Public and private cloud metadata and why it is useful

Oct 25, 2015Download as ODP, PDF0 likes256 views

The document discusses how cloud metadata and Ansible dynamic inventory can help DevOps and security teams collaborate more effectively. It provides examples of how metadata tagging servers can enable targeted operations like provisioning, patching, software installation based on tags. This allows implementing security processes into continuous delivery pipelines through automated and flexible configuration of servers. The speaker advocates that DevOps and security teams work together to build pipelines that use metadata and dynamic inventory to make security part of standard operations.

LONDON 2015Join the conversation #devseccon
Public And Private Cloud
Metadata And Why It Is
Useful
Steven Armstrong

Who Am I And What Do I Do?
• Steven Armstrong
• Principal Automation
Engineer @Betfair
• I make invisible robots
• Working in configuration
management for 9 years
• DevOps practitioner
• Build continuous
integration and
deployment pipelines
• Automate everything,
always

Current Situation With Some
Security Practitioners

DevOps And Security
Practitioners Have A
Responsibility To Avoid

How Cloud Metadata Can Help
Sort Information

Provision VMs or Physical
Servers tag with metadata

Ansible Dynamic Inventory
• Python dynamic inventory
file queries underlying
apis to act as a service
discovery tool
• Returns json inventory in
real time of cloud estate
• Filter machines based on
tags
• Carry out particular
operations on servers
using filters
•
•
ansible-playbook
–i openstack.py
–l riemann_qa
playbooks/run_chef.yml
•

All Cloud Providers Have
Metadata And Ansible Dynamic
Inventories

DevOps Use Case: Install
software on boxes
ansible-playbook
–i openstack.py
–l riemann_prod
playbooks/run_chef.yml
•

DevOps Use Case: Roll boxes off
load balancer at a particular version
and new boxes into service
ansible-playbook
–i openstack.py
–l riemann_prod
playbooks/loadbalancer.yml
•

Security Use Case: Assign
Servers To Teams or Owners
ansible-playbook
–i openstack.py
–l production
playbooks/email_owners.yml
•

Security Use Case: Tag Open
Vulnerabilities On Boxes

Security Use Case: Targeted
Patching or Updates Like Shellshock
ansible-playbook
–i openstack.py
–l production
playbooks/ad_hoc_patch.yml
•

LONDON 2015Join the conversation #devseccon
Contact Info: steven.armstrong@betfair.com
Blog: http://www.devarmstrongops.blogspot.co.uk/
tweet: @Steve9Armstrong
!!!Come to our continuous delivery workshop later today
which will show Betfairs deployment pipeline and how
we have integrated security scanning into it!!!

This document appears to be from an online conference presentation about speeding up Office 365 intranets. It includes an agenda for June 17-18, 2015 discussing topics like the object cache in SharePoint Online, establishing performance baselines using Application Insights, integrating Redis Cache, and using the Azure Content Delivery Network. Contact information is provided for Rick Van Rousselt, a SharePoint consultant, to answer any additional questions.

How to adopt React for moving fast startupSira Sujjinanont

The document discusses how a startup has adopted new technologies and scaled rapidly over 10 months. It overhauled its web platform and launched a new product using React Native by focusing on engineering culture, adopting modern tools, and understanding requirements from a business perspective. Continuous delivery of new code, processing over 120 million numbers daily, and rewriting the platform with their own UI library helped the startup scale quickly while improving quality.

Deploying Kubernetes on AWS Using TerraformAnant Corporation

I'll introduce you to using Terraform to spin up a Kubernetes cluster on Amazon's Web Services. We will be creating an EKS cluster and an auto-scaling group of workers for the cluster. Accompanying Blog: https://blog.anant.us/deploying-kubernetes-on-aws-using-terraform/ Webinar Recording: https://www.youtube.com/watch?v=62DlyF3B4_k Follow Us and Reach Us At: Anant: https://www.anant.us/home Cassandra.Link: https://cassandra.link/ Email: [email protected] LinkedIn: https://www.linkedin.com/organization... Twitter: https://twitter.com/anantcorp Eventbrite: https://www.eventbrite.com/o/anant-10... Facebook: https://www.facebook.com/AnantCorp/

Signal r azurepresentationJustin Wendlandt

This document discusses implementing real-time web applications using SignalR and Azure Service Bus. It provides an overview of real-time web capabilities, examples using SignalR for forced video switching and real-time deals, and scaling out applications using the publish-subscribe pattern with Azure Service Bus. The document also includes a demonstration of using SignalR with Azure for continuous integration and horizontal scaling.

European SharePoint Conference - TH3Rick Van Rousselt

This document discusses using containers and the Azure Container Service to extend Office Add-ins. It describes how containers provide a lightweight platform to simplify building, shipping, and running apps. Containers use a shipping container system for code, allowing apps to run everywhere without conflicts. The Azure Container Service is optimized for hosting containers at large scale and makes it easy to manage containers. It includes Docker swarm or DC/OS for container orchestration and is open source.

MongoDB World 2018: Using Puppet, Ansible and Ops Manager to Create Your Own ...MongoDB

Using Puppet, Ansible, and Ops Manager, Paychex automated the provisioning of MongoDB databases to address the challenges of a manual process that took 1-2 weeks. Puppet is used for OS configuration and standardization. Ansible is used for orchestration to make API calls to Ops Manager for database provisioning in 15-25 minutes. Ops Manager provides management, automation, monitoring, and backups. Future work includes further integrating backups and restores using Ansible and integrating with additional tools like ServiceNow.

Session Slides from DEVintersection EuropeRick Van Rousselt

My session slides from unityConnect 2016 in HaarlemRick Van Rousselt

When Our Serverless Team Chooses ContainersSam Goldstein

If you’ve come across the many “Serverless vs. Containers” articles that exist you may think that serverless and containers are engaged in an epic battle for dominance of cloud-native architecture. Don’t believe this hype, which is more geared toward driving blog post clicks than describing the actual technical landscape. In fact, Containers and Functions both have serverless use cases and aren’t mutually exclusive. In this talk will dive into serverless container services and when, why, and how our serverless team at Stackery integrates container workloads into our serverless architectures.

Monitor Azure Kubernetes Cluster With Prometheus by Mamta JhaCodeOps Technologies LLP

The Future of Enterprise Applications is ServerlessEficode

AWS for web developersMirumee Software

A brief introduction to Amazon Web Services from a web developer's perspective. You'll find out what EC2, VPC and S3 stand for, you'll also learn the purpose of security groups, resource isolation and why it all matters for your application. This is a part of Mirumee Talks — an engineering meetup that is free for everyone to come and enjoy. We love sharing what we know and what we are currently up to our in the techy trenches. Talk. Share. Learn.

Session Slides from DEVintersection EuropeRick Van Rousselt

Netflix s2e1lightningtalkaspyker

IBM has worked to port Netflix's open source Scalable Services Fabric framework to run on IBM's cloud infrastructure. This includes making Netflix services and microservice runtimes compatible with IBM SoftLayer IaaS and WebSphere Liberty application server. IBM ensured these services could be deployed across multiple IBM datacenters for high availability and automatic failure recovery. IBM also adopted Netflix's chaos testing and continuous delivery practices to validate cloud-native readiness. Going forward, IBM aims to offer the Scalable Services Fabric both as a Software as a Service and for on-premise use.

Modern application delivery with ConsulMitchell Pronschinske

CREATING REAL TIME DASHBOARD WITH BLAZOR, AZURE FUNCTION COSMOS DB AN AZURE S...CodeOps Technologies LLP

Sustainable software development / Jätkusuutlik tarkvaraarendusGreteStrandberg

From AIX to Zero-ops by Pierre BailletThe Incredible Automation Day

This document summarizes the journey of servers from the early mechanical computers of the 1600s to modern serverless architectures. It discusses the evolution of technologies like virtualization, cloud computing, and serverless that have shifted how infrastructure is managed. Companies have adopted these new technologies to reduce costs, earn more money by disrupting industries, and transform digitally to adapt. The document traces how developers and operations teams have seen their roles change and responsibilities shift over time as technologies advanced from owning physical hardware to utilizing fully managed serverless platforms.

Zero Latency: Building a Telemetry Platform on the Elastic StackElasticsearch

Building Cloud-agnostic Serverless APIsPostman

The serverless movement represents a paradigm shift in our ability to create impressive, scalable web applications and services. Redesigning how triggers can generate and execute events can be an extremely cost-effective solution for microservices and large projects alike. Why serverless? It's less complex, scales easily, and usually costs less. The challenge today is that you may be creating these functions specific to a cloud vendor's API gateway, rather than creating the functions that are most reliable and useful. In this session, you will learn how to create a cloud-agnostic serverless execution backend for your APIs. We will show you how to use Postman APIs with Nimbella’s tooling so you have cloud-agnostic runtime environment that can run in any cloud, including private infrastructure when required. If you are building scalable web applications that you want to deploy on any cloud or private cloud, this is a must-attend session.

FMEWT17 Getting Satrted FME 2017 (Ken)gespsrl

This document provides an overview of new features in FME 2017 including improved connectivity to more formats and web services, more powerful transformations for working with dates and times, enhancements to the data inspector and FME Server, and updates to FME Cloud pricing and capabilities. Key highlights include Active Directory support for FME Server user management, new options for handling failed jobs, and increased compute units and RAM for all FME Cloud instance types.

Migrating .NET and .NET Core to Pivotal Cloud Foundry (1/2)VMware Tanzu

This document discusses Capgemini's DevOps platform and solutions for addressing common industry challenges. It outlines tools and technologies like Pivotal Cloud Foundry, Spring, Kubernetes, and AWS that provide benefits such as instant provisioning, continuous integration and delivery, automation, self-healing applications, and independent platform upgrades without downtime. Contact information is provided for Capgemini executives to discuss these DevOps solutions.

Keynote TIAD Camp ServerlessThe Incredible Automation Day

This document provides an overview and agenda for the TIAD Camp Serverless event. The summary is: The document outlines the agenda for the TIAD Camp Serverless event, which includes sessions on serverless architectures using AWS Lambda, Google Cloud Functions, and Azure Functions. There will be bootcamps demonstrating how to build serverless APIs as well as discussions on serverless analytics, data pipelines, dynamic cloud architectures and operational challenges with serverless. The event aims to educate attendees on serverless concepts and tools across various cloud platforms.

Leveraging Akamai to Make Your Cloud Transformation Initiatives SuccessfulAkamai Developers & Admins

So you're in the Cloud — but what does that mean? With choices like multi-region, multi-Cloud, hybrid and mixed environments, there's no "one size fits all" when it comes to Cloud. But whatever your choice, Akamai can help you with your Cloud infrastructure before, during and after your Cloud transformation. In this session, Akamai and Rackspace will explore and showcase common Cloud transformations: (1) typical ordering and fulfillment apps transformation from an on-premise, dedicated DC to the Cloud using Amazon AWS (2) similar transformation using Microsoft Azure (3) multi-Cloud environments across AWS, Azure, GCP (Google Cloud Platform), Rackspace and dedicated hosting. For each use case, we'll illustrate how Akamai can help you achieve your business needs of availability, scalability, security, cost and user-experience while you can focus on your core business goals.

NodeTime Tool Reviewgs289509

NodeTime is an analytics tool that provides performance profiling, monitoring, and anomaly alerts for Node.js applications. It monitors performance and resources as well as Redis and MongoDB databases. NodeTime is easy to install with a single NPM command and requires just three lines of code to integrate. It provides real-time analysis through a web interface and can quickly alert developers to performance issues. However, it is an expensive tool and may have limited compatibility with some databases.

An experiment in agile threat modellingDevSecCon

The document discusses code-driven threat modeling using ThreatSpec. It describes how ThreatSpec can be used to specify threats and mitigations directly in code comments. Developers write ThreatSpec as they develop code and tests. Security reviews then analyze generated reports and data flow diagrams to ensure threats are properly mitigated. Code-driven threat modeling allows development and security teams to work together and keep the threat model and code in sync. While improvements are still needed, this approach has potential benefits over traditional threat modeling methods.

Public and private cloud metadata and why it is usefulDevSecCon

The document discusses how metadata and dynamic inventories in Ansible can help DevOps and security teams work together. It provides examples of how metadata tags in cloud environments can be used to filter servers and automate tasks like provisioning, patching, software installation based on server roles, owners, or open vulnerabilities. Integrating security scanning into continuous delivery pipelines is also mentioned as an area where DevOps and security processes can be aligned.

Using Excel in project managementLong Hoàng

More Related Content

What's hot (19)

Session Slides from DEVintersection EuropeRick Van Rousselt

My session slides from unityConnect 2016 in HaarlemRick Van Rousselt

When Our Serverless Team Chooses ContainersSam Goldstein

Monitor Azure Kubernetes Cluster With Prometheus by Mamta JhaCodeOps Technologies LLP

The Future of Enterprise Applications is ServerlessEficode

AWS for web developersMirumee Software

Session Slides from DEVintersection EuropeRick Van Rousselt

Netflix s2e1lightningtalkaspyker

Modern application delivery with ConsulMitchell Pronschinske

CREATING REAL TIME DASHBOARD WITH BLAZOR, AZURE FUNCTION COSMOS DB AN AZURE S...CodeOps Technologies LLP

Sustainable software development / Jätkusuutlik tarkvaraarendusGreteStrandberg

From AIX to Zero-ops by Pierre BailletThe Incredible Automation Day

Zero Latency: Building a Telemetry Platform on the Elastic StackElasticsearch

Building Cloud-agnostic Serverless APIsPostman

FMEWT17 Getting Satrted FME 2017 (Ken)gespsrl

Migrating .NET and .NET Core to Pivotal Cloud Foundry (1/2)VMware Tanzu

Keynote TIAD Camp ServerlessThe Incredible Automation Day

Leveraging Akamai to Make Your Cloud Transformation Initiatives SuccessfulAkamai Developers & Admins

NodeTime Tool Reviewgs289509

Session Slides from DEVintersection EuropeRick Van Rousselt

My session slides from unityConnect 2016 in HaarlemRick Van Rousselt

When Our Serverless Team Chooses ContainersSam Goldstein

Monitor Azure Kubernetes Cluster With Prometheus by Mamta JhaCodeOps Technologies LLP

The Future of Enterprise Applications is ServerlessEficode

AWS for web developersMirumee Software

Session Slides from DEVintersection EuropeRick Van Rousselt

Netflix s2e1lightningtalkaspyker

Modern application delivery with ConsulMitchell Pronschinske

CREATING REAL TIME DASHBOARD WITH BLAZOR, AZURE FUNCTION COSMOS DB AN AZURE S...CodeOps Technologies LLP

Sustainable software development / Jätkusuutlik tarkvaraarendusGreteStrandberg

From AIX to Zero-ops by Pierre BailletThe Incredible Automation Day

Zero Latency: Building a Telemetry Platform on the Elastic StackElasticsearch

Building Cloud-agnostic Serverless APIsPostman

FMEWT17 Getting Satrted FME 2017 (Ken)gespsrl

Migrating .NET and .NET Core to Pivotal Cloud Foundry (1/2)VMware Tanzu

Keynote TIAD Camp ServerlessThe Incredible Automation Day

Leveraging Akamai to Make Your Cloud Transformation Initiatives SuccessfulAkamai Developers & Admins

NodeTime Tool Reviewgs289509

Viewers also liked (10)

An experiment in agile threat modellingDevSecCon

Public and private cloud metadata and why it is usefulDevSecCon

Using Excel in project managementLong Hoàng

DevSecCon Asia 2017: Guillaume Dedrie: A trip through the securitiy of devops...DevSecCon

1. Ansible allows running automated tasks on remote servers using SSH, but running shell scripts introduces security risks if the Ansible controller is compromised. 2. Vagrant and Packer help create and distribute virtual machine images but early versions had security issues like hardcoding HTTP downloads and lack of signed checksums. Standards have improved but offline usage remains important. 3. Working offline can significantly speed up development workflows by avoiding network latency and issues, through techniques like freezing dependencies, caching packages locally, and disabling online repositories.

Tao of security scienceDevSecCon

This document discusses applying the principles of Taoism to DevSecOps. It defines Tao as the natural order of the universe that is difficult to grasp but easy to see. Examples are provided of how nature and aging occur naturally without hurrying. The document advocates taking a soft, non-interfering approach to security like water, which can overcome what is strong. It promotes applying the scientific method to security questions to generate testable hypotheses and analyze real data. Specific examples are given around password policies and patching frequencies. The document concludes by encouraging using models to help others improve and staying on the main road of innovation instead of fearing straying from it.

Stephen Sadowski - Securely automating infrastructure in the cloudDevSecCon

This document summarizes Stephen Sadowski's presentation on securely automating infrastructure in the cloud. It discusses the tools and processes they used, including Terraform for infrastructure as code, Chef for configuration management, GitLab for source control and access management, Jenkins for continuous integration/delivery, ELK for logging, Sensu for monitoring, and PagerDuty for alerting. It emphasizes treating infrastructure like code, minimum necessary access, and ensuring security is built into processes from the beginning through techniques like encryption, access control lists, and compliance testing.

Alfredo Reino - Monitoring aws and azureDevSecCon

This document provides an overview of monitoring Azure and AWS cloud environments. It discusses why monitoring is important for threat detection, hunting and response. It outlines what aspects should be monitored, including operating systems, applications, network traffic, and cloud service logs. Specific AWS and Azure monitoring options are described, such as CloudTrail, VPC Flow Logs, and Azure Audit Logs. Integrating cloud logs with SIEMs and threat intelligence feeds is also covered. Endpoint monitoring tools are suggested to record process, file, registry and network activity on virtual machines.

Simon Bennetts - Automating ZAP DevSecCon

The document provides information about automating scans using the OWASP ZAP security tool. It discusses getting started with the baseline scan, options for full scans including the command line, Jenkins plugin, and API. It also covers exploring targets using the spider, performing passive and active scans, generating reports, and authenticating. The workshop aims to demonstrate how to integrate ZAP into development pipelines to find security issues early.

Renato Rodrigues - Security in the wildDevSecCon

The document discusses security in software development. It outlines the typical software development life cycle of requirements, design, code, test, and deployment phases. For each phase, it notes that security is usually an afterthought rather than being integrated into the process from the beginning. It encourages improving security perceptions, work, and practices at each stage of development. The presenter is Renato Rodrigues, who wants to continue the security conversation on social media.

DevSecCon Asia 2017 - Abhay Bhargav: Building an Application Vulnerability To...DevSecCon

The document discusses building an application vulnerability toolchain for SecDevOps. It advocates leveraging existing security tools like SAST and DAST scanners through automation to reuse human effort. The author describes their process of identifying how to test applications based on factors like the stack and platform. They also discuss instrumenting and testing REST APIs, building custom automation, correlating data from multiple scans and tools in a NoSQL database, and using tools like Docker, Selenium and OWASP ZAP through their APIs.

An experiment in agile threat modellingDevSecCon

Public and private cloud metadata and why it is usefulDevSecCon

Using Excel in project managementLong Hoàng

DevSecCon Asia 2017: Guillaume Dedrie: A trip through the securitiy of devops...DevSecCon

Tao of security scienceDevSecCon

Stephen Sadowski - Securely automating infrastructure in the cloudDevSecCon

Alfredo Reino - Monitoring aws and azureDevSecCon

Simon Bennetts - Automating ZAP DevSecCon

Renato Rodrigues - Security in the wildDevSecCon

DevSecCon Asia 2017 - Abhay Bhargav: Building an Application Vulnerability To...DevSecCon

Similar to Public and private cloud metadata and why it is useful (20)

Netflix MSA and PivotalVMware Tanzu Korea

Five Ways to Fix Your SQL Server Dev-Test Problems Catalogic Software

Rapidly provisioning fresh copies of SQL databases is required for an effective Dev-Test environment. However, it can be challenging and most organizations take weeks to deliver usable data. Catalogic’s copy data management platform allows for timely, space-efficient, masked SQL DB copies. By doing so, Catalogic satisfies both infrastructure DBAs, who need automated copy provisioning, and application DBAs, who continually need fresh, secure data sets. This webinar will describe five ways Catalogic can help fix SQL Server Dev-Test problems.

Getting to Walk with DevOpsEklove Mohan

Back To Basicskamalikamj

This document provides an introduction to DevOps concepts including continuous integration, continuous delivery, infrastructure as code, and configuration management. It discusses the need for DevOps to improve processes like manual setups, lack of change tracking, and long release cycles. Key DevOps practices include infrastructure as code, configuration management, continuous integration, and continuous delivery. The document demonstrates a continuous delivery pipeline using Gocd.

Slides: How to Select a PaaSAltoros

Dev ops using JenkinsSynergetics Learning and Cloud Consulting

Continuous delivery is the process of automating the deployment of code changes to production. It involves building, testing, and deploying code changes through successive environments like integration, testing, and production. Continuous integration starts the process by automatically building and testing code changes. The release pipeline then automates deploying through environments. This finds issues early and allows for rapid deployment of code changes to production through automated testing and infrastructure provisioning.

Moving to microservices – a technology and organisation transformational journeyBoyan Dimitrov

Moving to microservices was a transformational journey for the company as their system grew rapidly. They started with a monolithic architecture which became difficult to maintain and scale. This led them to redesign their system using microservices built with Go running on AWS (Amazon Web Services). They developed core platform capabilities to support automated provisioning, routing, discovery, monitoring and more. This allowed them to deploy new services rapidly and operate their distributed system more efficiently. The transition required changes to both their technology and organizational culture.

56k.cloud trainingBrian Christner

This document provides an overview of Docker and cloud native training presented by Brian Christner of 56K.Cloud. It includes an agenda for Docker labs, common IT struggles Docker can address, and 56K.Cloud's consulting and training services. It discusses concepts like containers, microservices, DevOps, infrastructure as code, and cloud migration. It also includes sections on Docker architecture, networking, volumes, logging, and monitoring tools. Case studies and examples are provided to demonstrate how Docker delivers speed, agility, and cost savings for application development.

Enabling your DevOps culture with AWS-webinarAaron Walker

In this presentation shows you how the benefits of AWS technologies can be combined with a new approach to Development and Operations. It’s all about delivering new features and functionality faster, without compromising reliability, stability and performance. * Understand the challenges faced by traditional Development and Operations teams * Apply Continuous Integration/Delivery processes and tools to enable change * Appreciate how various AWS technologies can be used to facilitate DevOps

Machine Learning Platform in LINE FukuokaLINE Corporation

Data Labs supports LINE services by performing high-level data analysis and machine learning model development using their Hadoop data lake. The machine learning lifecycle involves many steps beyond just model training, including data collection, preprocessing, deployment, and monitoring. LINE's platform provides the necessary infrastructure to efficiently perform each step of the lifecycle, allowing for rapid continuous development and experimentation through tools like HDFS, Kubernetes, Jupyter notebooks, and CI/CD pipelines.

Azure Functions Real World Examples Yochay Kiriaty

Bodywork - GitOps for Machine LearningAlex Ioannides

The document discusses continuous deployment for machine learning projects using Bodywork. Bodywork enables CI/CD for ML projects by allowing teams to define workflows in a Git repository that can deploy models, pipelines, and services to Kubernetes. It tackles common deployment challenges for ML like managing container images and infrastructure, and allows teams to focus on their code. The talk includes demos of sample ML projects deployed with Bodywork, like serving a model with a REST API and a train-and-serve pipeline.

DevOps Engineer Training course onlinepraveena03290906

DevOps -Engineer-Training-Online-Coursespraveena03290906

DevOps-Engineer-Training-Courses -Onlinepraveena03290906

Devops -Engineer-Training-Courses-Onlinepraveena03290906

Business and IT agility through DevOps and microservice architecture powered ...Lucas Jellema

IT needs to run in production in order to generate business value. DevOps is among other things a way of thinking focusing on production software. A business application requires a tailor made platform to generate business value. The combination of application and its platform is a DevOps product. The DevOps team has full responsibility for that product through its entire lifecycle. The microservices architecture promises flexibility, scalability, and optimal use of compute resources. Via independent components with well-defined scope and responsibility, interface, and ownership that are evolved and managed in an automated DevOps process, this architecture leverages current technologies and hard-learned insights from past decades. This session defines the objectives of Business with IT, of microservices and DevOps and introduces Containers and the container platform Kubernetes as crucial ingredients for making DevOps happen.

Neo4j for Cloud Management at ScaleNeo4j

Cloud system configurations and their dependencies can quickly grow into the thousands of virtual machine, network and storage components. Once software is included, the number of components can easily rise into six figures. Frequent releases using continuous integration and deployment tools makes a repository of these components and relationships absolutely critical to cloud system integrity and quality of service no matter what cloud management tools you use. Systems configurations are more naturally represented using a graph database than the relational representations used by traditional IT management products. Our talk will explore how we use Neo4J to create a live, active, self-updating repository service, containing nearly all virtual hardware, network and software components and their dependencies, enabling continuous deployment in any cloud environment at scale.

Application Delivery PatternsShiva Narayanaswamy

This document discusses application delivery patterns used by REA. It begins with an agenda and mission statement. It then provides examples of "Hello World" programs in various languages. It discusses development and delivery lifecycles, including the use of pipelines. It describes characteristics of good pipelines and pipeline design considerations. It outlines REA's journey with application delivery on AWS and lessons learned, including the use of multiple accounts and decoupling deployment tools from applications. Key recommendations include deploying fully resolved artifacts, keeping metrics, and giving deployment teams response powers.

451 Research: Data Is the Key to Friction in DevOpsDelphix

- The document discusses how data friction impacts DevOps initiatives and the benefits of using Delphix to remove data friction. - It provides an overview of 451 Research findings that most organizations deploy code changes daily and have large, complex application changes. This puts pressure on development teams to access production-like data for testing. - Choice Hotels' journey is presented as a case study where they implemented Delphix to automate provisioning of test databases from production data. This allowed developers faster access to fresh data for testing and removed bottlenecks in their testing cycles. - The key benefits of Delphix are that it provides instant access to production-like data for various teams while ensuring data is secure and compliant through

Netflix MSA and PivotalVMware Tanzu Korea

Five Ways to Fix Your SQL Server Dev-Test Problems Catalogic Software

Getting to Walk with DevOpsEklove Mohan

Back To Basicskamalikamj

Slides: How to Select a PaaSAltoros

Dev ops using JenkinsSynergetics Learning and Cloud Consulting

Moving to microservices – a technology and organisation transformational journeyBoyan Dimitrov

56k.cloud trainingBrian Christner

Enabling your DevOps culture with AWS-webinarAaron Walker

Machine Learning Platform in LINE FukuokaLINE Corporation

Azure Functions Real World Examples Yochay Kiriaty

Bodywork - GitOps for Machine LearningAlex Ioannides

DevOps Engineer Training course onlinepraveena03290906

DevOps -Engineer-Training-Online-Coursespraveena03290906

DevOps-Engineer-Training-Courses -Onlinepraveena03290906

Devops -Engineer-Training-Courses-Onlinepraveena03290906

Business and IT agility through DevOps and microservice architecture powered ...Lucas Jellema

Neo4j for Cloud Management at ScaleNeo4j

Application Delivery PatternsShiva Narayanaswamy

451 Research: Data Is the Key to Friction in DevOpsDelphix

More from DevSecCon (20)

DevSecCon London 2019: Workshop: Cloud Agnostic Security Testing with Scout S...DevSecCon

Xavier Garceau-Aranda Senior Security Consultant at NCC Group With the steady rise of cloud adoption, a number of organizations find themselves splitting their resources between multiple cloud providers. While the readiness to deal with security in cloud native environments has been improving, the multi-cloud paradigm poses new challenges. The workshop will aim to familiarize attendees with Scout Suite (https://github.com/nccgroup/ScoutSuite), a key component of NCC Group’s cloud agnostic approach to security assurance. Scout Suite is an open source multi-cloud security-auditing tool, which enables security posture assessment of cloud environments. Using the APIs exposed by cloud providers, Scout Suite gathers configuration data for manual inspection and highlights risk areas. Rather than pouring through dozens of pages on the web consoles, Scout Suite provides a clear view of the attack surface automatically. The following cloud providers are currently supported: - Amazon Web Services - Microsoft Azure - Google Cloud Platform - Oracle Cloud Infrastructure - Alibaba Cloud During the workshop, attendees will leverage Scout Suite to assess a number of cloud environments designed to simulate typical flaws. We will display how the tool can be leveraged to quickly identify and help with remediation of security misconfigurations.

DevSecCon London 2019: Are Open Source Developers Security’s New Front Line?DevSecCon

Mitun Zavery Senior Engineer at Sonatype Bad actors have recognized the power of open source and are now beginning to create their own attack opportunities. This new form of assault, where OSS project credentials are compromised and malicious code is intentionally injected into open source libraries, allows hackers to poison the well. In this session, Mitun will explain how both security and developers must work together to stop this trend. Or, risk losing the entire open source ecosystem. Analyze, and detail, the events leading to today’s “all-out” attack on the OSS industry Define what the future of open source looks like in today’s new normal Outline how developers can step into the role of security, to protect themselves, and the millions of people depending on them

DevSecCon London 2019: How to Secure OpenShift Environments and What Happens ...DevSecCon

Jan Harrie Security Analyst at ERNW GmbH OpenShift by Red Hat is one of the major Platform as a Service (PaaS) solutions on the market. It is used to automatically deploy Kubernetes clusters and provides useful extensions for cluster management mixed with some magic under the hood. Instantiating a Kubernetes cluster is often a crucial step in setting up a modern application stack. But be aware – a lot of configuration parameters are awaiting you. And here several misconfigurations may occur that can lead up to a compromise of the cluster. Privileged containers, tainting of masters and executing workloads on them, missing role-based access controls, and misconfigured Service Accounts are part of the problem. In this talk, I will explain which configuration parameters of an OpenShift environment are critical to ensure the overall security of the deployed Kubernetes clusters. Implications of misconfigurations will be demonstrated during live demos. Finally, recommendations for a secure configuration are provided.

DevSecCon London 2019: A Kernel of Truth: Intrusion Detection and Attestation...DevSecCon

Matt Carroll Infrastructure Security Engineer at Yelp "Attestation is hard" is something you might hear from security researchers tracking nation states and APTs, but it's actually pretty true for most network-connected systems! Modern deployment methodologies mean that disparate teams create workloads for shared worker-hosts (ranging from Jenkins to Kubernetes and all the other orchestrators and CI tools in-between), meaning that at any given moment your hosts could be running any one of a number of services, connecting to who-knows-what on the internet. So when your network-based intrusion detection system (IDS) opaquely declares that one of these machines has made an "anomalous" network connection, how do you even determine if it's business as usual? Sure you can log on to the host to try and figure it out, but (in case you hadn't noticed) computers are pretty fast these days, and once the connection is closed it might as well not have happened... Assuming it wasn't actually a reverse shell... At Yelp we turned to the Linux kernel to tell us whodunit! Utilizing the Linux kernel's eBPF subsystem - an in-kernel VM with syscall hooking capabilities - we're able to aggregate metadata about the calling process tree for any internet-bound TCP connection by filtering IPs and ports in-kernel and enriching with process tree information in userland. The result is "pidtree-bcc": a supplementary IDS. Now whenever there's an alert for a suspicious connection, we just search for it in our SIEM (spoiler alert: it's nearly always an engineer doing something "innovative")! And the cherry on top? It's stupid fast with negligible overhead, creating a much higher signal-to-noise ratio than the kernels firehose-like audit subsystems. This talk will look at how you can tune the signal-to-noise ratio of your IDS by making it reflect your business logic and common usage patterns, get more work done by reducing MTTR for false positives, use eBPF and the kernel to do all the hard work for you, accidentally load test your new IDS by not filtering all RFC-1918 addresses, and abuse Docker to get to production ASAP! As well as looking at some of the technologies that the kernel puts at your disposal, this talk will also tell pidtree-bcc's road from hackathon project to production system and how focus on demonstrating business value early on allowed the organization to give us buy-in to build and deploy a brand new project from scratch.

DevSecCon Seattle 2019: Containerizing IT Security KnowledgeDevSecCon

Kristóf Tóth Software Engineer at Avatao The world is getting eaten alive by software. At this point, almost nothing can be done without interacting with some sort of software system. Not even buying your groceries. As we keep dumping out huge piles of code like there is no tomorrow, our far from perfect systems keep getting worse and worse from a security standpoint. What could possibly go wrong? We believe that education is the missing link. As appsec is still a curiosity topic on top universities, freshly graduated engineers simply have no clue. And how could they? The number of programmers keeps on doubling every few years and generations of software professionals are stuck without a proper background in ITSec. As this trend continues, our responsibility to do something about this is on the rise. In hopes of fighting this trend, we, at Avatao, have decided to share some of our dreams with the community. Our Tutorial Framework allows you to easily create interactive learning environments running inside Docker containers. These environments are capable of automatically guiding users through a set of topics by allowing them to interact with real software through a simple web browser. Users can attack webservices, write code to fix them or use a terminal to deploy websites by creating and pushing git tags. Nothing here is a mock-up: Every software component is real. In this talk, I am going to demonstrate the capabilities of the framework, talk about the technology behind it and explore some use cases for it. During the session we will open source the framework with the hope of creating a better, secure future together.

DevSecCon Seattle 2019: Decentralized Authorization - Implementing Fine Grain...DevSecCon

Sitaraman Lakshminarayanan Sr Security Architect at Pure Storage Authorization has two components – Policy Definition and Policy Enforcement. Traditionally both used to be centralized and we spent all the time Integrating products- Built or Bought with Centralized Access Management. This typically led to increased cycle time to change any access policy or change software/deployment to fit into one particular authorization model. When that doesn’t fit, we would end up with multiple authorization enforcements written in different languages with or without any adherence to any standards such as XACML or others. Imagine building few different or hundreds of products or services or micro services and you have to centrally manage all possible access policies. It’s definitely not a scalable solution in fast moving CI/CD world. Now imagine a way where every developers or products can externalize its authorization and we can modify authorization enforcement in a consistent manner? Imagine where developers can write their own implementation of how authorization should be enforced for their environment? Remember there is no one size fits all authorization policy. A policy that works for your environment does not work for my environment – for any number of reasons from Risk management to type of business applications. Open Policy Agent provides a consistent way to write authorization logic and expose it as REST API. Applications can easily integrate with OPA and can also write their own authroziation logics. Whether you are shipping products to customers or integrating a Product or Service into your environment, how awesome it would be to enforce your own authorization rules instead of changing your business process of who can gain access to what features. In this talk we will explore the benefits of Decentralized Authorization and how to use Open Policy Agent to achieve decentralized authorization. A closer look at few applications /integrations whether it is REST API /Micro Services, or Kubernetes to control various authorization policies as to who can deploy/what can you deploy. We will also look at how to build Integration tests to check our authorization policies.

DevSecCon Seattle 2019: Liquid Software as the real solution for the Sec in D...DevSecCon

The document discusses the challenges of delivering software and security fixes to customers. It describes the three phases of identifying vulnerabilities, fixing them, and getting fixes to customers. Getting fixes to customers often takes a long time due to long testing cycles, customers distrusting patches that may introduce bugs, and the challenges of deploying large patches. The document proposes the concept of "Liquid Software" which is continuously updating software with small changes, similar to how water is constantly flowing. This could allow for more frequent updates in smaller chunks to continuously patch vulnerabilities and add features. Various patterns are discussed for implementing continuous updates, such as canary releases, rollback capabilities, zero downtime updates, and automating processes.

DevSecCon Seattle 2019: Fully Automated production deployments with HIPAA/HIT...DevSecCon

Matt Lavin Software Architect at LifeOmic It's possible to have rapid feature delivery and happy developers without sacrificing high security and compliance. At LifeOmic, we've built an automated change management system that allows production deployments without slow human approval. We maintain HIPAA and HITRUST compliance while still allowing continuous delivery. I'll show how to collect data from BitBucket, Jenkins, and security scan tools to ensure that the approved processes have been followed. You'll hear how fast production approval incentivizes developers to follow good practices, and become advocates for following the process instead of pushing against it. Automating process checks as a gate to deployments is a great framework for promoting the behavior you want in your organization. Don't give up on rapid feature delivery just because you work in a regulated industry.

DevSecCon Singapore 2019: Four years of reflection: How (not) to secure Web A...DevSecCon

Julian Berton Preventing a company from becoming the newest data breach statistic can be a daunting prospect. Especially working within a company that employs hundreds of engineers pushing code to production daily, it often feels like everything is on fire and the holy grail of producing a security inspired product is but a dim light growing further and further away. The same feeling is true for security aware engineers being pushed to develop products quickly but also expected to consider quality assurance, operations, security and the reliability of their application or service. To help reduce the bleeding and build more security aware applications at scale, a balance of firefighting, preventative initiatives, automation and "JIT" education is required. So strap yourself in while we take you on a journey through 4 years of security successes and epic failures: * Automation - Implementing a secure-by-default build system (Buildkite) that makes detecting vulnerable dependencies (Snyk), storing secrets (AWS Secrets Manager) and scanning Docker containers, an effortless process. * Prevention - Eradicate several classes of bugs by selecting secure architectural patterns and using automated scripts to detect operational misconfigurations like dangling DNS entries, open S3 buckets, secrets checked into source code and repositories that have been made accidentally public. * "JIT” Education - Changing a companies security culture with RFC's for security standards, security integrated PIR via bug bounty program reports, visibility through security maturity frameworks (BSIMM).

DevSecCon Singapore 2019: crypto jacking: An evolving threat for cloud contai...DevSecCon

Rahul Kumar & Rupali Dash In the current era of blockchain technology, mining crypto currency is one of the biggest hit. The talk covers how the attackers use the insecure containers to mine crypto currency and earn million dollar profits. Cryptojacking activity surged to its peak in December 2017, when more than 8 million cryptojacking events were blocked by many intrusion detection companies. While there have seen a slight fall in activity in 2018, it is still at an elevated level, with total cryptojacking events blocked in July 2018 totalling just less than 5 million. The talk will cover how the mining activities has been done using browsers as well as cloud containers. We will also discuss how the cloud provides like amazon, azure and go are detecting such kind of activities and how minor misconfigurations leads to million dollar currency mining. The talk will also cover how 3rd party security providers like symantec and z-scalar and other intrusion detection system has configured signatures to block such kind of attacks. As well as from a sec-ops prospective what configuration checks should be done to prevent against such kind of attacks as well as detection of attacks. It will also cover some case studies and attack scenarios of mining Monero and the huge financial losses because of this attacks.

DevSecCon Singapore 2019: Can "dev", "sec" and "ops" really coexist in the wi...DevSecCon

Trinh Tran & Dennis Stötzel Are you trying to stay secure while developing and running a bunch of services and applications every day? So are we and it’s a huge pain in the… pipeline. We have been juggling these aspects while working with one of the biggest insurance companies in the world. In this talk, we will share our experiences of the last three years: Trinh, as a software engineer in Vietnam and Dennis, as a security engineer in Germany. We will present our experiences of making "dev", "sec" and "ops" coexist – without sparing any dirty details. Our goal has always been fast delivery and secure applications using pipelines, containers, orchestration, and the cloud. Let us explain which of these goals we have met and which remain goals, where we messed up and where we found glory. We will cover the following topics in our talk: * Evolution of our project, from beginning with four engineers running in one office, to expanding to fifty engineers coming from three continents and different backgrounds, * Development, delivery and security as a requirement in an agile project, * The good, the bad and the ugly in technology, architecture and infrastructure.

DevSecCon Singapore 2019: Workshop - Burp extension writing workshopDevSecCon

Sanoop Thomas & Samandeep Singh Burp suite is the de-facto proxy application for web security testers. This hands-on workshop will explore the different capabilities of burp proxy application, also dive into the extensions and tooling options to perform improved application security test cases. The workshop will start with a quick overview of burp usage, different settings, features, some commonly useful extensions and then explore deep into its extension APIs to build your own custom extensions. We will provide a suitable development environment in Java and Python platforms. This will be a hands-on workshop and participants will learn how to automate different application security test scenarios and build burp extensions with the help of templates.

DevSecCon Singapore 2019: Embracing Security - A changing DevOps landscapeDevSecCon

Cameron Townshend from Sonatype discusses securing software supply chains and the need for DevSecOps. He notes that 52% of Fortune 500 companies from 2000 are no longer around and that businesses are under attack. Townshend advocates treating software development like a manufacturing process by carefully vetting all components for quality and security. He highlights statistics showing the prevalence of vulnerabilities and breaches related to open source components. Townshend argues that organizations must automate security checks and remediation to keep pace with adversaries exploiting vulnerabilities within days.

DevSecCon Singapore 2019: Web Services aren’t as secure as we thinkDevSecCon

Tilak T Web-Services are taking over the world. Rest-framework is accelerating this development, because of its ease and flexibility. Developers often use and develop REST-based applications because it's exciting to work with. But they forget about security which leads to compromised and exploited applications. For instance, in more recent security tests against Web Services that my team executed, we found that vulnerabilities like Insecure Deserialization, XML External Entities, Server-Side Template Injection and Authorization Flaws are quite prevalent. I have found some simple steps that engineering teams can take towards finding and fixing such vulnerabilities with Web Services. This talk is offering a holistic perspective on finding and fixing some uncommon flaws that will be replete with anecdotes and examples of secure and insecure code. I will also delve into automating SAST and DAST tools using Robot-Framework to identify such flaws in Web-Services.

DevSecCon Singapore 2019: An attacker's view of Serverless and GraphQL apps S...DevSecCon

Sharath Kumar Ramadas Serverless Technology (Functions as a Service) is fast becoming the next "big thing" in the world of distributed applications. Organizations are investing a great deal of resources in this technology as a force-multiplier, cost-saver and ops-simplification cure-all. Especially with widespread support from cloud vendors, this technology is going to only become more influential. However, like everything else, Serverless apps are subject to a wide variety of attack possibilities, ranging from attacks against access control tech like JWTs, to NoSQL Injection, to exploits against the apps themselves (deserialization, etc) escalating privileges to other cloud components. On the other hand GraphQL (API Query Language) is the natural companion to serverless apps, where traditional REST APIs are replaced with GraphQL to provide greater flexibility, greater query parameterization and speed. GraphQL is slowly negating the need for REST APIs from being developed. Combined with Serverless tech/Reactive Front-end frameworks, GraphQL is very powerful for distributed apps. However, GraphQL can be abused with a variety of attacks including but not limited to Injection Attacks, Nested Resource Exhaustion attacks, Authorization Flaws among others. This talk presents a red-team perspective of the various ways in which testers can discover and exploit serverless and/or GraphQL driven applications to compromise sensitive information, and gain a deeper foothold into database services, IAM services and other other cloud components. The talk will have some demos that will demonstrate practical attacks and attack possibilities against Serverless and GraphQL applications. The author will release an intentionally vulnerable Serverless and GraphQL app at the end of the talk for the benefit of the audience and the security community at large.

DevSecCon Singapore 2019: The journey of digital transformation through DevSe...DevSecCon

The document discusses Nadira Bajrei's experience implementing DevSecOps practices at Bank Mandiri in Indonesia over several years. It outlines her background in IT governance and DevOps adoption at the bank. The presentation agenda includes discussing the bank's digital transformation roadmap, its DevSecOps journey involving cultural and process changes, and challenges faced in implementing these changes such as overcoming resistance to change and ensuring regulatory compliance.

DevSecCon Singapore 2019: Preventative Security for KubernetesDevSecCon

Liz Rice The latest Kubernetes version provides many security-related enhancements and controls, but it is far from being secure by default. Kubernetes is a complex orchestration platform with many different implementations, across multi-cloud/hybrid environments. Configuring it to comply with security best practices and specific security requires time and expertise that most organizations don’t possess. Aqua’s open source tools arm Kubernetes administrators and developers with an easy way to identify weaknesses in their deployments so that they can address those issues before they are exploited by attackers. During this presentation, we’ll review how these open source tools offer preventive security for Kubernetes: Kube-Bench: checks a Kubernetes cluster against 100+ checks documented in the CIS Kubernetes Benchmark. Kube-Hunter: conducts penetration tests against Kubernetes clusters that hunt for exploitable vulnerabilities and misconfiguration - both from outside the cluster as well as inside it (running as a pod)

DevSecCon London 2018: Is your supply chain your achille's heelDevSecCon

COLIN DOMONEY The advent of DevOps and large scale automation of software construction and delivery has elevated the software supply chain – and its underpinning delivery pipeline – to mission critical status in any modern enterprise. The increased velocity of modern pipelines and the removal of manual checks and balances has meant that modern pipelines are potential single points of failure in the delivery of secure software. Automotive and consumer electronics industries have long understood the need for both provenance (understanding the origin of materials) and veracity (ensuring the integrity of their manufacturing processes) in their supply chains; this presentation will address threats to software supply chains and practical approaches to reducing the fragility of your supply chain. Several examples of software supply chain failures will be presented and deconstructed to understand the typical failure modes. At the most elementary level many pipelines are poorly constructed with low levels of repeatability and poor test coverage, in other organisations there is a lack of governance over the supply chain allowing careless or willingly negligent actors to subvert or bypass controls or testing within the pipeline. There is also no standard mechanism to ensure a ‘chain of custody’ within a pipeline due to a lack common interchange format between tools, or a standard manner to represent the steps within a pipeline build process. This presentation will cover approaches (using ‘people and process’) in enforcing governance within a supply chain by describing best practices used in large-scale AppSec programmes. Several emerging technology initiatives will be presented: Google’s Grafeas is a means to ensure vulnerability information is represented in a uniform manner across all steps of a pipeline process, while In-Toto is a project to formally enforce the integrity of a pipeline process. A reference secure pipeline will be presented demonstrating both tools working in symphony, along with standard open source and commercial AppSec tools. Finally the pipeline itself may become the Achille’s Heel in an organisation – many pipelines are not sufficiently hardened and are themselves open to attack by use of vulnerable components and their extensible nature, often along with very wide open permissions. Guidance will be given on hardening of typical pipelines, and a fully secured ephemeral Jenkins pipeline will be demonstrated. Benefits of this Session: The attendee will gain an increased awareness of the pivotal importance of the software supply chain, and gain an understanding of some common failure modes and weaknesses. Most importantly the attendee will come away with practical guidance on enforcing higher levels of governance on their supply chain without reducing delivery velocity, as well as how to harden the pipeline infrastructure itself.

DevSecCon London 2018: Get rid of these TLS certificatesDevSecCon

Paweł Krawczyk Most network services and daemons now offer TLS transport protection and their managing certificates and TLS configuration for server farms may use more resources than actual configuration of these services. What if you could get rid of all this complexity and replace it by single transport protection protocol, securing all of the traffic between your servers trasparently and with single centralized key and configuration management? This will be a story of a successful implementation of IPSec protocols, largely and undeservedly forgotten in that purpose, for securing a farm of production cloud servers, with configuration centrally managed with Ansible.

DevSecCon London 2018: Open DevSecOpsDevSecCon

PETKO D. PETKOV Thanks to the DevSecOps philosophy a growing number of organisations around the world are ensuring their businesses are set up with the security in mind from the get-go. DevSecOps is taking the world by storm. This talk is about how to introduce DevSecOps in your organisation with ready-made, zero-cost, open source templates accessible to everyone. The talk will introduce the OpenDevSecOps project and show many practical examples of how to easily deploy security testing infrastructure on top of existing and well-established development tools.