How to Avoid Common Pitfalls of Cyber Threat Intelligence
Learn how a requirements-focused approach to cyber threat intelligence can inform, advise, and empower stakeholders within an organization.Calico monthly roundup: July 2023
Welcome to the Calico monthly roundup: July edition! From open source news to live events, we have exciting updates to share—let’s get into it!
Customer case study: Upwork Using Calico, Upwork was able to enforce zero-trust security for its newly migrated containerized applications on Amazon EKS. Read our new case study to find out how. |
Container security – Self-paced workshop This self-paced tutorial is designed to help you prevent, detect, and stop breaches in containers and Kubernetes. Learn how to secure all aspects of your containerized applications—all at your own pace! |
Open source news
- Calico Live – Join the Calico community every Wednesday at 2:00 pm ET for a live discussion about learning how to leverage Calico and Kubernetes for networking and security. We will explore Kubernetes security and policy design, network flow logs and more. Join us live on Linkedin or YouTube.
- CNCF webinar – Watch our CNCF on-demand webinar, Container and Kubernetes security policy design: 10 critical best practices, here.
- Calico eBPF and XDP – Learn how to implement eBPF security policies and XDP to achieve better performance in your Kubernetes cluster. Hands-on lab environment available here.
- Calico Wall of Continue reading
IPv6 Buzz 132: Down The Rabbit Hole Of IPv6 Router Advertisements
In this episode, Ed, Scott, and Tom get technical with a discussion of IPv6 Router Advertisements (RAs), what they are, what they're for, what information they contain, new and future RA options, and what you need to know about them to help deploy IPv6 effectively.
The post IPv6 Buzz 132: Down The Rabbit Hole Of IPv6 Router Advertisements appeared first on Packet Pushers.
IPv6 Buzz 132: Down The Rabbit Hole Of IPv6 Router Advertisements
In this episode, Ed, Scott, and Tom get technical with a discussion of IPv6 Router Advertisements (RAs), what they are, what they're for, what information they contain, new and future RA options, and what you need to know about them to help deploy IPv6 effectively.VXLAN/EVPN – What Are the Challenges in L2-based Networks?
Before diving into a new technology, it is always useful to understand the previous generation of technology, what the limitations where, and how the new technology intends to overcome them. In this post, let’s look at what some of the challenges were with L2-based networks and how VXLAN/EVPN can overcome them. Before starting, I want to balance the messaging a bit on the bad reputation that STP gets:
- Radia Perlman did an excellent job with what was available at that time.
- A lot of the bad reputation comes from a misunderstanding of the protocol.
- STP-based networks can run just fine but they are often misconfigured (related to the point above).
- Many issues come from misbehaving end user devices where protection mechanisms have not been implemented (see the point above).
- It’s natural for technologies to evolve as more compute becomes available and we gain experience.
Keep in mind that the original 802.1D standard was published in 1990. This was long before internet was generally available and our networks were critically important to us. At that time we didn’t measure outages in seconds or even minutes. That said, let’s look at the limitations of a traditional L2 network.
Convergence – In Continue reading
Automated namespace isolation with Calico
Calico has recently introduced a powerful new policy recommendation engine that enables DevOps, SREs, and Kubernetes operators to automatically generate Calico policies to implement namespace isolation and improve the security posture of their clusters.
This new recommendation engine is unique for three reasons:
- Calico’s policy recommendations work continuously in the background over a user-configurable time period. This ensures that less frequent traffic flows are also accounted for in recommended policies.
- Policy recommendations leverage Calico’s policy tiers. Tiers enforce an order of precedence on how Calico policies are evaluated and enforced. The recommended policies are placed in their own tier and Calico ensures each generated rule does not conflict with other policies you have implemented.
- Recommended policies are
StagedNetworkPolicies, allowing admins and operators to audit the behavior of these security policies before actively enforcing them.
In this blog, we’ll dive into each of these areas in more detail and provide an in-depth overview of how policy recommendations work and how it can improve the security posture of your cluster.
Before we get started, let’s quickly talk about namespace isolation and why it’s so important.
Why is namespace isolation important?
Namespaces are a foundational concept within Kubernetes. They help divide your Continue reading
Day Two Cloud 206: Making The Most Of Red Teaming With Gemma Moore
Red teams attack a customer's security systems. The idea of a red team, whether consultants or in-house, is to approach the target like an attacker would. A red team includes technical and human-based exploit and attempts to test defenses, probe for weaknesses, and identify vulnerable systems and processes. On today's episode we look at how to get the most out of a red team engagement--it's much more than just an attack and a report.
The post Day Two Cloud 206: Making The Most Of Red Teaming With Gemma Moore appeared first on Packet Pushers.
Day Two Cloud 206: Making The Most Of Red Teaming With Gemma Moore
Red teams attack a customer's security systems. The idea of a red team, whether consultants or in-house, is to approach the target like an attacker would. A red team includes technical and human-based exploit and attempts to test defenses, probe for weaknesses, and identify vulnerable systems and processes. On today's episode we look at how to get the most out of a red team engagement--it's much more than just an attack and a report.Can We Trust Worldcoin’s Aspirin For AI Headaches?
This post originally appeared in the Packet Pushers’ Human Infrastructure newsletter, a weekly mailing of essays, links to technical blogs and IT news, and whatever else think is interesting. Subscribe for free here. Let’s say I invent an autonomous mobile robot. It can lift heavy items for you, wash your dishes, do your grocery shopping, […]
The post Can We Trust Worldcoin’s Aspirin For AI Headaches? appeared first on Packet Pushers.
Navigating the Connectivity Landscape: Best Practices for Securing Network Architecture
Connectivity is no longer just an enabler. Network architecture must now take security and resilience into account, as well.Navigating the Connectivity Landscape: Best Practices for Securing Network Architecture
Connectivity is no longer just an enabler. Network architecture must now take security and resilience into account, as well.Introducing per hostname TLS settings — security fit to your needs
One of the goals of Cloudflare is to give our customers the necessary knobs to enable security in a way that fits their needs. In the realm of SSL/TLS, we offer two key controls: setting the minimum TLS version, and restricting the list of supported cipher suites. Previously, these settings applied to the entire domain, resulting in an “all or nothing” effect. While having uniform settings across the entire domain is ideal for some users, it sometimes lacks the necessary granularity for those with diverse requirements across their subdomains.
It is for that reason that we’re excited to announce that as of today, customers will be able to set their TLS settings on a per-hostname basis.
The trade-off with using modern protocols
In an ideal world, every domain could be updated to use the most secure and modern protocols without any setbacks. Unfortunately, that's not the case. New standards and protocols require adoption in order to be effective. TLS 1.3 was standardized by the IETF in April 2018. It removed the vulnerable cryptographic algorithms that TLS 1.2 supported and provided a performance boost by requiring only one roundtrip, as opposed to two. For a user to benefit from Continue reading