Full Stack Journey 067: What The Heck Is GitOps?
What, exactly, it GitOps? It seems like a new "Ops" word pops up every week! On today's Full Stack Journey podcast, guest Christian Hernandez of Codefresh explains GitOps, what it is, and how you can get started using it.
Full Stack Journey 067: What The Heck Is GitOps?
What, exactly, it GitOps? It seems like a new "Ops" word pops up every week! On today's Full Stack Journey podcast, guest Christian Hernandez of Codefresh explains GitOps, what it is, and how you can get started using it.
The post Full Stack Journey 067: What The Heck Is GitOps? appeared first on Packet Pushers.
Infinitely extensible Access policies
Zero Trust application security means that every request to an application is denied unless it passes a specific set of defined security policies. Most Zero Trust solutions allow the use of a user’s identity, device, and location as variables to define these security policies.
We heard from customers that they wanted more control and more customizability in defining their Zero Trust policies.
Starting today, we’re excited that Access policies can consider anything before allowing a user access to an application. And by anything, we really do mean absolutely anything. You can now build infinitely customizable policies through the External Evaluation rule option, which allows you to call any API during the evaluation of an Access policy.
Why we built external evaluation rules
Over the past few years we added the ability to check location and device posture information in Access. However, there are always additional signals that can be considered depending on the application and specific requirements of an organization. We set out to give customers the ability to check whatever signal they require without any direct support in Access policies.
The Cloudflare security team, as an example, needed the ability to verify a user’s mTLS certificate against a registry Continue reading
How Cloudflare One solves your observability problems
Today, we’re excited to announce Cloudflare One Observability. Cloudflare One Observability will help customers work across Cloudflare One applications to troubleshoot network connectivity, security policies, and performance issues to ensure a consistent experience for employees everywhere. Cloudflare One, our comprehensive SASE platform, already includes visibility for individual products; Cloudflare One Observability is the next step in bringing data together across the Cloudflare One platform.
Network taps and legacy enterprise networks
Traditional enterprise networks operated like a castle protected by a moat. Employees working from a physical office location authenticated themselves at the beginning of their session, they were protected by an extensive office firewall, and the majority of the applications they accessed were on-premise.
Many enterprise networks had a strictly defined number of “entrances” for employees at office locations. Network taps (devices used to measure and report events on a local network) monitored each entrance point, and these devices gave network administrators and engineers complete visibility into their operations.
Learn more about the old castle-and-moat network security model.
Incomplete observability in today’s enterprise network
Today’s enterprise networks have expanded beyond the traditional on-premise model and have become extremely fragmented. Now, employees can work from anywhere. People access enterprise networks Continue reading
Next generation intrusion detection: an update on Cloudflare’s IDS capabilities
In an ideal world, intrusion detection would apply across your entire network - data centers, cloud properties, and branch locations. It wouldn’t impact the performance of your traffic. And there’d be no capacity constraints. Today, we’re excited to bring this one step closer to reality by announcing the private beta of Cloudflare’s intrusion detection capabilities: live monitoring for threats across all of your network traffic, delivered as-a-service — with none of the constraints of legacy hardware approaches.
Cloudflare’s Network Services, part of Cloudflare One, help you connect and secure your entire corporate network — data center, cloud, or hybrid — from DDoS attacks and other malicious traffic. You can apply Firewall rules to keep unwanted traffic out or enforce a positive security model, and integrate custom or managed IP lists into your firewall policies to block traffic associated with known malware, bots, or anonymizers. Our new Intrusion Detection System (IDS) capabilities expand on these critical security controls by actively monitoring for a wide range of known threat signatures in your traffic.
What is an IDS?
Intrusion Detection Systems are traditionally deployed as standalone appliances but often incorporated as features in more modern or higher end firewalls. They expand the security Continue reading
Introducing Cloudforce One: our new threat operations and research team
This post is also available in 简体中文, 日本語, Deutsch, Français and Español.
Meet our new threat operations and research team: Cloudforce One. While this team will publish research, that’s not its reason for being. Its primary objective: track and disrupt threat actors.
The security teams we speak with tell us the same thing: they’re inundated with reports from threat intelligence and security product vendors that do little to improve their actual security. The stories are indeed interesting, but they want deeper insights into the techniques and actors targeting their industry—but even more than that, they want to be protected against these threats with minimal to no involvement. That is the mission on which Cloudforce One will deliver.
This team is led by me, Blake Darché, Area 1’s co-founder and former head of Threat Intelligence. Before starting Area 1, which was acquired by Cloudflare earlier this year, I was a founding member of CrowdStrike’s services organization, and before that a Computer Network Exploitation Analyst at the National Security Agency (NSA). My career has focused on identifying and disrupting sophisticated nation-state sponsored cyber threats before they compromise enterprises and governments, and I’m excited to accelerate that work at Continue reading
Improving Business Outcomes with Proactive Monitoring
Proactive monitoring can no longer be an afterthought because the business benefits that it can bring outweigh any perceived complexities.Cloudflare outage on June 21, 2022
Introduction
Today, June 21, 2022, Cloudflare suffered an outage that affected traffic in 19 of our data centers. Unfortunately, these 19 locations handle a significant proportion of our global traffic. This outage was caused by a change that was part of a long-running project to increase resilience in our busiest locations. A change to the network configuration in those locations caused an outage which started at 06:27 UTC. At 06:58 UTC the first data center was brought back online and by 07:42 UTC all data centers were online and working correctly.
Depending on your location in the world you may have been unable to access websites and services that rely on Cloudflare. In other locations, Cloudflare continued to operate normally.
We are very sorry for this outage. This was our error and not the result of an attack or malicious activity.
Background
Over the last 18 months, Cloudflare has been working to convert all of our busiest locations to a more flexible and resilient architecture. In this time, we’ve converted 19 of our data centers to this architecture, internally called Multi-Colo PoP (MCP): Amsterdam, Atlanta, Ashburn, Chicago, Frankfurt, London, Los Angeles, Madrid, Manchester, Miami, Milan, Mumbai, Newark, Osaka, São Paulo, Continue reading
VXLAN-to-VXLAN Bridging in DCI Environments
Almost exactly a decade ago I wrote that VXLAN isn’t a data center interconnect technology. That’s still true, but you can make it a bit better with EVPN – at the very minimum you’ll get an ARP proxy and anycast gateway. Even this combo does not address the other requirements I listed a decade ago, but maybe I’m too demanding and good enough works well enough.
However, there is one other bit that was missing from most VXLAN implementations: LAN-to-WAN VXLAN-to-VXLAN bridging. Sounds weird? Supposedly a picture is worth a thousand words, so here we go.
VXLAN-to-VXLAN Bridging in DCI Environments
Almost exactly a decade ago I wrote that VXLAN isn’t a data center interconnect technology. That’s still true, but you can make it a bit better with EVPN – at the very minimum you’ll get an ARP proxy and anycast gateway. Even this combo does not address the other requirements I listed a decade ago, but maybe I’m too demanding and good enough works well enough.
However, there is one other bit that was missing from most VXLAN implementations: LAN-to-WAN VXLAN-to-VXLAN bridging. Sounds weird? Supposedly a picture is worth a thousand words, so here we go.
Tech Bytes: Fortinet Firewall Integrates SD-WAN, ZTNA, LAN Controller (Sponsored)
The Tech Bytes podcast welcomes Fortinet to to discuss the universal nature of Fortinet hardware and software. The same FortiGate NGFW appliance includes networking capabilities including a router, SD-WAN, ZTNA, and a LAN controller.Tech Bytes: Fortinet Firewall Integrates SD-WAN, ZTNA, LAN Controller (Sponsored)
The Tech Bytes podcast welcomes Fortinet to to discuss the universal nature of Fortinet hardware and software. The same FortiGate NGFW appliance includes networking capabilities including a router, SD-WAN, ZTNA, and a LAN controller.
The post Tech Bytes: Fortinet Firewall Integrates SD-WAN, ZTNA, LAN Controller (Sponsored) appeared first on Packet Pushers.
IEEE Conference on Network Softwarization
I’m moderating a panel at the upcoming IEEE Conference on Network Softwarization. This is one of the various “good sources” out there for understanding what might be coming in the future for computer networks. The conference is hybrid, so you can register and watch the sessions live from the comfort of your home (or office).
I’m moderating the distinguished experts panel on the afternoon of the 30th.
How the Internet Really Works
Gentle reminder that I’m teaching a three-hour webinar on Safari Books this coming Friday on Internet operations. The course is roughly divided into three parts.
The first part covers DNS operations, including a high-level overview of how DNS works and some thoughts on how DNS providers “work” financially. The second part is a high-level overview of packet transport, focusing on routing, the different kinds of providers, and how each of of the different kinds of providers “work” financially. The third part is a collection of other odds and ends.
Anyone who registers is able to watch a recorded version of the training afterwords.
I’m teaching part 2 next month, which I call Navigating the DFZ.
Nashville Professional Women’s Networking Meetups
Nashville is home to a vibrant professional women’s networking scene. There are meetups for women in a variety of industries, including tech, healthcare, and entrepreneurship. These meetups provide a great opportunity for women to connect with others in their field, share resources and best practices, and build relationships. In addition to networking, these meetups often feature guest speakers, workshops, and other events that can help professional women further their careers. Whether you’re new to town or looking to expand your network, attending a professional women’s networking meetup is a great way to connect with like-minded women in Nashville.
Popular Women’s Networking Meetups in Nashville
Women in Technology Nashville
A women’s business networking organization with a mission to connect, inspire, and empower women in the tech industry. WiTT hosts monthly events featuring guest speakers, workshops, and networking opportunities. Attendees can expect to gain valuable insights from women leaders in the tech industry, learn about new technology trends, and build meaningful connections with other women in the field. WiTT also offers membership levels for individuals and corporate partners, providing access to exclusive resources and benefits. Whether you’re looking to learn more about technology or connect with like-minded women in the industry, women Continue reading