BrowserStack Security Breach. Lessons Learned.
•
0 likes•1,049 views
The author discusses lessons learned after getting hacked. Key lessons include: implementing proper monitoring of systems and unlikely events; removing wildcard access controls; keeping an accurate inventory of machines and who has access; regularly patching systems for security vulnerabilities; maintaining onsite and offsite backups; enabling centralized logging of systems; and having an amazing security-focused team.
Recommended
More Related Content
Similar to BrowserStack Security Breach. Lessons Learned.
Similar to BrowserStack Security Breach. Lessons Learned. (20)
More from Aditya Patawari
More from Aditya Patawari (12)
Recently uploaded
Recently uploaded (20)
BrowserStack Security Breach. Lessons Learned.
- 1. We got hacked. Lessons learned. Aditya Patawari Lead of Systems Engineer at BrowserStack.com Fedora Ambassador and Contributor to Fedora Infra aditya@adityapatawari.com adimania on freenode irc http://blog.adityapatawari.com March 30, 2015 Aditya Patawari We got hacked. Lessons learned.
- 2. Topics Monitoring is good. Right monitoring is saviour. Wildcards! Get rid of them. How many machines you got? Who got access to them? Did you patch that? Where is your backup? Logging is on! You need an amazing team. Aditya Patawari We got hacked. Lessons learned.
- 3. Monitoring is good. Right monitoring is saviour. Multi location monitoring Monitor unlikely situations like table locks Monitor IP addresses Aditya Patawari We got hacked. Lessons learned.
- 4. Wildcards! Get rid of them. Database grant statements will KILL you. Any wildcard ACL is a potential disaster. Aditya Patawari We got hacked. Lessons learned.
- 5. How many machines you got? Make an inventory. Make an automated inventory. Aditya Patawari We got hacked. Lessons learned.
- 6. Who got access to them? Did you generate generic api keys? Two-factor is amazing How similar is your staging to production? Aditya Patawari We got hacked. Lessons learned.
- 7. Did you patch that? So many CVEs CI for security updates? Look at OpenVAS Aditya Patawari We got hacked. Lessons learned.
- 8. Where is your backup? Onsite and Offsite, both are mandatory Another AWS region is not offsite Encrypt it Aditya Patawari We got hacked. Lessons learned.
- 9. Logging is on! Log your systems centrally Log actions on your hardware/service provider Aditya Patawari We got hacked. Lessons learned.
- 10. You need an amazing team. Aditya Patawari We got hacked. Lessons learned.
- 11. Questions? Now is your chance :) Aditya Patawari We got hacked. Lessons learned.