How Big Companies Get Hacked

About this video

Chuck argues big companies keep getting hacked mainly through the applications and code their developers write, opening with practitioners saying most major recent exploits have been application-based, it is impossible to deploy 100% secure code, and universities do not teach secure coding. He traces two causes. First, speed pressure collapsed the old monolith process — separate server, network, quality-control and security teams reviewing work over a long cycle — into microservices, containers and public cloud, where developers absorbed server and network roles (‘shifting left’, broadened here to IT operations responsibilities). Developers are good at code, he argues, but not necessarily at securing servers, containers or networks, so misconfigurations multiply. The proposed answer is not to retrain every developer as a security/network engineer or to slow down, but a DevOps engineer — a rare ‘unicorn’ combining development, operations, security, cloud and Kubernetes who automates checking properly — or a firm that supplies that, with sponsor BoxBoat presented as that option. Second, agile CI/CD pushes small code changes live in minutes. He demos sponsor GitLab: committing a small Python login-service change to master triggers a pipeline that builds/tests the app, deploys to Kubernetes and runs checks automatically. The scary side is that constant deployment means constantly more code and more chances to ship a vulnerability, with QC/security roles again shifted to developers. The remedy offered is to automate security in the same pipeline: GitLab does SAST (he shows Bandit for Python and ESLint for JavaScript), container scanning that found CVEs such as outdated software in a container image, code-quality checks, dependency/vulnerability reports and a security dashboard, plus scheduled rescans because code safe yesterday can be vulnerable today. Automation also speeds fixes because the developer is notified immediately instead of weeks later by a separate team. His conclusion: hackers mostly probe for known, existing vulnerabilities in apps, containers and configs, so security must be baked into the CI/CD automation rather than bolted on afterwards.

Key takeaways

• Thesis: hackers mostly attack the application/code layer, and most developers were never taught secure coding — more code written faster means more vulnerabilities.
• Cause 1: microservices, containers and cloud let developers absorb server/network/security-team roles (‘shifting left’) they are not expert in, creating misconfigurations.
• Cause 2: agile CI/CD deploys small changes in minutes, multiplying the volume and frequency of code that could ship a vulnerability.
• Fix proposed: DevOps engineers (or an outside DevOps firm) who automate the pipeline properly, instead of expecting developers to become security and network engineers.
• Fix in tooling: bake SAST, container/CVE scanning, dependency and code-quality checks and scheduled rescans into the pipeline (GitLab AutoDevOps demo) so developers get immediate security feedback.

Episode details: published February 9, 2021 · 25:04 long. Summary written by Self Growth Videos from the episode itself. Business results and any income figures mentioned are NetworkChuck’s own claims, shared for education — they are not typical or guaranteed.

← Previous: you need to learn Hybrid-Cloud RIGHT NOW!! // FREE CCNA // EP 10 · Next: forcing my kids to make Ethernet cables // FREE CCNA // EP 11 →

All NetworkChuck videos · NetworkChuck profile · NetworkChuck on YouTube