raesene9

28 ms·

391.
by raesene9 5y ago
On the first point, I don't see any particular reason why banking shouldn't go with cloud. Obviously banking has regulatory hurdles and things like availability are important so it'll require a specific architecture to help a
392.
by raesene9 5y ago
Good to see some practices like default deny networking (ingress and egress) and very limited interactive production access being laid out here. A couple of other areas that aren't mentioned, although perhaps they're still doing
393.
by raesene9 5y ago
Therein lies an interesting detail. Docker does block unshare in default configurations, using its seccomp filter. However in Kubernetes, by default, Docker's seccomp filter is disabled. At the moment you need to re-enable it on a pod
394.
by raesene9 5y ago
Indeed there have been CVEs this year where code in a user namespace was able to trigger them where a standard unprivileged process could not (e.g. CVE-2022-0185)
395.
by raesene9 5y ago
This might be correct, although looks not great that they're only talking about it after the leaked screenshots. However, if LAPSUS have more, this could easily lead to them wanting to prove him wrong and release more proof of compro
396.
by raesene9 5y ago
I'm not a fan of how the article refers to containers as "a form of operating system virtualization", I don't find that a very useful way to think about them. Generally I think of them as constrained processes which cont
397.
by raesene9 5y ago
The original write-up is linked from this post https://www.crowdstrike.com/blog/cr8escape-new-vulnerability... - Good, lots of details on exact reproduction. One idea for mitigation before you can get a patch out for t
398.
by raesene9 5y ago
Secure defaults are super important, especially on complex systems as people will not want to mess with the out of the box configuration too much when setting things up. One additional consideration is that the secure defaults should be u
399.
by raesene9 5y ago
I'm not sure I'd agree with "rarely". There is some cross-over with auditing, but the infosec people (in my experience) are generally more risk focused than auditors who are more "rules" focused. Also I've
400.
by raesene9 5y ago
Aand there's a problem :) So if you consider the size of most audit teams relative to the size of the IT departments they audit, how do the auditors become subject matter experts in all the different types of technology in use in the o
401.
by raesene9 5y ago
Depends hugely on the testing team and scope :) I've been a customer and tester over the years and I've seen everything from obvious scanner output, through to actually good bespoke content. There is going to be some boilerplate t
402.
by raesene9 5y ago
Pentesting involves report writing 'cause you've got to tell people what you did somehow :) A better model (IMO) is for the pentester to get onboarded into the bug/defect tracking system and put things there. Pretty much ever
403.
by raesene9 5y ago
That's a pretty large generalization. There's a wide range of careers under the umbrella of what gets called Infosec. Some that really don't fit the definition of "auditor" - Vulnerability research - Pentesting -
404.
by raesene9 5y ago
I'm afraid that in quite a few organizations, CISO stands for "Chief Incident Scapegoat Officer".
405.
by raesene9 5y ago
we're all alone, more or less
406.
by raesene9 5y ago
When I talk to people about k8s, if they haven't containerized their apps yet, I generally recommend starting with a simple CAAS setup and then, if you need some of the flexibility and power that k8s provides, then move those apps
407.
by raesene9 5y ago
Shame to see it go, I still have my Dust Puppy on the shelf and a signed User Friendly card, I got back at a conf. in the 90's.
408.
by raesene9 5y ago
< 5.8 not being affected is probably a saving grace for quite a few enterprises as I'd expect that LTS distributions may not have got that version included as yet.
409.
by raesene9 5y ago
Containers provide a level of isolation relative to standard Linux processes. Docker style containers were not designed specifically as a security sandbox (IMO) but instead re-use a set of Linux primitives to provide a level of isolation. O
410.
by raesene9 5y ago
It doesn't but TBH user namespaces have a mixed record when it comes to security. For example CVE-2022-0185 wasn't exploitable from a standard container unless user namespaces were available allowing additional capabilities to b
411.
by raesene9 5y ago
Do you have references for there being far more evidence of fraud than against it in the US 2020 presidential election? From what I've seen there have been a large number of recounts and reviews in battleground states, including recoun
412.
by raesene9 5y ago
Manufactured realities believed by large groups of people are definitely a thing at the moment, and not just in Russia. Another example is in the USA where, reportedly, 40% of people don't believe Biden won the 2020 election despite th
413.
by raesene9 5y ago
I went for SOARE, TULIP, NYMPH. The first two to get all the verbs in and then NYMPH to get as many consonants as possible, it's generally not too bad it seems.
414.
by raesene9 5y ago
I've started using jless for interacting with things like the Kubelet API, it makes browsing through the response a lot easier when I don't know exactly what I'm looking for.
415.
by raesene9 5y ago
nerdctl is just a new client to target containerd. Containerd has been around a long time, it was originally part of Docker itself, but was separated out and is now a standalone project. Docker uses containerd as part of it's standard
416.
by raesene9 5y ago
I think that's mixing apples with oranges really, as containerd uses runc as well. nerdctl is a client app which speaks to containerd, which is a long running daemon. podman uses a different architecture (no long running daemon) Both p
417.
by raesene9 5y ago
Tyically there's a hierarchy of security documents/practices. you start with principles work, like in this repo. then you look at technologies you use and start getting into specific examples. For many platforms/services ther
418.
by raesene9 5y ago
That should come out in threat modelling, which is covered. when you're looking at who the adverseries for a specific system are, you'll necessarily cover what your data is and how valuable it is. What may not be covered, and so
419.
by raesene9 5y ago
At a principles level TBH security advice often doesn't change much over time. I've been in the industry for 20+ years now and I can see things in that repo. that were old when I started :) The technologies change, and the impleme
420.
by raesene9 5y ago
I think this is correct but is tricky to put into action as companies rarely staff security departments to do this, typically you'll see ratios of 20 devs or even 50 devs to 1 security person. At that level it's very difficult for

More ›