Talk Transcript: How Cloudflare Thinks About Security

Talk Transcript: How Cloudflare Thinks About Security
Image courtesy of Unbabel
Talk Transcript: How Cloudflare Thinks About Security

This is the text I used for a talk at artificial intelligence powered translation platform, Unbabel, in Lisbon on September 25, 2019.

Bom dia. Eu sou John Graham-Cumming o CTO do Cloudflare. E agora eu vou falar em inglês.

Thanks for inviting me to talk about Cloudflare and how we think about security. I’m about to move to Portugal permanently so I hope I’ll be able to do this talk in Portuguese in a few months.

I know that most of you don’t have English as a first language so I’m going to speak a little more deliberately than usual. And I’ll make the text of this talk available for you to read.

But there are no slides today.

I’m going to talk about how Cloudflare thinks about internal security, how we protect ourselves and how we secure our day to day work. This isn’t a talk about Cloudflare’s products.

Culture

Let’s begin with culture.

Many companies have culture statements. I think almost 100% of these are pure nonsense. Culture is how you act every day, not words written in the wall.

One significant piece of company culture is the internal Security Incident mailing list Continue reading

The Cost of Disruptiveness and Guerrilla Marketing

A Docker networking rant coming from my good friend Marko Milivojević triggered a severe case of Deja-Moo, resulting in a flood of unpleasant memories caused by too-successful “disruptive” IT vendors.

Before moving on, please note that the following observations were made from my outsider perspective. If I got something badly wrong, please correct me in a comment.

Imagine you’re working for a startup creating a cool new product in the IT infrastructure space (if you have an oversized ego you would call yourself “disruptive thought leader” on your LinkedIn profile) but nobody is taking you seriously. How about some guerrilla warfare: advertising your product to people who hate the IT operations (today we’d call that Shadow IT).

Read more ...

MACsec over WAN

MACsec is an interesting alternative to existing tunneling solutions, that protects Layer 2 by performing integrity, origin authentication and, optionally, encryption. Normal use-case is to use MACsec between hosts and access switches, between two hosts or between two switches. This article is a leftover from MACsec on Linux that I first tested in 2016 when support for MACsec was just included in the kernel. I will describe how MACsec is used together with a Layer 2 GRE tunnel to protect the traffic between two remote sites, over WAN or Internet, like a site-to-site VPN at Layer 2.

Money Moves: September 2019

Datadog Barks Back to Cisco’s $7B Offer, Fetches $648M in IPO: GitLab Inhales $268M Series E,...

Read More »

© SDxCentral, LLC. Use of this feed is limited to personal, non-commercial use and is governed by SDxCentral's Terms of Use (https://www.sdxcentral.com/legal/terms-of-service/). Publishing this feed for public or commercial use and/or misrepresentation by a third party is prohibited.

The Journey to Security Automation

Ansible-Blog_Journey-to-Security-Automation

 

Whether you’re a security professional looking at automation for the first time, or an ITops veteran tasked to support corporate secops teams, the following blog provides an overview of how Red Hat Ansible Automation can support your security automation program throughout all the different stages of its evolution.

 

Security Automation: A maturity model

Automation is becoming more and more pervasive across the entire IT stack. 

Initially introduced to support ITOps, automation has been a well-established practice for years.

Today, thanks to modern automation platforms like Red Hat Ansible Automation, IT organizations are more capable of coping with the unprecedented scale, and complexity of modern infrastructures and finally have access to a level of flexibility that allows for extending automation practices to entirely new areas.

As an example, Ansible Network Automation enabled network operators to be the next group approaching automation in a structured fashion, to help simplify both maintenance and operations of their ever-growing, multi-vendor, brownfield infrastructures.

The security space started looking at automation in relatively recent times to support the already overwhelmed security teams against modern cyberattacks that are reaching an unparalleled level of speed and intricacy.

In fact, if we factor in the aforementioned scale Continue reading

Top Questions Answered: Docker and Kubernetes? I Thought You Were Competitors!

Last week, we covered some of the questions about container infrastructure from our recent webinar “Demystifying VMs, Containers, and Kubernetes in the Hybrid Cloud Era.” This week, we’ll tackle the questions about Kubernetes, Docker and the software supply chain. One common misperception that we heard in the webinar — that Docker and Kubernetes are competitors. In fact, Kubernetes is better with Docker. And Docker is better with Kubernetes.

Docker And Kubernetes? I thought you were competitors?

We hear questions along this line all the time. Here are some quick answers:

Can I use Kubernetes with Docker?

  • Yes, they go together. You need a container runtime like Docker Engine (based on open source containerd) to start and stop containers on a host.
  • When you have a bunch of containers running across a bunch of hosts, you need an orchestrator to manage things like: Where will the next container start? How do you make a container highly available? How do you control which containers can communicate with other containers? That’s where an orchestrator such as Kubernetes comes in.
Comparing traditional, virtualized, containerized and Kubernetes deployment architectures.
  • The container runtime and the orchestrator are the two core atomic units that Continue reading

The Week in Internet News: Governments Pressure Facebook to Halt Encryption Plans

Anti-encryption demands: Government officials from the U.S., U.K., and Australia have asked Facebook to put a hold on its plans to expand encryption on services like Messenger, CNet reports. “We are writing to request that Facebook does not proceed with its plan to implement end-to-end encryption across its messaging services without ensuring that there is no reduction to user safety and without including a means for lawful access to the content of communications to protect our citizens,” says a letter signed by U.S. Attorney General William Barr and other officials.

This law is not fake: A new fake news law in Singapore has taken effect, SPDP Radio says. The law includes penalties of up to US $60,000 and 10 years in prison for people found guilty of spreading what the government considers to be fake news. Web sites could face fines of more than $720,000 for not taking down so-called fake news after being ordered to do so. Free speech advocates have major problems with the law, as you might expect.

The lines are cut: Internet access in most of Iraq was shut down after violent protest in the country, CNet says. Some people were Continue reading

ONUG, MEF Want to Clarify SD-WAN Decisions

The partnership is focused on ensuring that SD-WAN vendors are developing products that meet the...

Read More »

© SDxCentral, LLC. Use of this feed is limited to personal, non-commercial use and is governed by SDxCentral's Terms of Use (https://www.sdxcentral.com/legal/terms-of-service/). Publishing this feed for public or commercial use and/or misrepresentation by a third party is prohibited.

Tech Bytes: MidSouth Bank Invests In Network Performance, Visibility With Silver Peak SD-WAN (Sponsored)

On today's sponsored Tech Bytes episode we talk with MidSouth Bank CIO Daniel Hereford about how he's using SD-WAN from Silver Peak to support the bank's transformation to a hybrid cloud model, while also improving network visibility and performance for mission-critical applications.

The post Tech Bytes: MidSouth Bank Invests In Network Performance, Visibility With Silver Peak SD-WAN (Sponsored) appeared first on Packet Pushers.

Vodafone Embraces OpenRAN on Home Turf

Vodafone, an early proponent of the Telecom Infra Project’s OpenRAN initiative, says it started...

Read More »

© SDxCentral, LLC. Use of this feed is limited to personal, non-commercial use and is governed by SDxCentral's Terms of Use (https://www.sdxcentral.com/legal/terms-of-service/). Publishing this feed for public or commercial use and/or misrepresentation by a third party is prohibited.

Transform Your Career: Attend Open Source Summit + Embedded Linux Conference Europe

Register now for Attend Open Source Summit + Embedded Linux Conference Europe held October 28 - 30,...

Read More »

© SDxCentral, LLC. Use of this feed is limited to personal, non-commercial use and is governed by SDxCentral's Terms of Use (https://www.sdxcentral.com/legal/terms-of-service/). Publishing this feed for public or commercial use and/or misrepresentation by a third party is prohibited.

Verizon and NEC Infuse AI Into Deployed Fiber

The technology cocktail can support smart city initiatives without having to rip up streets to...

Read More »

© SDxCentral, LLC. Use of this feed is limited to personal, non-commercial use and is governed by SDxCentral's Terms of Use (https://www.sdxcentral.com/legal/terms-of-service/). Publishing this feed for public or commercial use and/or misrepresentation by a third party is prohibited.

Network Break 255: Adtran Gets Into SD-WAN; Google Preps Chrome To Block HTTP Mixed With HTTPS

Today's Network Break analyzes Adtran's entry into the SD-WAN market, a new IBN product from Lumina Networks, the latest software upgrade from NTOP, Google's timeline for blocking HTTP elements in HTTPS sessions in Chrome, plus a couple of detailed follow-ups, and a Tech Bytes show.

The post Network Break 255: Adtran Gets Into SD-WAN; Google Preps Chrome To Block HTTP Mixed With HTTPS appeared first on Packet Pushers.

150 successful machine learning models: 6 lessons learned at Booking.com

150 successful machine learning models: 6 lessons learned at Booking.com Bernadi et al., KDD’19

Here’s a paper that will reward careful study for many organisations. We’ve previously looked at the deep penetration of machine learning models in the product stacks of leading companies, and also some of the pre-requisites for being successful with it. Today’s paper choice is a wonderful summary of lessons learned integrating around 150 successful customer facing applications of machine learning at Booking.com. Oddly enough given the paper title, the six lessons are never explicitly listed or enumerated in the body of the paper, but they can be inferred from the division into sections. My interpretation of them is as follows:

  1. Projects introducing machine learned models deliver strong business value
  2. Model performance is not the same as business performance
  3. Be clear about the problem you’re trying to solve
  4. Prediction serving latency matters
  5. Get early feedback on model quality
  6. Test the business impact of your models using randomised controlled trials (follows from #2)

There are way more than 6 good pieces of advice contained within the paper though!

We found that driving true business impact is amazingly hard, plus it is difficult to isolate Continue reading

Xilinx unveils open source FPGA platform

The Vitis unified software platform from FPGA vendor Xilinx is the result of five-year project to create software development tools using familiar languages like C++ and Python to develop a wide range of applications for its reprogrammable chip.The beauty of FPGAs (Field Programmable Gate Arrays) is their configurable, adaptable nature. That's also what makes programming them a king-sized challenge. They're difficult to work with for an unskilled programmer who is not well versed in hardware, and they often require esoteric languages.Vitis supports heterogeneous architectures including Xilinx’s Zynq SoCs, MPSoCs, and Versal ACAPs. Vitis is designed to enable highly optimized, domain-specific acceleration to a wide array of applications, from cloud deployments, to machine learning and AI, to IoT and desktop applications. Think of it as being for Xilinx what CUDA is to Nvidia.To read this article in full, please click here

1 … 1,179 1,180 1,181 1,182 1,183 … 3,890