Secure All Software - Issue #9

Links

Functions are often short-lived, deployed in large numbers and are invoked more and more frequently as you scale. How to manage monitoring and security?

Security isn’t just a checkbox on project designs — it’s continual improvements made at multiple layers of the stack. We explore some of these layers and share how we tackled security’s challenges.

Go Language - Web Application Secure Coding Practices is a guide written for anyone who is using the Go Programming Language and aims to use it for web development.

Here's an approach to securing the cloud infrastructure layer that companies should adopt ASAP.

Tools and Tech

This also scans all an organization's repos you have permission to view. Because nobody has enough RAM in their brain to remember this stuff for 100+ repos.

Where should we store secrets? In source? In build artifacts? In CI/CD Pipelines as environment variables? None of these are good places. Cruise is open sourcing their new tool, a vault client, but for servers and containers: daytona

What to Watch?

Google Product Manager, Dustin Kirkland interviews Google Product Manager, Maya Kaczorowski to discuss interesting vulnerabilities in the Kubernetes (K8s) space.

The first session of last years RSA DevOps track in San Francisco. A great discussion about coloration and how it can improve the security of a whole organization. This might be the end of security as we know it.

Want to share something?

Did you write a great post? Built a useful too or have something else to share? Please share it with me andy@occamslabs.com or on Twitter @pxlpnk

More at: https://www.SecureAllSoftware.dev