The Side Door to Your Production Environment: Finding Hidden Access Paths

We are all responsible for ensuring technology-led change is safe and positive for everyone in society. At BCS we’re committed to meeting this responsibility under royal charter.That’s why we set the highest standards of professionalism and best practice in the industry, share knowledge, and develop skills and capability tuned to our evolving digital world.We’ve been supporting the technology industry since 1957 and our 70,000-strong membership spans 150 countries. Every member actively promotes IT professionalism and we provide them with career development opportunities and bring the community together to address the professional, ethical and economic challenges facing technology today.

BCS, The Chartered Institute for IT

The Side Door to Your Production Environment: How to discover access paths hidden behind IAM policies

<h3>Agenda</h3>18:00 - Networking in BCS London over refreshments 18:30 - Event start with resentation and Q&amp;A either ad hoc or at the end 20:00 - Presentation closes and networking for venue attendees in BCS London (pizza &amp; refreshments)20:45 - Event close and adjourn to The Old Doctor Butler's Head to continue discussion if desired (or Mason's Arms next door to it, if too noisy)

<h3>Synopsis</h3>You locked the front door. You checked the keys. You reviewed the access list. So production should be secure, right? Not necessarily. In modern systems, access rarely follows a single, obvious route. A developer may have no direct permission to reach a sensitive resource, yet still be able to get there indirectly through a deployment pipeline, a service role, a workload, a delegated identity, or a chain of individually legitimate permissions. This talk looks at those side doors. We’ll explore how privilege escalation paths emerge across cloud identities, CI/CD systems, workloads and services, why a perfectly reasonable IAM policy can still leave unexpected routes into production, and how access can drift as systems evolve. Rather than asking only, “What permissions does this user have?”, we’ll ask a more useful question: “What can this identity eventually cause to happen?” The goal is to move from reviewing permissions as isolated rules to understanding access as a connected system of paths, dependencies and delegated authority, and to show why closing one door does not always mean the risk is gone.

<h3>About the speaker</h3>Viola Lykova (<a href="https://www.linkedin.com/in/violaly/" title="https://www.linkedin.com/in/violaly/" target="_blank" data-msys-clicktrack="0" rel="nofollow noopener noreferrer">https://www.linkedin.com/in/violaly/</a>) is the Founder of Viola Security and CTO at nuclecode, working at the intersection of security, cloud infrastructure and production engineering. Over the past nine years, she has built and led engineering teams, designed and operated highly available systems, and worked across fintech, cloud platforms and regulated technology environments. Her experience spans technical leadership, platform engineering, SRE, identity and access management, and the architecture of production systems. Her current work focuses on a deceptively simple security question: who can actually reach, influence or control a production system, regardless of what the IAM policy appears to say? Through Viola Security, she researches effective access, privilege escalation paths, access drift and revocation verification, with a particular interest in turning complex authority relationships into systems that can be measured, tested and continuously verified. Viola is also a technical speaker, presenting on cloud security, IAM, production access and the engineering problems that emerge when systems grow beyond the assumptions they were originally designed around.

Our events are for adults aged 16 years and over.This meeting is conducted in accordance with the <a href="https://www.bcs.org/media/egnkzp3f/bcs-code-of-conduct-for-meetings.pdf" title="https://www.bcs.org/media/egnkzp3f/bcs-code-of-conduct-for-meetings.pdf" target="_blank" data-msys-clicktrack="0" rel="nofollow noopener noreferrer">BCS Code of Conduct for Meetings</a>.BCS is a membership organisation. If you enjoy this event, please consider joining BCS. You’ll be very welcome. You’ll receive access to many exclusive career development tools, an introduction to a thriving professional community and also help us Make IT Good For Society. <a href="https://www.bcs.org/membership/events" title="https://www.bcs.org/membership/events" target="_blank" data-msys-clicktrack="0" rel="nofollow noopener noreferrer">Join BCS today</a>If you are attending in person, please familiarise yourself with the <a href="https://www.bcs.org/media/ww4jlkud/visitor-instructions.docx" title="https://www.bcs.org/media/ww4jlkud/visitor-instructions.docx" target="_blank" data-msys-clicktrack="0" rel="nofollow noopener noreferrer">Visitor Instructions</a> for the BCS London Office.Please note, if you have any accessibility needs, please let us know via groups@bcs.uk, and we’ll work with you to make suitable arrangements.BCS privacy notice: your data will be processed by BCS in accordance with our <a href="https://www.bcs.org/legal-and-privacy-notices/data-privacy-notice/" title="https://www.bcs.org/legal-and-privacy-notices/data-privacy-notice/" target="_blank" data-msys-clicktrack="0" rel="nofollow noopener noreferrer">data privacy notice</a>.Photography: by attending this event, you may be photographed or filmed. Please speak to a member of staff if you do not wish to be included.For overseas delegates who wish to attend the event, please note that BCS does not issue invitation letters.

This event is brought to you by: <a href="http://www.bcs-spa.org/index.php" title="http://www.bcs-spa.org/index.php" target="_blank" data-msys-clicktrack="0" rel="nofollow noopener noreferrer">Software Practice Advancement (SPA) SG</a>Image credit: photo by <a href="https://unsplash.com/@danila_balashkin?utm_source=unsplash&amp;utm_medium=referral&amp;utm_content=creditCopyText" title="https://unsplash.com/@danila_balashkin?utm_source=unsplash&amp;utm_medium=referral&amp;utm_content=creditCopyText" target="_blank" data-msys-clicktrack="0" rel="nofollow noopener noreferrer">Danila Balashkin</a> on <a href="https://unsplash.com/photos/a-black-and-white-photo-of-a-stair-case-9gEaJ9dug5c?utm_source=unsplash&amp;utm_medium=referral&amp;utm_content=creditCopyText" title="https://unsplash.com/photos/a-black-and-white-photo-of-a-stair-case-9gEaJ9dug5c?utm_source=unsplash&amp;utm_medium=referral&amp;utm_content=creditCopyText" target="_blank" data-msys-clicktrack="0" rel="nofollow noopener noreferrer">Unsplash</a>

The Side Door to Your Production Environment: Finding Hidden Access Paths

Speaker

Good to know

Location

BCS, The Chartered Institute for IT

How do you want to get there?

More events from BCS, The Chartered Institute for IT

Discover more events from BCS, The Chartered Institute for IT, from Science & Tech to other experiences you might love.

Still looking for the right event?

Explore all events in London and filter by date, category, and more to find the perfect fit.

The Side Door to Your Production Environment: Finding Hidden Access Paths

Speaker

Good to know

Location

BCS, The Chartered Institute for IT

How do you want to get there?

More events from BCS, The Chartered Institute for IT

Discover more events from BCS, The Chartered Institute for IT, from Science & Tech to other experiences you might love.

You might also like...

Browse more events with different dates, prices, and formats to find your next great experience.

Still looking for the right event?

Explore all events in London and filter by date, category, and more to find the perfect fit.