Abhay Bhargav (Page 2)

Winning with Serverless DevSecOps Pipelines

There's little doubt that Serverless Technologies are being adopted at a rapid pace [1] [https://thenewstack.io/why-serverless-is-being-adopted-at-a-faster-rate-than-expected/] . I have personally seen typically stodgy, old-school enterprises take to building out serverless (especially FaaS) projects to handle some mission-critical operations. I tend to agree [https://read.acloud.guru/simon-wardley-is-a-big-fan-of-containers-despite-what-you-might-think-18c9f5352147]

serverless

So you wanna build a Production-ready Serverless App?

I've been exploring serverless security for around a year now. Commonly, as a security pro, one typically looks at the offensive angle to any technology. While this can be very useful, it pales in comparison to the effort required in actually running and maintaining this technology, live, in

Seven Deadly Sins of Container Security - Part 1

This video is AppSecEngineer's Part 1 of Seven Deadly Sins of Container Security. These specifically refer to 7 different mistakes that people and orgs make when running containerized deployments in their environment.

Content-Security-Policy: An Introduction

Content-Security-Policy (CSP) is a major control to protect against Cross-Site Scripting Attacks. This video talks about both offensive and defensive perspectives of Content-Security-Policy implementations for your application Code for the example app: https://github.com/we45/csp-flask Code for the presentation: https://github.com/we45/AppSecEngineerCSPIntro

application security Featured

Disassembling CVE and CWE for No Fun and No Profit

There's a good chance that you or your colleague(s) will be shuffling through the massive vendor presentation areas at RSA next week. Chances are that, as you make your way through the booths with shiny screens with Dashboards and fancy-looking charts, you'll see one or

we45 Featured

we45's Fedex Week

Research and Learning has been a big area of focus at my company, we45. We pride ourselves in teaching and training, new and experienced cohorts who join our organization. Its not only a fun process to see someone learn a new skill, but incredibly rewarding to see it being applied

graphql Featured

The Hard Way: Security Learnings from Real-world GraphQL

This article comes (relatively) close on the heels of my talk at AppSec California. The talk was: > "An Attacker's Perspective of Serverless and GraphQL Applications" The slides for that talk are available here [https://github.com/we45/we45-Public-Presentations/blob/master/2019/AbhayBhargav_AppSecCali_SLS%26GQL.

container Featured

CVE-2019-5736, runC and the Trickle down effect of Bad Advice

"Docker Containers are supposed to run as root", he said, authoritatively on a call. I started to doubt myself. "How can anything running as root, be a good thing?" I asked myself. But the gent giving us the piece of advice (nay, justification) was a senior

op-ed Featured

Thoughts on Developer Security Training

I have had the good fortune to have trained thousands of developers on Application Security. Private organizations, conferences and even some non-profit groups have engaged us (we45) and my team to do this. Needless to say, this has been an extremely rewarding experience. I have had several clients say that

container security

Stories of My Experiments with "Distroless" Containers

If you're like me, you're probably using Containers to deploy and run applications. Containers are incredibly convenient to package and run your applications, consistently, with all the necessary dependencies. However, most containers I would typically build, were built off an operating system Docker base-image. Early in

InfoSec is a lot like Stand-up Comedy

I have been in InfoSec since 2008. I started extensively presenting at conferences and events from 2014 or so (when I felt I had something…

A Guided Tour of the AWS Key Management Service (KMS)-as-Code

I started doing PCI-DSS Audit work in 2008 (yes I know). Since then, PCI-DSS has always had “Requirement 3”, a PCI-DSS set of security…

DynamoDB Injection

I have been developing a bunch of serverless apps and experimenting with serverless security for our (we45’s) work in Pentesting and for…

HOWTO: Amazon Inspector with Terraform

I have been playing around with Terraform for the last 2 months or so, and I really enjoy working on it. The entire approach to…

Integrating E2E and Application Security Testing: HOWTo with NightwatchJS and OWASP ZAP

The Problem

Stories of Application Security: “You Get what you Git”

I believe that stories are a great way of getting a complex message across to people. I have started, what I hope would be a series of…

Security is Non-Essential

Yes. I said it. Why? Let me tell you why….

Why your Application Security needs “Skin in the Game”

What is “Skin in the Game”?

AppSec vs Secure Applications

Wait…What??? Don’t they mean the same thing? Well, yes, I used to think so. In fact, I was quite committed to this concept for a very long…

Security Engineer Interview Questions: What’s an HMAC?

At the OWASP Bay Area Meetup recently, I ran into Tad Whitaker. He works in security and was instrumental in organizing the OWASP Bay Area…

The OWASP Top 10–2017: What works and what doesn’t…

Its finally here! :) After several arguments, debates, fanfare and some fury, the OWASP Top 10 2017 is finally making its way to a PDF near…

Better Security Outcomes with Abuser Stories for Scrum Teams

A User Story is a fundamental concept that is used by nearly every Agile or Scrum Team. A User story is a simple description of a feature…

My experiences with Facebook abstinence

I was angry. There was another story about how a section of the media was distorting a cause that I believed in. A short scroll below…

Fear and Loathing — Security in Cashless India

Two thoughts simulataneously come to mind when I think about events that have transpired in the last week. One, of course is the…

4 Ways I beat the Professional Plateau

This was the end of the 2013. I was bored. I had no reason to be. I was the CEO (still am) of an up and coming Information Security firm…