastructure as Code: Advocates for using infrastructure as code (e.g., SST, serverless framework) to create repeatable and secure deployment patterns.
• Short-term Credentials: Recommends using short-term credentials and Secrets Manager for managing access securely.
• CI/CD Pipelines: Highlights the importance of CI/CD pipelines with automation for secure and efficient deployments.
• DDoS and Cross-Site Script Protection: Suggests using AWS Shield and WAF to protect applications against DDoS attacks and cross-site scripting.
• Internal Tools Security: Emphasizes that internal tools should be secured with VPN and SSO to prevent unauthorized access.
• Shift Security Left: Concludes with the importance of integrating security early in the development process, often referred to as "shifting security left."

Quotes:

• "I was literally building the rocket ship as I'm flying it."
• "Engineers ship applications and security engineers ship access."
• "You really need to know what the services need at the least amount possible."
• "No one wants to talk about incidents, but they do happen."
• "The four top questions that I think you should immediately ask when you are in an incident are who, what, where, and why."
• "It's important to think about these types of ways to build because there's patterns that you can replicate."
• "Pre-signed URLs are really helpful because it creates this time-limited authentication token to the resource."
• "We like that. It makes it really easy to just give access for a certain period of time."
• "Shift the security focus earlier in the process. Some people call it shifting security left."
• "I hope that this is empowering and helpful for you to architect security into your development journey and really put the dev in DevSecOps."