What All DevOps Teams Should Know About The AWS Shared Responsibility Model

Keeping your cloud workloads secure, compliant, and protected while moving at the speed of DevOps is no easy task. Our team at Threat Stack knows this truth very well. There are many different viewpoints on the best approach to take to keep your customer data and systems protected in the cloud, and it all starts with understanding where your cloud provider’s responsibility for security ends and where yours begins. Let’s use AWS as an example throughout this post as they have a Shared Responsibility Model that demonstrates this well. Read more “What All DevOps Teams Should Know About The AWS Shared Responsibility Model”

Implementing Better DevOps Security: Expert Perspectives

On Wednesday, Threat Stack was featured in an important GigaOM webinar panel, Iron Clad DevOps Security for Your EC2 Environments. The panel included our own Director of Ops and Support, Pete Cheslock, along with David Linthicum of GigaOM, Greg Ferro, Independent Analyst, and Matt Sarrel, Executive Director of Sarrel Group. It was a deeply informative hour-long discussion which David himself claimed as one of the best security webinars he’s had. We couldn’t agree more!

Read more “Implementing Better DevOps Security: Expert Perspectives”

The Linux “Grinch” Vulnerability: Separating Fact From FUD

Recently, a security firm reported what they claimed to be a flaw with a major impact on organizations running Linux. (And apparently since all the rage these days is to give bugs code names, they pre-seeded the market with this timely one: “grinch”).

Linux software bugs have been huge this year, leaving administrators reeling to patch themselves from Shellshock, Heartbleed, POODLE, etc. With claims that this vulnerability could have an impact similar to Shellshock, I really wanted to dive into what the “grinch” bug means in order to separate the fact from the FUD.

Read more “The Linux “Grinch” Vulnerability: Separating Fact From FUD”

4 Steps To Effectively Integrate DevOps Workflows With Cloud Security Practices

I’ve spent most of my career in Operations, and the last 5 years at various organizations advocating and instilling DevOps principles in the teams I work with. One thing I’ve noticed is that most companies value speed over security, which has traditionally been a blocker in delivering software.

Recently, however, with more and more breaches and vulnerabilities reported (Shellshock and Heartbleed to name a just few), I’ve changed my tune. I’m not going to say I’ve become paranoid, but one of the reasons I’ve joined Threat Stack is because I believe how important it is that security gets integrated into the operations process.

Read more “4 Steps To Effectively Integrate DevOps Workflows With Cloud Security Practices”

Bringing Infosec Into The DevOps Tribe: Q&A With Gene Kim

Last week, I had a call with Gene Kim, founding CTO of Tripwire and author of The Phoenix Project (see end of post for more details). I’ve known Gene from the DevOps community for awhile now, so we took this time to dive into all things DevOps and Security, in the end resulting in this great Q&A to share with you all on what bringing Security into DevOps means for us all.

Read more “Bringing Infosec Into The DevOps Tribe: Q&A With Gene Kim”