# Actionable Followups from the Capital One Breach

DevFeed: [Actionable Followups from the Capital One Breach](<https://devfeed.tech/articles/actionable-followups-from-the-capital-one-breach-36657.md>)

Original publisher: [Read original article](<https://shostack.org/blog/actionable-followups-from-the-capital-one-breach/>)

Author: Adam

Published: 2019-07-30T00:00:00Z

Content type: opinion

Language: en

Sources: [Shostack & Friends Blog](<https://devfeed.tech/sources/shostack-friends-blog.md>)

Topics: [Security](<https://devfeed.tech/topics/security.md>), [cloud security](<https://devfeed.tech/topics/cloud-security.md>), [Authorization](<https://devfeed.tech/topics/authorization.md>), [Code](<https://devfeed.tech/topics/code.md>), [Agile](<https://devfeed.tech/topics/agile.md>)

Tags: [agile](<https://devfeed.tech/tags/agile.md>), [breach](<https://devfeed.tech/tags/breach.md>), [cloud-security](<https://devfeed.tech/tags/cloud-security.md>), [code](<https://devfeed.tech/tags/code.md>), [permissions](<https://devfeed.tech/tags/permissions.md>), [security](<https://devfeed.tech/tags/security.md>)

## AI overview

The article draws actionable security lessons from the Capital One breach, focusing on avoiding overly broad permissions and using static analysis and commit hooks to detect or block risky access grants. It also argues that security guidance can be progressively turned into code and improved through an agile approach.

## Source excerpt

What have we learned and what steps can we take?