Stories Tag: infosec

A Bit of Ambiance comes to Sigstore | by Dan Lorenc | Sep, 2021 | Medium

admin 4 days ago in

Zero-trust security starts with trusting actual entities based on strong identity, not whoever happens to control a secret, or whoever gets behind a firewall. No secrets sounds great in theory! It even sounds a bit magical. How can we authenticate without any secrets? In reality you can’t but you move the secrets around a bit and change how they work to get a similar effect….

A New Kind of Trust Root. Announcing the Sigstore Root Key… | by Dan Lorenc | Jun, 2021 | sigstore

admin 3 months ago in

I’m thrilled to announce that the Sigstore community is holding our first Root Key ceremony on June 18th at 2pm Eastern, and I’m even more thrilled to announce that it will be hosted LIVE by the always incredible DanPOP on his CloudNative.tv show, Spotlight Live. This Trust Root will eventually be used to secure the keys used by the entire Sigstore project, but more importantly…

Red Hat Advanced Cluster Security for Kubernetes | by Lawrence Manickam | Jun, 2021 | Medium

admin 4 months ago in

Microservices deployment in Kubernetes demands higher-level security needs and perception. The non-functional requirements of Microservices are unfolding in a complex manner. The two least focused areas in a Software Development Life Cycle are ‘Security’ and ‘Performance’. Consider Development is on the ‘left’ and Operations is at the ‘right’. It is important to shift the security to the left; Therefore, organizations can enjoy the speed to…

A Safer curl | bash ? | by Dan Lorenc | May, 2021 | sigstore

admin 5 months ago in

This post is about using container registries (Docker registries, OCI registries, whatever you want to call them) for the storage and distribution of generic, non-container-related binary artifacts. I explain the reasoning below, but first: code and demos Here’s a quick walkthrough of a draft tool (still WIP!) to securely fetch published contents from an OCI registry, called sget. sgetis part of the sigstore project, and…

What’s Next for Sigstore?. Project Update March 2021 — Building… | by Dan Lorenc | Mar, 2021 | sigstore

admin 6 months ago in

If you’re new to the Sigstore project, we officially launched on March 9th 2021 with a mission of improving the open source supply chain by making it easy to sign and verify code. We’re planning to provide free tools, APIs, and services as a public-benefit/non-profit. This post is to give a quick recap of where we are today, where we’re headed and what we’re focusing…

Azure subscription security review | by Marcin Niemiec | Feb, 2021 | Medium

admin 8 months ago in

Lately I have come across task to perform security review of Azure subscription. It was white-box based and I had access to all terraform, Kubernetes and Docker files. I will share with you what checks are worth to do for such review. Number of resources to check may vary from project to project. For me best approach is to mix automated tools with manual work….

Kubernetes Pentest: Checklist, tools and resources | by LobuhiSec | Jan, 2021 | Medium

admin 8 months ago in

Kubernetes is a maze: deployments, pods, containers, namespaces, services… When you arrive at kube-world as a beginner (like me) nothing has sense. For a while, I’ve been thinking about to create a checklist for pentesting purposes and put together every tool, repo or technique I’ve been discovering about kubernetes lately, but every implementation of kube is different so this could be consider as much as…

Web Application Firewall Architectures and Cloud Native Solutions | by Alex Gervais | Sep, 2020 | Ambassador API Gateway

admin 1 year ago in

A web application firewall (WAF) is a network security component that inspects, sanitizes and redacts malicious HTTP requests for applications. Since WAFs are operating on the application layer (layer 7 in the OSI model), traffic payloads originating from users and bots can be analyzed, in the hopes of blocking malicious clients and letting legitimate client requests proceed. WAFs are a critical part of any enterprise…

Introducing Kubernetes Goat – madhuakula

admin 1 year ago in

I have been working in Containers, Kubernetes and it’s security for quite sometime. I felt that there is a gap between the security and technology understanding of the Kubernetes it self. We all learnt using different goats in security world like WebGoat. I wanted to create some simple environment where anyone can practice and learn to get started in Kubernetes Security. That’s how it all…