In September 2024, I returned to Stockholm to give a talk at Sec-T. The Slides are here, and the YouTube Video is here.
In the last year or so talking to organizations of all sizes, shapes, and security budgets, it’s become clear there is a deeper problem than just “developers don’t know how to not make a bucket public”. How we as an industry use the public cloud is fundamentally unsafe. We wouldn’t give any random 16-year-old kid with a driver’s license a 787 to fly. Yet, with the public cloud, anyone with a credit card can sign up for one of the most technically complex creations the IT Industry has ever created. Engineers fresh out of school are given access to enterprise cloud tenants and told to deploy their applications. At no point do the cloud providers take reasonable measures to ensure you are qualified to operate the cloud safely, nor are their default auto-pilot settings all that safe.