Thomas Cameron

Must See TV. We need Hardware Vendors Intel, AMD, Arm to make cheaper Edge devices with Confidential Computing Chips available. All edge computers in the future should be running Confidential Containers or VMs. If adversary can touch a piece of hardware, they can probably get root access, Secure the system with encryption of not only data but processes running on the system.

2

Roses are red, Proofs are blue, Automated reasoning, Is a party for two! 🎉 🤖 I've been trying hard to keep up with the latest developments in the world of provable security at Amazon Web Services (AWS) - https://lnkd.in/gZTpZ3yz - and let me tell you, it's a fascinating field 🤯 From model checking to SMT solvers, the tools of the automated reasoning trade are really bolstering cybersecurity efforts. Think about it - being able to mathematically verify the security properties of your systems? That's like having a crystal ball that tells you the future, except the future is way more secure. And the best part? You don't even need a PhD in theoretical computer science to get in on the action. You can see some of the awesome ways automated reasoning is being put to work for AWS customers in services like IAM Access Analyzer, Amazon S3 Block Public Access, Amazon VPC Network Analyzer, Amazon VPC Reachability Analyzer, and Amazon Verified Permissions. These tools can help you identify security risks, validate access permissions, and generally improve the security posture of your cloud infrastructure. So if you're looking to level up your security game, why not give automated reasoning a try? It's like having your own personal security expert, except WAY nerdier. Who's with me? Let's get our proof on! 🤓 #CloudSecurity #AwsCloud #AutomatedReasoning #ProveableSecurity #AwsSecurity #CyberSecurity #SecurityPosture

13

5 AWS re:inforce 2024 Highlights from Philly in less than 1 min 🎥 if you prefer reading 👇🏾 - this was the largest reinforce yet (if you hear the word on the street) - Lots of Cloud Security Practioners and Leaders in the audience - attendance from far wide - shout out to the folks from Peru 🇵🇪 , Nigeria 🇳🇬 , Japan 🇯🇵 & South Korea 🇰🇷 who reached out and met me. ❤️🙏🏾 - 3 Announcements from keynote - Malware Detection for S3, IAM Access Analyzer gets preview of possible IAM policy, Security Lake enrichment - Lots of Chalk talks on IAM were again popular this year too as identities are lot more complex than 2023 in 2024 We did interviews with practitioners and Leaders on top of mind topics like AI security, identity , Appsec, zero trust which will be coming on Cloud Security Podcast soon, if you are subscribed or follow the page - you would get notified when it is released. Did I miss any update from AWs reinforce 2024? Philly Must See Places included in Video - independence hall, Liberty Bell, Angelos Pizzeria, Rocky Steps - hope I covered all major Philly spot 😬 Cc Amazon Web Services (AWS) #aws #awsreinforce #cloudsecurity

68

8 Comments

Five reasons large HPC users still struggle to reliably use Spot instances at scale, even with AWS EC2 instance hibernation turned "on". 1. Hibernate requires the exact same instance and exact same subnet for the restore, making it less likely to find a suitable new instance to continue running on quickly. 2. There are Spot instances available for some GPU instances (if you can survive the interruption) but hibernation is not available for GPUs. I hear from customers using Runai that they face the same limitations and reserved instances were suggested vs. trying to use Spot instances. 3. Hibernate must save the entire machine image apps+OS, hence it is more costly and inefficient compared to an approach that only saves the app and process trees (less data movement intensive). It is not uncommon for large Spot instance interruption "storms" to occur and customers have reported upwards of 30-40% reclaim rates, efficiency matters. 4. Users must configure a root volume size that is guaranteed to have enough free space and throughput to store the data on RAM. This EBS cost can add up for larger machines. File system based methods to persist the data on RAM can be much more cost effective. 5. Limited selection of EC2 instances is supported. For Linux machines, you can only use instances with 150GB of RAM or less. Many customers require 256, 512, 768, and larger instances for long periods of time and reliably using Spot instances is out of reach. It seems like most users are stuck with using on-demand and reserved instances for many use cases instead of running them on Spot and at best only using Spot for small VM workloads in a limited number of cases. In my opinion, our approach to memory checkpointing addresses all of the limitations above and some of the largest fortune 500 companies are beginning to adopt our solution. What has your experience using EC2 instance hibernation been like? #HPC #HTC #AWS #EC2 #Hibernation

15

9 Comments

"Torvalds's version avoids using the barrier_nospec() API, which prevents speculative execution of some machine code. Speculative execution is a feature of modern CPUs that use branch prediction to try to predict what program code will be run before it's needed, so it can be run and the results cached in advance. If the prediction is correct, it saves time; if it isn't, the results are discarded. The snag is that this opens up a particular form of security issue, which boffins have been working on ever since." https://lnkd.in/gzvmuTFw

6

Checkout the new blog post from the Rackspace Technology Cloud Developer Blog: https://lnkd.in/gQQe3iXy TL;DR I spent the weekend writing a new application, because sleep is for the weak. Meet Gisty: the code bin you didn't know you needed but might actually enjoy. Gisty was deployed on #Rackspace #OpenStack Flex: building an application and watching it deploy / scale effortlessly on the platform we're bringing to market has been incredibly satisfying. Highlights: * Writing a #Swift application to store data in Swift? Yep, I went there. It's meta, a pun, and a performance boost rolled into one * Containerized everything with Fedora CoreOS running Podman, in UBI-9 containers * OpenStack Application credentials made granting Gisty what is needed and securing access to my account a breeze * The UI is simple and features some fun toothpaste tubes: smiling when things work and looking hilariously disheveled when they don't; a quirky reminder that even when things get messy, there's always a way to clean them up * Simplified application stack, leveraging the OpenStack APIs to effortlessly scale. Rackspace OpenStack Flex is making open infrastructure native applications feasible and genuinely fun. If you're curious about how Gisty was built checkout the about page at "https://gisty.link/about." 🥂 Here's to embracing the open cloud, laughing along the way, and building things that make life a little more intriguing.

26

There was a major update to the Linux systemd update recently resulting in (and I am not making this up) "now with 42% less Unix philosophy". Unfortunately it also has result in the potential to erase a users entire home directory: "Among the issues fixed in version 256.1 are that even as long as five years ago, systemd-tmpfiles had moved on past managing only temporary files – as its name might suggest to the unwary. Now it manages all sorts of files created on the fly … such as things like users' home directories. If you invoke the systemd-tmpfiles --purge command without specifying that very important config file which tells it which files to handle, version 256 will merrily purge your entire home directory." But this post isn't about the intended behavior of systemd. It is about one of the challenges of open source software. Namely, the challenges of being an end-user and dealing with such. In this case a user (GitHub user jedenastka) filed a bug report indicating that when they ran the --purge command it deleted their home directory. The response from a systemd maintainer was, less than ideal: "So an option that is literally documented as saying "all files and directories created by a tmpfiles.d/ entry will be deleted", that you knew nothing about, sounded like a "good idea"? Did you even go and look what tmpfiles.d entries you had beforehand? Maybe don't just run random commands that you know nothing about, while ignoring what the documentation tells you? Just a thought eh" Except it turns out maybe that isn't the case - maybe in this case whomever designed the purge function just did it badly: "Lennart Poettering: 'I think we should fail --purge if no config file is specified on the command line. I see no world where an invocation without one would make sense, and it would have caught the problem here.' Red Hat open source developer Zbigniew JÄ(TM)drzejewski-Szmek: 'We need to rethink how --purge works. The principle of not ever destroying user data is paramount. There can be commands which do remove user data, but they need to be minimized and guarded.' Systemd contributor Betonhaus: 'Having a function that declares irreplaceable files — such as the contents of a home directory — to be temporary files that can be easily purged, is at best poor user interfacing design and at worst a severe design flaw.'" I'm glad the maintainers were able to get where they needed to be but it does make me wonder why we were ever in that situation in the first place. Software should be designed to fail safe. Deleting a users home directory because they did not use the command correctly (i.e. didn't specify what seems to be a required config file) isn't an oops on the users part it is improper software design. Being snippy about it doesn't help anyone and sure doesn't improve the image of OSS.

2

Filetop - one of very cool eBPF command line tools. Great way to understand where IO activity on your system really comes from https://lnkd.in/evzXZEWS #observability #ebpf

11

Europeans [https://lnkd.in/gGPejVvU] most often consume raw, UHT, HTST, and unpasteurized dairy including milk, yogurt and cheese products. Jeremy Farrar, the World Health Organization’s (WHO) chief scientist, said last week the risk of spillover to humans from the new strain was an “enormous concern.” Bird flu rarely infects humans but is often fatal when it does. According to the WHO, the case fatality rate among humans since 2003 stands at 52 percent. US federal rules require milk from infected cows to be discarded, but it’s not yet clear whether cows often start shedding the virus before they look sick or produce abnormal milk. The 16 April preprint, which has not yet been peer reviewed, includes reports that milk from infected cows is thicker and more yellow than typical milk and that infected animals eat less and produce less milk than usual. —— https://lnkd.in/gxG4i8ra Tanya Gravier MPH: “I agree here with Eric [https://lnkd.in/g3F_vd9n ] “There is lack of transparency and we should not assume the milk is safe. A lot of what ifs?-what if it’s not pasteurized correctly? And then I pondered UHT milk-the kind you buy at room temperature. Seems like it should be totally safe..but au contraire. I have this comment from a paper about foot and mouth disease-a totally different virus and it’s not very reassuring: “Although HTST pasteurization #didnotcompletelyinactivate viral infectivity in whole and 2% milk, possibly because a fraction of the virus was protected by the milk fat and the casein proteins, it greatly reduced the risk of natural transmission of FMDV by milk.” :: The FMD virus (FMDV) is a single stranded RNA virus of 25–30 nm diameter with icosahedral symmetry. The virus belongs in the genus Aphthovirus in the family Picornaviridae.” Inquiries 0) H5N1/AN degraded hemagglutinin toxic? 1) Degraded H5N1/AN hemagglutinin in Pasteurized Milk 🥛 a risk, given 0)? 2)Survey H5N1/AN in Swine [zoonotic hinge’] Highly Pathogenic Avian Influenza (HPAI) —• Paul’s HPAI Inquiries 0) H5N1/AN degraded hemagglutinin toxic? 1) Degraded H5N1/AN hemagglutinin in Pasteurized Milk 🥛 a risk, given 0)? 2)Survey H5N1/AN in Swine [zoonotic hinge’] https://lnkd.in/gMfgmuN7 Pascual E, Mata CP, Gómez-Blanco J, Moreno N, Bárcena J, Blanco E, Rodríguez-Frandsen A, Nieto A, Carrascosa JL, Castón JR. Structural basis for the development of avian virus capsids that display influenza virus proteins and induce protective immunity. J Virol. 2015 Mar;89(5):2563-74. doi: 10.1128/JVI.03025-14. Epub 2014 Dec 17. PMID: 25520499; PMCID: PMC4325719.

Hey everyone! In my last post about cloud networking vs. traditional data centers and being a trusted advisor vs. just a seller, a few folks reached out asking, “Igor, what did you mean?” Well, let me break it down. Cloud networking isn’t all that different. It’s just done right. Remember the days of the VMware stack with vSwitch or dVS? Back then, the advice from VMware SEs and SAs was that we could solve everything with vMotion, even in active/active data centers designs. Hmmm did some used parallel so called swimming lanes - i.e. 2 parallel application stacks? They preached, “Just use vMotion,” and unfortunately a lot of people believed it. Stretching L2 domains across DCs? We all know the disasters that caused. But in the cloud, there are no L2 domains. Why? Because applications are finally done right. I don’t worry about IP address changes anymore—thanks to dynamic FQDN. This should’ve been the norm all along, even in traditional environments. Fast forward to today. Let’s see what Prosimo.io can do for you. Remember, be a trusted advisor, not just a seller. Reach out and let’s chat!

6

I have lost count the amount of times I argued against additional encryption! Hear me out, usually for cloud native storage, you can pretty easily set up TLS encryption in transit, and some form of FIPS 140-2 encryption standard for encryption at rest, when sharing data is involved, that is all you need. Just need to make sure you set up permissions correctly and strictly follow least privilege principle! But there are those who insist adding extortionate extra encryption standards without realizing that instead making it more secure, they are actually making the solution more vulnerable to the meet in the middle attacks. I know this is quite in depth, but you can read really good article about it below: https://lnkd.in/e_93-NWf. #CyberSecurity #Encryption #CloudSecurity #DataProtection #InfoSec #CloudComputing #DataSecurity #TechTrends #Privacy #FIPS1402 #TLS #DataEncryption #SecurityStandards #Cryptography #CloudNative

5

2 Comments

If you thought vulnerability prioritization was hard, think again - fixing is WAY HARDER, especially in 3rd party libraries / OSS dependencies. I'm so humbled with the feedback and reception our new product announcements around upgrades and remediation we've received. Beth Pariseau did an amazing job of highlighting the value of such a monumental product release, where Pathik Patel from Informatica shared some of his views and experiences using our product as well. Compliance drivers like #FedRAMP are driving more pressure on accelerated remediation - you typically have 30 days to fix critical and high vulnerabilities. It's simply impossible to do so when these vulnerabilities exist in foundational libraries like Spring. 🔥 Upgrade Impact Analysis shows you and your developers what vulnerabilities you can fix with package upgrades easily, without breaking your applications. It also identifies situations where breaking changes will get introduced, so those upgrades can be thoughtfully planned and executed. 🔥 Endor Magic Patches are trusted patches we provide you on your existing package versions, when upgrades are too painful, or will take too long. This is a game changer for organizations that struggle for months or even years trying to upgrade foundational platform libraries like Spring, jackson-databind, snake-yaml, etc. Here's how it works: 1️⃣ Identify vulnerabilities that are reachable by your application code. 2️⃣ Analyze the impact of upgrading dependent packages. 3️⃣ Patch only what's vulnerable if the upgrade is too challenging. This is a huge innovation in Software Supply Chain Security and a meaningful step toward helping developers and AppSec teams work together seamlessly. Read more here: https://lnkd.in/eBKainF9 #betterwaytosca #sca #appsec #remediation #fedramp

57