security

How We Survived Our First PCI/HIPAA Compliant Check with Kubernetes

How We Survived Our First PCI/HIPAA Compliant Check with Kubernetes

December 23, 2019

At a high level, Travis will go over what it took for Nav to pass their first compliance check with their application in Kubernetes.At a lower level, he'll discuss what PCI/HIPAA compliance is like …
JavaScript, security, and the case for feature simplicity

JavaScript, security, and the case for feature simplicity

December 22, 2019

JavaScript engines are frequently targeted by malicious attackers, and dozens of vulnerabilities are reported in them every year. Most of these occur due to errors made while implementing well-specified features. Natalie Silvanovich discusses the link between feature complexity, developer error, and security vulnerabilities and the importance of considering implementation difficulty in design.
Scrutinizing SPIRE to Sensibly Strengthen SPIFFE Security

Scrutinizing SPIRE to Sensibly Strengthen SPIFFE Security

December 22, 2019

SPIFFE (Secure Production Identity Framework For Everyone) is an open source standard for giving identities to services in dynamic and heterogeneous environments. SPIRE is an implementation of SPIFFE …
Jumpstarting your DevSecOps pipeline with IAST and RASP (sponsored by Contrast Security)

Jumpstarting your DevSecOps pipeline with IAST and RASP (sponsored by Contrast Security)

December 21, 2019

Jeff Williams explains how to layer security tools on a CI/CD pipeline without disrupting it and demonstrates a fast, effective, scalable DevSecOps pipeline using free tools.
Kubernetes security best practices

Kubernetes security best practices

December 21, 2019

Ian Lewis shares the easiest and best ways to improve the security of your Kubernetes clusters
The distributed authorization system: A Netflix case study

The distributed authorization system: A Netflix case study

December 19, 2019

Manish Mehta and Torin Sandall lead a deep dive into how Netflix enforces authorization policies (who can do what) at scale in its microservices ecosystem in a public cloud without introducing unreasonable latency in the request path.
How to Choose a Kubernetes Runtime

How to Choose a Kubernetes Runtime

December 18, 2019

This year has seen the launch of several new container runtimes,including gVisor from Google and Nabla from IBM, as well as the consolidation of the Hyper and Intel VM container projects into Kata con …
Istio - The Packet's-Eye View

Istio - The Packet's-Eye View

December 18, 2019

The Istio project reached 1.0 this summer, and is mature enough to have LTS releases. It's getting a lot of attention, but in a lot of ways it's still a mystery. You've probably read about it, you mig …
Running VM Workloads Side by Side with Container Workloads

Running VM Workloads Side by Side with Container Workloads

December 18, 2019

On Kubernetes clusters, cloud native workloads and (legacy) VM workloads can run side by side. KubeVirt is a project to bring declarative, Kubernetes-style APIs to VM creation, configuration, and mana …
Deep Dive: Container Identity WG

Deep Dive: Container Identity WG

December 16, 2019

Over the past year the Container Identity working group has been working on a number of initiatives relating to identity in Kubernetes. These include providing a mechanism to issue scoped JWTs that ca …
Machine Learning the Kubernetes Way

Machine Learning the Kubernetes Way

December 16, 2019

The Bloomberg Professional Service (aka "the Terminal") provides data, analytics, news, information and communication to professionals in business, finance, government, and philanthropy. Through our i …
Running Serverless HPC Workloads on Top of Kubernetes and Jupyter Notebooks

Running Serverless HPC Workloads on Top of Kubernetes and Jupyter Notebooks

December 16, 2019

Jupyter notebooks, deployed on top of k8s, are finding rapid adoption in universities and industry. While k8s can spawn new pods for each notebook session, launching high performance computing (HPC) j …
Patterns in Node.js vulnerabilities

Patterns in Node.js vulnerabilities

December 14, 2019

Chetan Karande shares the findings from an analysis of over a thousand publicly known Node.js vulnerabilities. With intuitive data visualizations and statistics, Chetan details trends over last five years, explores common security mistakes made by Node.js package authors, and explains how you can prevent these issues in your own code.
The freedom to configure is the freedom to make a better world.

The freedom to configure is the freedom to make a better world.

December 13, 2019

Chances are you fell in love with technology the day you took some tool that didn't quite work for you and made it betterbetter suited to you and your idiosyncratic needs and uses. Then you shared your improvements and made other people's lives better too, and what sweeter feeling is there? Cory Doctorow explains why the right to configure is the signature right of the 21st century.
Architecting data platforms for cybersecurity

Architecting data platforms for cybersecurity

December 12, 2019

Data is becoming a crucial weapon to secure an organization against cyber threats. Charaka Goonatilake shares strategies for designing effective data platforms for cybersecurity using big data technologies, such as Spark and Hadoop, and explains how these platforms are being used in real-world examples of data-driven security.
Deep Dive: Falco

Deep Dive: Falco

December 12, 2019

In any Cloud Native architecture, theres a seemingly endless stream of events that happen at each layer. These events can be used to detect abnormal activity and possible security incidents, as well …
When third parties stop being polite. . .and start getting real

When third parties stop being polite. . .and start getting real

December 12, 2019

Nic Jansma and Charles Vazac perform an honest audit of several popular third-party libraries to understand their true cost to your site, exploring loading patterns, SPOF avoidance, JavaScript parsing, long tasks, runtime overhead, polyfill headaches, security and privacy concerns, and more. They also share tools to help you decide if a librarys risks and unseen costs are worth it.
Complex event processing with Apache Flink

Complex event processing with Apache Flink

December 11, 2019

Complex event processing (CEP) helps detect patterns over continuous streams of data. DNA sequencing, fraud detection, shipment tracking with specific characteristics (e.g., contaminated goods), and user activity analysis fall into this category. Kostas Kloudas offers an overview of Flink's CEP library and explains the benefits of its integration with Flink.
Is Istio the Most Next Gen Next Gen Firewall Ever Created?

Is Istio the Most Next Gen Next Gen Firewall Ever Created?

December 11, 2019

Istio is emerging as a popular service mesh layer for cloud native apps and it delivers a variety of great features for devops scenarios. While security is one of its core tenets, Istio has far more p …
Deep Dive: NATS

Deep Dive: NATS

December 10, 2019

The NATS project and its ecosystem have been continuously evolving since joining the CNCF and in this session we will share a retrospective of what is the current state of the art and overall directio …
Executive Briefing: GDPRGetting your data ready for heavy, new EU privacy regulations

Executive Briefing: GDPRGetting your data ready for heavy, new EU privacy regulations

December 10, 2019

In May 2018, the General Data Protection Regulation (GDPR) goes into effect for firms doing business in the EU, but many companies aren't prepared for the strict regulation or fines for noncompliance (up to 20 million or 4% of global annual revenue). Mark Donsky and Syed Rafice outline the capabilities your data environment needs to simplify compliance with GDPR and future regulations.
Container Security and Multi-Tenancy Tales from Kata and Nabla

Container Security and Multi-Tenancy Tales from Kata and Nabla

December 9, 2019

With the introduction of the Kubernetes CRI many different choices have emerged for users to run their various containerized workloads. There have been concerns about the complexity of making traditio …
Hadoop under attack: Securing data in a banking domain

Hadoop under attack: Securing data in a banking domain

December 9, 2019

The apparent difficulty of managing Hadoop compared to more traditional and proprietary data products makes some companies wary of the Hadoop ecosystem, but managing security is becoming more accessible in the Hadoop space, particularly in the Cloudera stack. Federico Leven offers an overview of an end-to-end security deployment on Hadoop and the data and security governance policies implemented.
How to protect big data in a containerized environment

How to protect big data in a containerized environment

December 9, 2019

Recent headline-grabbing data breaches demonstrate that protecting data is essential for every enterprise. The best-of-breed approach for big data is HDFS configured with Transparent Data Encryption (TDE), but TDE can be difficult to configure and manageissues that are only compounded when running on Docker containers. Thomas Phelan discusses these challenges and explains how to overcome them.
Shopifys $25k Bug Report, and the Cluster Takeover That Didnt Happen

Shopifys $25k Bug Report, and the Cluster Takeover That Didnt Happen

December 9, 2019

In May, a security researcher reported a vulnerability in a Shopify microservice and demonstrated how it could be used to access keys from the Google Cloud metadata API. This could have led to a clust …
Lightning Talk: What I Wish Id Known about Fluentd with Kubernetes

Lightning Talk: What I Wish Id Known about Fluentd with Kubernetes

December 7, 2019

Fluentd is really powerful, but configuring it for best performance and getting the most out of it is not easy. Bryan spent several weeks tuning Fluentd on a production Kubernetes cluster, uploading t …
Completely Securing the Software Supply Chain using Grafeas + in-toto

Completely Securing the Software Supply Chain using Grafeas + in-toto

December 6, 2019

Continuous delivery, a prevalent concept in the cloud native ecosystem, has drastically simplified and accelerated development and deployment of software from its inception to the enduser. Unfortunate …
Continuous Delivery Meets Custom Kubernetes Controller: A Declarative Configuration Approach to CI/CD

Continuous Delivery Meets Custom Kubernetes Controller: A Declarative Configuration Approach to CI/CD

December 5, 2019

Building and maintaining streamlined continuous integration and delivery (CI/CD) pipelines is often challenging. It is even harder on Kubernetes since the deployments are, rightfully so, safely guarde …