Why your security teams are not ready for containers and Kubernetes, and what you can do about it
From a people perspective and an organizational standpoint, many CISOs have said that their security teams are not ready for containers and Kubernetes. This isn’t surprising, given the stark contrast between where we were less than a decade ago and where we are today in terms of systems architecture. I am of course referring to the cloud-native era, which has ushered in a whole new architectural approach.
With Kubernetes at the center asserting its domination, it’s time to start thinking about how we can best prepare security teams for this new era. To do that, let’s look at why they’re struggling in the first place (spoiler alert: it’s because organizations are struggling, too).
Security and organizational structure in the era of cloud-native computing
In the traditional software development and deployment model, things were quite static. We can think of the traditional model as a relay race where the baton was passed from the development team to the platform team to the security team. While this model works well for traditional application architectures, this type of organizational structure is less effective for new architectures for container orchestration and Kubernetes-native applications, where everything is dynamic and highly automated.
But perhaps the most Continue reading
What is a Lifestyle Brand and Does It Make Sense for Your Business?
The term “lifestyle brand” is often used to describe a company or product that is associated with a certain lifestyle or set of values. A lifestyle brand may target a specific demographic, such as millennials, or it may be more broadly appealing.
Some companies embrace the lifestyle brand label while others shy away from it, preferring to focus on their product or service rather than any sort of perceived image.
So, what exactly is a lifestyle brand? And does it make sense for your business? Let’s take a closer look.
What is a lifestyle brand?
A lifestyle brand can be defined as a company or product that is associated with a certain lifestyle or set of values. The key word here is “associated.” A lifestyle brand doesn’t necessarily produce products that are directly related to the lifestyle in question. Rather, the connection is more abstract.
For example, consider the clothing brand Levi’s. Levi’s isn’t explicitly a “lifestyle brand,” but it is often associated with the “casual cool” lifestyle. This is because Levi’s has built its image around being a relaxed, comfortable, and stylish brand. As a result, people who identify with the “casual cool” lifestyle are more likely Continue reading
How Do I Raise Awareness Of My Open Source Software Project? feat. Emily Omier – Video
Positioning Consultant Emily Omier advises the Day Two Cloud podcast audience on how to raise awareness of your open source software project. Just don’t say “marketing”! 😊😬 For the rest of Emily’s insights, listen to episode 118 of Day Two Cloud. https://packetpushers.net/series/day2cloud/ More Emily? https://www.linkedin.com/in/cloud-native-positioning/ You can subscribe to the Packet Pushers’ YouTube channel for […]
The post How Do I Raise Awareness Of My Open Source Software Project? feat. Emily Omier – Video appeared first on Packet Pushers.
Enterprise Multi-Cloud: Bringing Cost-Efficiency to Network Connectivity
To avoid overpaying for network connectivity to the cloud, enterprises need an intelligent network with multi-cloud capabilities.Using Apache Kafka to process 1 trillion inter-service messages
Cloudflare has been using Kafka in production since 2014. We have come a long way since then, and currently run 14 distinct Kafka clusters, across multiple data centers, with roughly 330 nodes. Between them, over a trillion messages have been processed over the last eight years.
Cloudflare uses Kafka to decouple microservices and communicate the creation, change or deletion of various resources via a common data format in a fault-tolerant manner. This decoupling is one of many factors that enables Cloudflare engineering teams to work on multiple features and products concurrently.
We learnt a lot about Kafka on the way to one trillion messages, and built some interesting internal tools to ease adoption that will be explored in this blog post. The focus in this blog post is on inter-application communication use cases alone and not logging (we have other Kafka clusters that power the dashboards where customers view statistics that handle more than one trillion messages each day). I am an engineer on the Application Services team and our team has a charter to provide tools/services to product teams, so they can focus on their core competency which is delivering value to our customers.
In this blog I’d Continue reading
Solving Society’s Big Problems Means Funding More Than Supercomputers
Data science, AI/ML, and HPC have been influential in tackling complex issues like the coronavirus pandemic. …
Solving Society’s Big Problems Means Funding More Than Supercomputers was written by Tobias Mann at The Next Platform.
The New US Ransomware Law – Is Your Network Ready?
Under the Act, organizations must show that data is preserved from the moment an incident or vulnerability is detected until the incident is closed out.Introducing Gluware Topology: Packet Pushers Gluware LiveStream, June 28, 2022 (4/7) – Video
Gluware introduces a new Topology feature in its network automation platform. Gluware Topology maps the network using the Gluware model and engine to visualize the network. Benefits of the new capability include improved operations by showing what network devices are where, faster troubleshooting, and streamlining security and audit processes. Packet Pushers host Ethan Banks joins […]
The post Introducing Gluware Topology: Packet Pushers Gluware LiveStream, June 28, 2022 (4/7) – Video appeared first on Packet Pushers.
Tech Bytes: Forecasting SD-WAN Performance With WAN Insights (Sponsored)
Today on the Tech Bytes podcast we look at how to get better visibility into the WAN. Our sponsor is Cisco ThousandEyes and we’re going to discuss its latest capability, called WAN Insights, that analyzes WAN performance data to help remove SD-WAN blind spots and give network engineers a better understanding of whether their providers are delivering as promised.Tech Bytes: Forecasting SD-WAN Performance With WAN Insights (Sponsored)
Today on the Tech Bytes podcast we look at how to get better visibility into the WAN. Our sponsor is Cisco ThousandEyes and we’re going to discuss its latest capability, called WAN Insights, that analyzes WAN performance data to help remove SD-WAN blind spots and give network engineers a better understanding of whether their providers are delivering as promised.
The post Tech Bytes: Forecasting SD-WAN Performance With WAN Insights (Sponsored) appeared first on Packet Pushers.
Network Break 390: New Juniper Access Switch; Intel To Hike Prices
This week's Network Break podcast discusses new switch hardware from Juniper, the underwhelming outage response by Canadian ISP Rogers, and why SASE growth is exploding. Intel is said to be raising prices across a variety of chips, a security researcher has demonstrated a replay attack that can open and start Honda vehicles, and more.KAIST Shows Off DirectCXL Disaggregated Memory Prototype
The hyperscalers and cloud builders are not the only ones having fun with the CXL protocol and its ability to create tiered, disaggregated, and composable main memory for systems. …
KAIST Shows Off DirectCXL Disaggregated Memory Prototype was written by Timothy Prickett Morgan at The Next Platform.
Announcing VMware HCX 4.4
VMware HCX continues to evolve with the release of HCX 4.4 which includes several key enhancements in multiple different areas. These enhancements are going to address new requirements, stabilize the current feature set and provide additional security. This blog aims to highlight the major changes in HCX 4.4.
Transport AnalyticsFollowing the release of HCX 4.1, the HCX team undertook an effort to better understand how various aspects of a network underlay (including bandwidth, packet loss and latency conditions) affect migration outcomes. We called this effort the Network Underlay Characterization for HCX. During the 4.2 release, the characterization exercise enabled us to officially support services over VPN/SD-WAN, along with the Network Underlay minimum requirements to support any underlay agnostically. We also published detailed tech paper (See Network Underlay Requirements and HCX Performance Outcomes). This document guides the reader through the characterization exercise (manually using command line tooling). HCX 4.4 adds Transport Analytics the HCX, allowing the user to execute performance baselining for the HCX service transport on-demand and visualizes transport performance in real-time and as time-series graphs. This enables the migration administrator to understand the network underlay conditions reflected in the transport and plan Continue reading |
Sponsored Post: G-Core Labs, Close, Wynter, Pinecone, Kinsta, Bridgecrew, IP2Location, StackHawk, InterviewCamp.io, Educative, Stream, Fauna, Triplebyte
Who's Hiring?
- Close is building the sales communication platform of the future and we're looking for a Site Reliability Engineer to help us accomplish that goal. If you have a passion for databases (both SQL and NoSQL), significant experience building, managing, and monitoring infrastructure, databases, and backend services at scale and want to work with a rag-tag team of hardworking, but humble humans, then come check us out!
- Wynter is looking for system administrators, engineers, and developers to join its research panel. Participate in research surveys, get paid ($90-$180/hr) for your feedback and comments. Super low key commitment, 10-15 mins per survey. Learn more and sign up.
- DevOps Engineer: At Kinsta, we set out to create the best managed hosting platform in the world. If you are an experienced DevOps Engineer who is constantly looking for ways to innovate and improve, we might just be the place for you! As Kinsta’s DevOps Engineer, you will be instrumental in making sure that our infrastructure is always on the bleeding edge of technology, remaining stable and high-performing at all times. If you love working with Linux, have a background in PHP, and have worked with cutting-edge technologies, such as Continue reading
A story about AF_XDP, network namespaces and a cookie
A crash in a development version of flowtrackd (the daemon that powers our Advanced TCP Protection) highlighted the fact that libxdp (and specifically the AF_XDP part) was not Linux network namespace aware.
This blogpost describes the debugging journey to find the bug, as well as a fix.
flowtrackd is a volumetric denial of service defense mechanism that sits in the Magic Transit customer’s data path and protects the network from complex randomized TCP floods. It does so by challenging TCP connection establishments and by verifying that TCP packets make sense in an ongoing flow.
It uses the Linux kernel AF_XDP feature to transfer packets from a network device in kernel space to a memory buffer in user space without going through the network stack. We use most of the helper functions of the C libbpf with the Rust bindings to interact with AF_XDP.
In our setup, both the ingress and the egress network interfaces are in different network namespaces. When a packet is determined to be valid (after a challenge or under some thresholds), it is forwarded to the second network interface.
For the rest of this post the network setup will be the following:
e.g. eyeball packets Continue reading