Cris Merritt

DOD Continuous ATO Implementation Guide is finally here. There's a path to make the CD part of the CI/CD can finally happen... https://lnkd.in/eXF2k7vs

1

Maintain safe and secure deployments to Kubernetes with Octopus 👏 When scaling Kubernetes deployments it can be hard to ensure safety and security. But not with Octopus. Octopus provides built-in RBAC controls and ITSM integrations to handle access to projects, approvals, and safe deployments to production. Audit logs store every action so you have a complete picture of who did what and when. Runbooks let you automate day-0 provisioning and day-2 maintenance tasks that your team can self-serve with a single click. Learn more: https://lnkd.in/g63sT52P #Kubernetes #ContinuousDelivery #OctopusDeploy #DevOps

17

"Running Redis on Windows: Setting Up with WSL" is your step-by-step guide to effortlessly integrating Redis into your Windows environment. Discover how to leverage the Windows Subsystem for Linux (WSL) to run Redis seamlessly, combining the power of Linux with the flexibility of Windows. Whether you’re looking to enhance application performance, manage data more efficiently, or simply expand your tech toolkit, this guide has you covered. Elevate your development game with Redis on Windows today! Dive into the full guide here: https://lnkd.in/d4GrUB9S Authored by: Muhammad Aaliyan Khan, Software Engineer at Qavi Tech Looking to bring innovative ideas like this to life in your IT projects? Get in touch with us! Qavi Tech specializes in cutting-edge development and is always excited to work on interesting, impactful projects. #Redis #Windows #WSL #SoftwareDevelopment #TechTips #Innovation #WebDevelopment

23

Have you heard about Kyverno? It's a powerful policy engine designed specifically for Kubernetes. With Kyverno, you can: - Validate, Mutate, and Generate - Kubernetes resources effortlessly. - Secure your software supply chain by verifying OCI image signatures and artifacts. - Manage policies using familiar tools like `kubectl`, `git`, and `kustomize` - no need to learn a new language! Kyverno integrates seamlessly into your CI/CD pipeline, ensuring compliance, security, and automation at every step. 🌟 Check it out on GitHub: [Kyverno](https://lnkd.in/dguXtbFP)   Learn more: [Kyverno.io](https://kyverno.io/) #Kubernetes #DevOps #CloudNative #PolicyManagement #Kyverno 🔗 Let's connect and discuss how Kyverno can enhance your Kubernetes workflows!

1

Every Friday on X I post about free security tools. Cost should not be prohibitive to investing in your cybersecurity. You can find me on X as @vtahowe -------------------------------------------------------- It’s Free Tool Friday! Securing Infrastructure as Code (IaC) edition. Trivy, by Aqua Security - scan IaC and uncover misconfigurations https://lnkd.in/g_HrCYxA Checkov, by Bridgecrew - scan IaC and detect leaked AWS creds https://lnkd.in/gHgzSNMs Terrascan, by Tenable - scan IaC against 500+ out of the box policies derived from security best practices

1

Shifting to Terraform is the first piece of the puzzle. Automating and governing cloud infrastructure with Terraform is the next level. ControlMonkey offers the most comprehensive Terraform Automation solutions for companies with large-scale environments. With tools for shifting 1000s of cloud resources to Terraform in a few clicks, Terraform CI/CD, Cloud Asset Inventory, AI-powered Drift Detection & Remediation, and many more, ControlMonkey is the one-stop-shop to manage and govern your cloud with Terraform truly. We invite you to Booth #348 for a technical discussion about Terraform, Automation, Cloud Governance, and everything in between. If you're managing large-scale environments and looking to increase your cloud team efficiency while reducing risks, drop by our booth and learn more about us. (: Looking forward to seeing you there. 😎 You can book a time to meet us there: https://lnkd.in/dgaVARYi #aws #devops #terraform #opentofu #reinvent

3

🔐 Welcome to today’s Cloud Safari episode! 🌥️ Dive deep into AWS Secrets Manager and learn how to securely manage your API keys, passwords, and sensitive data. Discover the core functionalities, benefits, and step-by-step integration with RDS and EC2 instances. 🚀 Enhance your security posture with automatic secrets rotation, multi-region support, and seamless integration with various AWS services. Don’t miss out on this essential guide to simplifying and securing your cloud infrastructure! https://lnkd.in/gz_tRbkX  #adexltd #youtubevideos #awstutorial #aws #amazonwebservices #awssecretmanager

8

Holes in Your Bitbucket: Why Your CI/CD Pipeline Is Leaking Secrets https://ift.tt/cnD73Wg Written by: Mark Swindle   While investigating recent exposures of Amazon Web Services (AWS) secrets, Mandiant identified a scenario in which client-specific secrets have been leaked from Atlassian's code repository tool, Bitbucket, and leveraged by threat actors to gain unauthorized access to AWS. This blog post illustrates how Bitbucket Secured Variables can be leaked in your pipeline and expose you to security breaches.  Background Bitbucket is a code hosting platform provided by Atlassian and is equipped with a built-in continuous integration and continuous delivery/deployment (CI/CD) service called Bitbucket Pipelines. Bitbucket Pipelines can be used to execute CI/CD use cases like deploying and maintaining resources in AWS. Bitbucket includes an administrative function called "Secured Variables" that allows administrators to store CI/CD secrets, such as AWS keys, directly in Bitbucket for easy reference by code libraries.  CI/CD Secrets: CI/CD Secrets serve as the authentication and authorization backbone within CI/CD pipelines. They provide the credentials required for pipelines to interact with platforms like AWS, ensuring pipelines possess the appropriate permissions for their tasks. Secrets are often extremely powerful and are beloved by attackers because they present an opportunity for direct, unabated access to an environment. Maintaining confidentiality of secrets while balancing ease of use by developers is a constant struggle in securing CI/CD pipelines.  Bitbucket Secured Variables: Bitbucket provides a way to store variables so developers can quickly reference them when writing code. Additionally, Bitbucket offers an option to declare a variable as a "secured variable" for any data that is sensitive. A secured variable is designed such that, once its value is set by an administrator, it can no longer be read in plain text. This structure allows developers to make quick calls to secret variables without exposing their values anywhere in Bitbucket. Unless… Exporting Secrets from Bitbucket in Plain Text CI/CD pipelines are designed just like the plumbing in your house. Pipes, valves, and regulators all work in unison to provide you with reliable, running water. CI/CD pipelines are a complicated orchestration of events to accomplish a specific task. In order to accomplish this, these pipelines are highly proficient at packaging and deploying large volumes of data completely autonomously. As a developer, this creates countless possibilities for automating work, but, as a security professional, it can be a cause for anxiety and heartburn. Perhaps it's a line of code with a hardcoded secret sneaking into production. Maybe it's a developer accidentally storing secrets locally on their machine. Or maybe, as we have seen in recent investigations,  it's a Bitbucket artifact object containing secrets for an AWS environment being publ...

1

CISA is now explicitly recommending that software providers "run security scanning tools on each open source software component," as well as "cache copies of all open-source dependencies." How do you do this? By using Cloudsmith as your artifact management platform. It's all built in, with no extra work required by your developers. This is why we describe Cloudsmith as the control plane that secures your software supply chain. https://lnkd.in/eGj27TSh

22

Two headlines from the past week: Figma Moves from ECS to Kubernetes to Benefit from the CNCF Ecosystem and Reduce Costs: https://lnkd.in/d-S43vrA Serverless Is Trending Again in Modern Application Development: https://lnkd.in/dM-nRJvW There is a thin line between the two headlines - they both embrace cloud-native applications. Do cloud-native applications suit 100% of current applications? Probably not. Does your organization still maintain traditional applications on top of legacy virtualization technology, for running stable and static applications, which still produce your organization's business value? If this is the case, perhaps you can keep those applications until the end of the support lifecycle. On the other hand, if your business requires agility, the ability to gain experience with the latest technologies (such as containers, serverless, and GenAI applications), and the ability to quickly release new services or capabilities to your customers, I encourage you to invest in modern application development, on-top of cloud-native services. For all the veteran sys admins, engineers, or architects among us – do not wait until you lose your job – learn today how to take the full benefits of the public cloud, learn how to code for automation processes, specialize in multi-discipline – from compute, storage, network, security, and GenAI. Any skill that will enable you to adapt to the modern world. You are welcome to follow me on social media - https://lnkd.in/dwQAiYhY #cloud #modernization #cloudnativeapps #careeradvice

20

🚀 Boost Your IaC Security with Checkov and Terraform 🚀 In today's cloud-native world, securing your infrastructure as code (IaC) is paramount. Checkov, an open-source tool by Bridgecrew, simplifies this process by scanning your Terraform configurations for security misconfigurations and compliance issues. Why Checkov? Checkov is a powerful static code analysis tool designed for securing infrastructure as code (IaC). When used with Terraform, Checkov can help identify misconfigurations and potential security risks. Here's a brief guide on how to use Checkov to scan Terraform files 👉 https://lnkd.in/ggXj9qGb #terraform #devops #cloudcuddler

2

Creating Stunning Snapshot Report Cards with Grafana Discover how to transform Excel files into visually appealing snapshot report cards using Grafana. Learn the step-by-step process of setting up a Grafana instance and rolling out your first beautiful and informative report for your team. Upgrade your data presentation game now! #SnapshotReportCards #GrafanaTutorial #DataVisualization #TeamMetrics #ExcelTransformation #DataPresentation #VisualAppeal #ITProjects #DataAnalysis #InformationReporting

8

Use 12Port Horizon solution to visualize your network traffic flow.

3

Learn how to deploy Buildbarn on Kubernetes with added security using mTLS. This guide, by Yuriy Taraday, walks you through the setup process, ensuring your distributed build system is both scalable and secure. https://hubs.ly/Q02Q48YX0

8

Anti-Complex Kubernetes: Open Source and Cloud Native – October 31 🚀 Platform builders and engineering leaders, this one’s for you! In this deep-dive session, we'll explore strategies to reversing the complexity in Kubernetes. Joining us this episode is Phill Gibson, Sr. Product Manager at Azure. He’ll share insights on what’s working—and what’s not—in the battle against cloud native complexity. 📅 October 31 – mark your calendar! 🔗 https://hubs.ly/Q02VmzPd0 #CloudNative #Kubernetes #DevOps #OpenSource #PlatformEngineering #TechLeadership

7

There’s more to application security than just shift left tools. Applications built with AI need continuous testing because LLMs change as users interact with them. For these apps especially it’s important that we don’t just monitor security at the beginning of the software development lifecycle. Runtime security tools are able to catch things shift left tools can’t including: - Zero day vulnerabilities - Shadow vulnerabilities - Software dependancies behaving unexpectedly Tomorrow my newsletter subscribers will learn about why runtime is the right time to monitor your application security and a tool that can help.

2