Subdomain Hijacking - Why DevOps is Making Us More Vulnerable
Explore subdomain hijacking vulnerabilities in DevOps practices and learn mitigation strategies to enhance your organization's security posture.
Replacing Privileged Users with Just-in-Time Access Requests
Learn how to implement just-in-time access requests to enhance security and reduce privileged user risks in your organization's infrastructure.
Supply Chain Security for Open Source Projects
Explore supply chain security strategies for open-source projects, enhancing protection against vulnerabilities and ensuring robust software development.
A Better Way to SSH: Introducing SSH Certificates
Discover a superior SSH approach using certificates, enhancing security and simplifying access management for cloud-native environments.
A Centralized Solution for Access Management in DevOps
Explore centralized access management in Kubernetes, focusing on declarative configuration, ClusterProfiles, and policy-driven lifecycle management using Sveltos.
Dynamic Data Masking and Encryption for MySQL/PostgreSQL
Explore dynamic data masking and encryption techniques for MySQL/PostgreSQL databases, focusing on data security, lifecycle management, and Apache ShardingSphere implementation.
Measuring Reliability in Production
Explore techniques for measuring and improving system reliability in production environments, focusing on key metrics and practical strategies.
Securing Software Repositories - APAC Friendly
Explore strategies for securing software repositories, focusing on best practices and tools to protect against vulnerabilities and ensure code integrity.
Under the Radar: How We Found 0-Days in the Build Pipeline of OSS Packages
Explore critical vulnerabilities in OSS build pipelines, including 0-day discoveries in major projects. Learn about attack trees, mitigations, and 'Living Off the Pipeline' components for enhanced security.
SLSA: A Security Paradigm for Software Supply Chain Integrity
Explore SLSA levels, software supply chain security basics, and tools like Cosign to enhance artifact integrity and benefit your organization.
Practical Steps for Securing the Entire SDLC
Practical steps for securing the entire software development lifecycle, moving beyond secure coding to embrace holistic system security throughout the development process.
Navigating the Quantum Readiness Journey: Securing Kubernetes with Quantum-Resistant Cryptography
Explore quantum-resistant cryptography for Kubernetes security. Hands-on insights into mTLS, x.509 certs, and container signing. Learn standardization progress and empower yourself to conduct tailored experiments.
Sigstore: Past, Present and Future Directions
Explore Sigstore's journey, impact on OSS code signing, and future plans. Learn about its adoption by major projects and integration efforts with package managers.
Invisible Infiltration of AI Supply Chains: Protective Measures from Adversarial Actors
Explore protective measures against adversarial actors infiltrating AI supply chains. Learn to secure data, models, and pipelines, implement security controls, and mitigate risks in AI systems.
GRC Engineering - Bringing Governance, Risk, and Compliance to Your Git Repositories
Explore innovative approaches to integrate Governance, Risk, and Compliance directly into git repositories, revolutionizing how organizations handle compliance and security challenges.
Rolling out the C2 - Modern Red Team Infrastructure in 2024
Explore modern red team infrastructure setup using Azure Cloud, Tailscale VPN, GitLab, and containerization. Learn to deploy secure C2 systems for effective penetration testing and security assessments.
Using a Cloud Telescope to Observe Internet-Wide Botnet Propagation Activity
Explore the Cloud Telescope: a global, cloud-native architecture for capturing cybernetic activity. Learn about its design and discover insights from recent experiments on botnet propagation and infection patterns.
One Port to Serve Them All - Google GCP Cloud Shell Abuse
Uncovers security vulnerabilities in GCP Cloud Shell, demonstrating how attackers can exploit a public-facing port to access internal services and bypass authentication, potentially leading to data leaks and network attacks.
Securing Cloud-Native DevOps - A Zero Trust Approach
Explore Zero Trust principles for securing cloud-native DevOps environments, addressing challenges like supply chain attacks and lateral movement in microservices and serverless architectures.
Zero Downtime Credential Rotation - Strategies and Benefits
Learn strategies for safe credential rotation in complex systems without downtime. Explore design techniques to enhance system security and resilience while minimizing disruptions.
Enforceable Supply Chain Security Policy with OPA Gatekeeper and Ratify
Enhance container supply chain security using OPA Gatekeeper and Ratify. Learn to enforce policies, verify images, and establish trust in deployments through practical demonstrations and safeguarding techniques.