Operations | Monitoring | ITSM | DevOps | Cloud

The latest News and Information on CyberSecurity for Applications, Services and Infrastructure, and related technologies.

ELK - Not Just For The Nice Visitors

Most of the applications we see for the ELK stack are from businesses which want to improve their customers' experience. To return relevant search results and to create Kibana dashboards that allow them to analyse data and give the customers what they want. But there are some cases where the customer is always wrong, and where the last thing you want to do is give a site visitor what he wants. Welcome to the world of forensics, compliance and fraud detection.

How to configure HTTPS for an Nginx Docker Container

There are a few ways to effectively configure HTTPs for an Nginx Docker Container. In this guide, we will quickly cover configuration through the use of free certificate authority Let’s Encrypt. For plenty of people, using Let’s Encrypt to configure HTTPS for an Nginx docker container is a good option. A paid version like Comodo’s SSL certificates may make more sense if you want to increase the security of your site and server.

SupportWorld Live Goes Virtual! A Recap and Lessons Learned

Conferences, while a lot of work, are such a fun outlet to connect with other people in the IT community. It’s an opportunity to learn about new technologies, trends, and gain new perspectives around the industry. Some of my favorite memories of past conferences stem from the exhibit hall passport games and morning coffee breaks, mingling with other attendees whose paths you may not typically cross. Those were the days!

Detecting CVE-2020-1472 (CISA ED 20-04) Using Splunk Attack Range

The recent disclosure of CVE-2020-1472 vulnerability by Microsoft showcases the need for tools that allow defenders to quickly replicate published exploit code, register attack data, and create signatures or other mitigations against released exploits with a high likelihood of exploitation against popular infrastructure or operating systems.

What's new in Sysdig - September 2020

Welcome to our monthly update on what’s new from Sysdig! This month is a little eclipsed by last month’s big launch of Essentials and our new SaaS regions, KubeCon EU, and many of us finishing off the summer holidays and getting the kids packed off back to school. Our teams are busy working on some big feature releases which we don’t want to reveal just yet, but I think you’re all going to really love them in the coming months!

Network Policy with GKE

By default, pods are non-isolated; they accept traffic from any source. The Google GKE solution to this security concern is Network Security Policy that lets developers control network access to their services. Google GKE comes configured with Network Security Policy using Project Calico which can be used to secure your clusters. This class will describe a few use cases for network security policy and a live demo implementing each use case.

Leveraging behavior analytics and machine learning algorithms in your PAM strategy

Modern technologies like machine learning (ML) algorithms can introduce a forward-thinking outlook to privileged access management (PAM) and enable enterprises to predict emerging access risks in real time. ML-based anomaly detection systems can deeply analyze raw data collected around privileged activity, profile standard user behavior patterns, and then surveil future operations to detect any deviations from the norm, such as server logins after office hours.

Manage AppArmor profiles in Kubernetes with kube-apparmor-manager

Discover how Kube-apparmor-manager can help you manage AppArmor profiles on Kubernetes to reduce the attack surface of your cluster. AppArmor is a Linux kernel security module that supplements the standard Linux user and group-based permissions to confine programs to a limited set of resources. AppArmor can be configured for any application to reduce its potential attack surface and provide greater in-depth defense.

How to Secure Mixed Linux/Windows Clusters with Calico Policy

Calico is the only cross-platform CNI and Network Policy engine available today and is currently powers more than 150,000 known clusters across millions of nodes worldwide. Many organizations have .NET and windows workloads that they are or will eventually modernize and deploy to Kubernetes. We have been collaborating with Microsoft and joint customers over the past few years to bring Calico to the Windows platform.