Full transcript
0:00[Music]
0:02welcome everybody super excited to be at
0:06devops forward days I'm Chris and I'm
0:09going to talk about security things I
0:11learned in the past and think I see
0:14um coming up in the future
0:17I'm a CTO and co-founder at Mandu Mondo
0:21is a leader in security posture
0:23management and uh I have a very strong
0:26background in security
0:28my career started at Deutsche telecon
0:31which is one of the largest typical
0:33providers within Europe and the back in
0:37the days it was 2010 ish we really had a
0:40lot of server infrastructure and we need
0:42to figure out how to secure this
0:44infrastructure and scale and it was very
0:47very manual it was the the time where
0:51chef and puppet was really like
0:54flourishing and it was just the time
0:57where everything was going to be
0:58automated
1:00and internally we started we started a
1:03research project to figure out hey can
1:06we use those automation tools to make
1:08things more secure so we started a
1:10project called hardening project
1:11internally to figure out how can we do
1:14this a lot of people said don't try it
1:17we did it not going to work too
1:20difficult so we said okay challenge
1:22accepted let's try and figure out
1:24and we quickly build it out core Linux
1:28module to make the configuration of a
1:31new server super automated super like
1:33secure by default the next level was
1:36securing SSH and and that really helped
1:39driving driving the automation we've got
1:42really really quickly adopted it was uh
1:45internally we rolled it out to massive
1:48amount of critical infrastructure we
1:50also rolled out even on AIX service so
1:53those those who know that still
1:57um
1:57so very exciting to have this all all
2:00been there uh it was very clear from day
2:03one that we wanted to make this open
2:04source and available to everyone so the
2:07it was the first open source project of
2:09launcher Telecom and we called this now
2:12devsac and that that is the incubation
2:16of that project and since then it has
2:17been fully open source project Telecom
2:20is uh still using it on a daily basis to
2:23to secure the infrastructure
2:26um very exciting times but doing that we
2:30also quickly learned that
2:31just solving it with automation is only
2:35part of the story
2:37as when we talked with a lot of like
2:40operations teams they said uh I can't
2:43explain my management why I need to
2:46automate this thing I can't explain my
2:48management that this this needs more
2:51security so it's really difficult to say
2:53like request resources for something
2:56that you can't prove so what was missing
2:58was really something that you could run
3:01and say hey we have the following gaps
3:03like this is not secure this is not
3:05secure so we started a project called
3:08called inspec
3:10um I started a company made this really
3:12really big Chef software required us
3:15and was used by by Major Fortune 500
3:18companies
3:20so now there's tooling out there that
3:22helps you to automate and to to check
3:24but what what's the problem so we
3:32has really used to look like this like
3:34they helped to make the world be more
3:36secure they wanted to
3:40identify vulnerabilities make them
3:42available and help help everybody to be
3:45essentially become a better better human
3:49um this is not so true nowadays so we
3:52have a lot of groups that are
3:54essentially
3:56using all those uh all those
3:58vulnerabilities out there and do a
4:00criminal business around this they have
4:03sales quarters they have playbooks they
4:05have customer support and they have also
4:07affiliate programs so that means they're
4:10fully exploiting all those
4:12vulnerabilities for their benefit and uh
4:15that can't be a good thing right like
4:17that is something that we really really
4:20want to avoid
4:22um and and let's see how this can be
4:25done so
4:27what plays into the hand of those groups
4:30is that we have a massive amount of
4:32increase in known one abilities so it's
4:36a 20 increase per year which last year
4:39was uh roughly 25 000 reported
4:42vulnerabilities and those are only the
4:45reported vulnerabilities we assume like
4:47this is just the tip of the iceberg so
4:49there are a lot of unknown
4:51vulnerabilities available that are
4:53actually not yet known
4:56interesting to know is that 20 25 of
5:01those vulnerabilities have exploits so
5:03that's over just last year over six
5:06thousand
5:08um exploits
5:09um at this pulse of those groups to
5:13figure out how to how to hack your
5:15infrastructure and just a little bit to
5:17understand how this vulnerability
5:19Discovery process works it's really
5:21going like vulnerability is discovered
5:23hopefully by by a person that is going
5:25to report it to the vendor
5:27um and then they normally report a cve
5:32and that CBE is then being assigned is
5:35not being published until the vendor has
5:37the patch in place once the vendor has
5:39the patch in place the full
5:40documentation that's online before the
5:43patch we call it zero day Expo and
5:45because not no known information and
5:48then after that we just call it exploit
5:50and interesting to know is
5:53that 14 of the exploits are available
5:56before the patches are released which is
5:59uh is quite a number and so we need to
6:04like make sure that we not just like
6:05depend on patches but also make it
6:07difficult with secure configuration
6:10the the
6:12um you see additional 23 uh happen after
6:16the week the CDE was published and then
6:1950
6:20additional like then we're like okay
6:22like this is being like released after a
6:25month so after a month essentially most
6:28of the exploits are available after like
6:31at least one month after the cve was
6:33published so you have roughly 30 days
6:36until this thanks so it's fully
6:40exploited
6:42now we look at the other side okay
6:44patches out there so how is it being
6:46rolled out so then normally what happens
6:48oh Panic moment
6:51um and you see the ESR has critical
6:53impact so let's identify where this is
6:56so we start like looking and it takes
6:59the walls this process the asset
7:01inventory piece is super super
7:03complicated so that's why it normally
7:06takes takes a long like like just think
7:08about your kubernetes cluster like which
7:10container has no chests that reacts
7:13involved uh it's it's actually a really
7:15really complicated question
7:18um once you have it you'd normally
7:19generate a report then report is then
7:22ending in a ticket a lot of work and
7:25system being fixed being rolled up so
7:28the average the average time for this
7:30whole process
7:32is about
7:34246 days
7:38so do you have a difference between 30
7:41days
7:42and
7:43246 days so that gives
7:46additional time for hackers to just
7:49exploit the infrastructure so we have
7:52more issues like more vulnerabilities we
7:55have a slow roll out of fixes and that
7:58all plays into the hand right so if you
8:00have an increase there hacker school
8:02full Automation and they scan the
8:04internet in three minutes like then you
8:07see already like this is going to be a
8:09problem like you you don't need to
8:11really like have a PhD for that like
8:13this is some super straightforward the
8:16numbers just just speak for themselves
8:21um and there's been a survey like
8:22talking about like thousand it and
8:25Security Professionals and 80 were
8:27victims and a lot of them more than 60
8:31percent pay the ransom and that's
8:35something uh you should really avoid
8:38because that money is better spent on
8:39something that that helps us uh to build
8:42better products help humanity and not
8:46not investing it into
8:48and to really ransomware gangs
8:52the key challenge that that we see over
8:55and over and over again just just for
8:58being the reasons is
9:01patch management and hardening so both
9:04of the things are normally not done and
9:06this is like more than 80 percent of the
9:08attacks are just going to array software
9:11and misconfiguration and with the amount
9:15of vulnerabilities just increasing the
9:17likelihood of like hitting hitting the
9:19goal is is really really high and that
9:22makes
9:23that makes something that we need to fix
9:25so now the question that we need to ask
9:29ourselves why it is so difficult for
9:31teams to
9:32fix things quickly so that we could ask
9:35hey why is like 250 days until a fix has
9:40been pulled out into into infrastructure
9:43and that is it's not that people don't
9:45want to like do this faster it's just
9:47like the way
9:49things work right now and which is not a
9:52good thing so and let's let's talk a lot
9:54about the process how platform
9:57engineering and security is really
10:00working together in most cases and how
10:02this is not helpful to reduce the time
10:06and the
10:07Engineers normally like build the
10:10application get pressure like everything
10:11needs to be shipped really really fast
10:14um so it's Building Products
10:17um and delivering value and the so they
10:20go from local development they develop a
10:23node.js app put it into terraform deploy
10:26it Ghost Cloud CSD is checked
10:29pre-production One account production
10:31boom so let's deployed it naturally
10:34security comes from the different angle
10:36they go with what's the most likely like
10:39attack Vector that hackers can do they
10:41come from the production environment so
10:44they start from the exactly the other
10:46end and trying to protect that
10:48infrastructure
10:50which makes a lot of sense but it's it's
10:53essentially difficult to to work
10:56together because like the time from
10:59local development to production is long
11:02like so when once they get the report
11:04like local development teams are already
11:06on the next project sometimes and then
11:09maybe the whole rollout of the product
11:11is being blocked just because like
11:13there's there's something missing and
11:16and then tying it to the specific piece
11:18of software and like testing everything
11:21it's it's something that you really want
11:23to avoid makes it very very expensive if
11:26if the security teams are good they do
11:28it most likely already in the
11:30pre-production environment
11:31but still too late and
11:35let's just take a simple example to make
11:38this a little bit more visual
11:41security Engineers look for the attack
11:43path of like what's my color pocket been
11:46doing like they want to make sure
11:47nothing has been public so they look at
11:50how to configure it properly in AWS
11:52Google and azure
11:54and they come up with a rule set hey you
11:57need uniform bucket access level it
12:00can't be public so this is the rule
12:03otherwise we'd be shut down your
12:05application
12:06makes a lot of sense and then you come
12:09to the secure like the platform
12:10engineers and they
12:12don't use they don't use click Ops
12:15anymore like they use terraform so now
12:17the role will make it makes a lot of
12:20sense it's not necessarily directly
12:22applicable to them because they need to
12:24make sure everything needs to be
12:26properly checked in terraform not in the
12:29cloud so the essentially once it's
12:32deployed to the cloud it's way too late
12:33because like then it's already public so
12:35it needs to be checked beforehand
12:37and like making those rules uh working
12:40hand to hand and together it's
12:42challenging like this is this is where
12:44we have the Gap like we essentially have
12:46teams doing something with really really
12:49good intention and they want to be
12:51secure and they try but you you're
12:53humans so we make mistakes and then
12:55seeing this coming from local
12:58development production getting them this
13:00feedback getting the red list of hey
13:03sorry but you made this like wrong so
13:05everybody is super annoying like the the
13:07platform engineering team is super
13:09annoying because they get the report
13:11like really really late the security
13:14team is super annoying because they have
13:17to tell
13:18um normally like platform engineering
13:20teams the same thing over and over and
13:23over again
13:26that leads to frustration so people are
13:29like this this can't be this is
13:32something that that
13:34um I think is one of the most
13:36things that drives people crazy either
13:38it's slowing down the process then they
13:40fight with each other and just like
13:43everybody has really good intentions
13:44here
13:46um but the way mostly the way that
13:49security industry works is really not
13:54the way people work together and so
13:56that's that's coming that's why it's
13:58coming to frustration
14:01so what we what we've done is
14:03doing a security therapy we talk to more
14:06than 100 leaders and ask them hey
14:10it's the biggest problem like what's
14:12driving your nuts like what what really
14:14is is going on there because we wanted
14:17to figure out like where is the biggest
14:19problem
14:20[Music]
14:20um
14:22in summary essentially it's a lot more
14:25software so a lot more software so
14:28that's driving driving more issues more
14:31vulnerabilities the team gets overloaded
14:33then if they have all the security tools
14:37because they're normally are quite
14:38expensive they have to glue like more
14:42than 30 applications together then they
14:45need to glue like them together get an
14:47aggregated and super annoying like the
14:49mental overhead just to get a simple
14:52answer
14:53where is software experience where is
14:56open ssh in that version being installed
15:01those tools normally don't solve that so
15:03it's you pay a lot of money and you
15:05still can't answer the real question
15:08the
15:09other one is
15:11as I said security security has their
15:14own tooling so they don't share the
15:16tooling with the platform engineering
15:18team most likely it's not because the
15:21team doesn't want to share it it's just
15:22because the license cost of the security
15:25tooling is just not driven in a way that
15:27everybody gets access and that makes it
15:30really difficult for the security teams
15:32to share that knowledge even if they
15:33want to
15:34they can't because of the license cost
15:37and that is
15:38nuts so that doesn't make any sense
15:40because you should have vulnerability
15:43information available as early as
15:45possible to as many people within your
15:47organization because it's better your
15:49organization knows what's going on then
15:52the hackers so so that's that's
15:55definitely a problem something that
15:57really comes by the way the tools are
15:59licensed not by by how humans work
16:04and then the constant struggle like the
16:06prioritization if we have reports being
16:10delayed
16:11um then they're all read then you get
16:13the the fatigue of ah it's wet anyway so
16:17like let's just ship it let's ship new
16:19stuff um so because it stays well so why
16:22why do anything and that's that's
16:25something that is not
16:27driving the right Behavior I think it's
16:30just not helpful and and we need to find
16:34a better way to deal with that
16:37so
16:39yep
16:40so normally what happens say yep
16:42management you we have a problem
16:44security blocks us again we can't ship
16:47our app security is saying those stupid
16:49platform Engineers they really never
16:52listen to us and we have to tell them
16:53all the same thing ever and ever again
16:57um so yeah it's it's
17:00the problem is though the hackers don't
17:03care like they always attack you right
17:05so the question is more how do we make
17:07this better so that this problem is not
17:09going to happen because our only
17:11defenses to be really really fast in the
17:15delivery process and so that we need to
17:17have mostly the identification of the
17:20issues really really early and that's
17:22that's tricky
17:24so let's let's talk a little bit about
17:26how those security tools or new security
17:30tools need to work to support uh the
17:33most progressing companies that that I
17:35have seen working and solving that
17:37problem on on a large scale
17:42if you have a massive amount of
17:43infrastructure the first thing is they
17:45need a unified view so the tooling that
17:48you have
17:49really needs to cover everything and
17:51that sounds like oh this is impossible
17:53like not going to happen but we've seen
17:56this work with with hashicorp terraform
17:59like terraform cameras so many services
18:02super extensible and nobody would argue
18:04that that Hershey cooked terraform is
18:07not not
18:10the tool to go to do all the setup of
18:12those different applications so there's
18:14there must be a way so that you can
18:16essentially query all those different
18:19infrastructure layers like ranging from
18:21cloud services workloads running within
18:24in this case if you have kubernetes we
18:27have the kubernetes cluster then we have
18:29workloads we have application containers
18:30and you can like extend this bit of like
18:33serverless so this is just just to
18:35illustrate the unified view that you
18:37need to have and that's something that
18:40happens but
18:42unfortunately that's not everything you
18:45need more so it's also the life cycle so
18:48you need build and run time because
18:52um as we've seen platform engineering
18:54spends most of their time in local
18:56development and like going to cicd once
18:59it's shipped like we normally have
19:00automatic deployment so if they spend
19:03most of their time on the left side like
19:06wouldn't it be great if the security is
19:08also being checked on the left side also
19:11on the right side but like we can like
19:13really reduce the the cycles
19:16and increase our production level by
19:20just checking things earlier
19:24so the question is here
19:26um how do we get out of the situation
19:29where we
19:32focus on individual technology like how
19:35do I make it a secure an Azure how do I
19:37make it secure in AWS but go to the real
19:40problem so and as soon as we have a
19:42bucket no matter if it's an Azure AWS or
19:45Google you really want to make sure hey
19:49this is being secure
19:52developers use terraform so we also need
19:55to check terraform and like make sure
19:56they bring these
19:58develop the styrofoam HCL this is being
20:01checked and then also covered so if it's
20:04already like checked in terraform it's
20:06not even like being created
20:09um in the cloud wrongly so that reduces
20:12the amount of like reports that security
20:14needs to send out dramatically and we
20:17need to like focus on how can we achieve
20:19that goal
20:21and then so essentially what we want to
20:24see here and the the smart
20:27teams that we have seen are really
20:30focusing on bringing all their security
20:32knowledge
20:34to the platform Engineers so that they
20:38essentially prevent bad things to being
20:41configured in the first place and that
20:43helps them to really focusing on best
20:46practices educate build out like
20:49policies understand like do more
20:52in-depth analysis and so it frees up a
20:55lot of time from those from those teams
20:58to really
21:00make the whole infrastructure secure so
21:03the goal here is
21:05those teams working together and not
21:07against each other and that's that's
21:09that's key so
21:11um it's always the question hey why
21:14can't those teams not work together
21:15because the goal for us is building the
21:18most secure fast delivery saw like
21:21pipeline so that we have a very secure
21:25infrastructure and we can achieve that
21:27we just need to work together
21:30so one thing like the the what what
21:32happens here is that we essentially need
21:34to make sure everybody has access like
21:37no matter where you are if it's like
21:38platform engineering security
21:39engineering you need to have access to
21:43all the security checks you need to see
21:45that early you need to like check the
21:46container in the pipeline you need to
21:48check the container and the runtime you
21:51have full coverage so that means you can
21:53see things and build and run time it can
21:55integrate into your existing processes
21:59um and and that is important because
22:00like then security can actually help the
22:03platform Engineers to build this in and
22:05not just like be restricted by the
22:08tooling they have available automation
22:10is key I mean we talked a lot about
22:12Automation and
22:15having that available and built into all
22:18the automation everything is in
22:20kubernetes everything is in terraform
22:22nowadays so if we if the security
22:24tooling doesn't work with that then how
22:28helpful is it right so like that's like
22:31security needs to be where people are
22:33where people develop new things and
22:35that's that's where top of the mind of
22:38the of the new security Engineers I have
22:41met
22:42um that we're really focusing on how can
22:43they work together how can they bring in
22:46their knowledge how can they help them
22:48so that that they make sure you
22:51applications are
22:54always constantly up to date
22:57and it needs to be extensible very very
23:00quick
23:01um those those teams
23:03reach the limit so they reach the
23:05maturity level and then they
23:08they see like those security tools that
23:10are not extensible they don't allow them
23:12to extend the rule set
23:14and that's a problem because you're
23:16really stuck like you can't make sure
23:18forward although mentally like you're
23:21already like on the next level you would
23:23really check something that you can't
23:25it's just driving you nuts then in the
23:28next level so that's something that
23:30really needs to be avoided and
23:33well it probably makes a lot of sense
23:35like while listening to it implementing
23:38this is actually
23:40has been really difficult I have to say
23:42so not a lot of tooling allows you to do
23:45that
23:46so because we believe that many open
23:49source projects in the past so we
23:51believe like we can help help
23:54um
23:55teams getting there so be open source
23:57two projects uh CN query which uses a
24:02graphql query language underneath took
24:04very your
24:06infrastructure one is for asset
24:08inventory so quickly get information
24:10about Linux how many users like what
24:13what kind of permissions are set on
24:14those users make sure all the all the
24:18next Services get all the services that
24:20are running all the processes
24:22from AWS find quickly on who are the IM
24:27users that have no two-factor
24:29certification enabled makes it really
24:31really quickly like gather information
24:33about the infrastructure but also having
24:35an incident response pack so you can
24:37quickly query all those things
24:39um and figure out if the SMS
24:41configuration
24:43on the other hand he also based on the
24:45same graphql based query engine we built
24:47C and spec and CN spec comes with out of
24:51the box policies for all those major
24:53platforms ranging from Linux Windows
24:56containers kubernetes
24:58going Beyond OCTA slack so it's really
25:01extensible in terms of like similar to
25:04how terraform works so you can extend
25:06this you can contribute new providers
25:08new resource packs and and also new
25:11policies
25:13um just to give you a sneak peek of how
25:15this can work so you can see how this
25:17process that I just talked about can be
25:19actually being implemented as you we
25:22have in our case a graphql based mql
25:25which is like similar to terraform have
25:28different resources available so you can
25:30query
25:31terraform HDL files you can say hey give
25:34me all the resources that Define the
25:36public access block and then you check
25:38like individual like arguments there the
25:41same for as three buckets you just
25:43iterate over all buckets and say hey
25:45all those entries really need to have
25:49like a block public ACLS and block
25:51public policy being set to true so that
25:54it's all uniform
25:56and that now you see like the the same
25:58check being implemented into levels
26:01which makes life a lot easier because
26:04you can you have not one
26:06one way to do it just for different
26:08infrastructure and bring this to the
26:10next level the question is now how can
26:12the teams work together to to Define one
26:17rule set that essentially is applicable
26:19for Developers for platform engineers
26:21and go into security and on the left on
26:24the right side we see those individual
26:26queries where checking for channel form
26:29and checking for NWS on the right side
26:32you see okay like this is just like one
26:34check that we Implement here
26:37um and then we have different variants
26:39being included So based on the
26:42um on the platform we essentially check
26:44hey is this is this terraform then check
26:47terraform is this AWS we we check um we
26:50check that
26:51and that makes it really really easy to
26:53have one policy set just apply it and no
26:57matter where you are you can see this
26:58can easily be extended to Azure gcp and
27:02just gives you gives you an illustration
27:04of how this can be done
27:07so with that Tooling in mind uh now you
27:10can see like how this process can work
27:11together the like teams can Define the
27:14policy rules they can say this is
27:16applicable to us we apply this to local
27:19development but also production like it
27:21can work hand-to-end together they can
27:23check terraform they can check AWS like
27:25ranging from local into into production
27:28the checks can also be integrated easily
27:31in cicd so that means like everybody is
27:35collaborating to essentially make this
27:37secure which drives down the time of
27:41getting patches and misconfigurations
27:44being fixed
27:45to a dramatic level
27:49so that you as a company are being more
27:51secure your projects are more more way
27:54more secure the best it's all open
27:56source you can just use it you don't
27:59have to pay for it it's essentially
28:01something that we believe like is
28:03something helpful and we try to make
28:06be very helpful in case you have any
28:08questions try it out get up get us
28:10feedback give us feedback so that we can
28:12make it make it even better
28:14uh super excited so we have a just we
28:17have a strong background we come from
28:19Google and and NASA our experience so we
28:22have done quite some large
28:24infrastructure in the past
28:26and used all those learnings to build
28:28mandu and make make this make this
28:32knowledge available
28:34in case you have any questions feel free
28:36to reach out super excited Super would
28:38love to hear from you if you have any
28:40questions
28:41um
28:43let me know any feedback
28:46um
28:47thank you very much for your time and
28:50talk to you soon bye
28:56hi Chris stuff
29:00so thank you for use the interesting
29:04topic security is always important but
29:07usually on my practice nobody cares
29:09about it on development stage
29:14yes and when we go to production we
29:17found some issues when our storage as
29:21you mentioned are unencrypted or even
29:23public variable or our repository have
29:26sensitive data and we have some
29:30questions what skills are required for
29:33security engineering for person who
29:36because for now it's very popular to
29:39high in devsec Ops and for your opinion
29:42is it right way or the wrong way yeah no
29:45very good question very good question
29:47um the I think the the security
29:50Engineers really need to know ansible
29:52and terraform really well
29:55um so the it's normally really not
29:57rocket science like the the the
30:00misconfigurations and patching like this
30:03makes normally sense it's really not
30:05difficult but the the challenge is more
30:07the amount of checks you need to do it's
30:10like you if you deploy infrastructure
30:12you deploy it in AWS then you have a new
30:14service here and a new service here and
30:16then a new service you can't know
30:18everything like even if you're working
30:19full-time on security
30:22I would like not know all those checks
30:24for securing my Linux server out of my
30:26head all the time so I would not trust
30:28my head and like doing it all the time
30:30right so that's why you have those
30:32policies that give you guidance and
30:34important is that those things are
30:35automated too so you see just uh and the
30:39soft checks you see it's failing and
30:40then you give get some guidance so I
30:42think it's it's more building out a
30:44community around those security
30:45knowledge instead of making this hidden
30:48so one of the biggest the biggest things
30:50that I find find quite annoying in the
30:52security industry there's this like this
30:54exclusive knowledge
30:56not being shared and so it's you need to
30:59spend a lot of time to figure out how to
31:01do this proper so I think it's more on
31:03as in general like as as a group to make
31:07make this knowledge available
31:09um and you just need to do it I think
31:12it's really not like you don't need a
31:14PhD you don't need to study it it's just
31:16applying it work of automation use the
31:18right tools there's a lot of Open Source
31:20tools out there and started that and
31:23just apply it on a daily basis like try
31:25to be a little bit more secure every day
31:27and learn as you go
31:30oh thank you for your answer yes I
31:33totally agree that some of uh security
31:36issues required a lot of time but of my
31:39opinion uh tend to time the second Ops
31:41seems as a just for optimized course
31:44instead more careful to be security
31:48yes and also we have another question
31:51what is the best practice for security
31:53engineering tooling is enough for
31:56example like it's a Docker image uh
31:59check your voice LCD or something else
32:02is required
32:05uh a lot of security tools go right now
32:07just like checking containers and
32:09checking vulnerabilities and containers
32:11and then we say what solve problem then
32:14um I think it's actually not enough it's
32:16just one one small power of the thing
32:18and and it starts a little bit more with
32:20the mindset as I explained in this talk
32:22as it needs to start with the
32:25understanding that those teams need want
32:27to work together right so like they want
32:29to share the knowledge so so that comes
32:31with is two directions you see that the
32:34engineers need to
32:35spent more time understanding what are
32:37the risks deploying it into production
32:39and the security teams need to
32:41understand a little bit more where the
32:43developers are so I think it starts on
32:45the people side like where
32:47um we need to like just and try to
32:49understand the other side a little bit
32:50and work together so that's I think only
32:53with that mindset you can actually
32:54implement this proper so so just have
32:57the tooling here like it's it's nice
32:59it's helping but it's not solving the
33:01overall problem and then when you come
33:04down to okay like we were on a work
33:06together then I think it's always start
33:09with the biggest risk so that's most
33:11likely in production so you need to like
33:13you need to solve like find out like
33:15where is the public bucket open right
33:17like is my application Exposed on ports
33:19that shouldn't like that's starting from
33:22their biggest risk and yes you need to
33:23solve it and then like walk down from
33:26essentially from the right side to the
33:28left side and and the the more you put
33:31this those controls and if you have a
33:34fully automated pipeline and you say
33:36like okay this port should really not be
33:38open then Implement an automated check
33:40so that this is not going to happen on
33:42the next deploy because it can always
33:44happen so you can always work back and
33:47then also work from the other side it's
33:48it's I think it's like just
33:51the more the more checks you can apply
33:53earlier the more the less problems you
33:56have in production so the goal is to for
33:59you for us as humans have more time
34:01building the right thing and not do the
34:03same problem over and over again and you
34:06can only achieve that by moving
34:08essentially a lot of like checks more
34:11and more in the pipeline to the left but
34:13of course most likely if you haven't
34:15done anything you need to start on the
34:17right side so vulnerabilities and
34:18containers is good but even when you
34:20deploy to kubernetes like this container
34:23runs I don't know like depends on how
34:26you deploy it maybe a month maybe two
34:27months maybe three months and like new
34:29vulnerabilities are discovered so the
34:31time you scant it in the pipeline is so
34:33long ago that it's like you have
34:35probably way more like more stuff in the
34:37production so I think if you want to
34:40really be secure you need to do it in
34:42all stages
34:43um and and you just need to understand
34:45what's the biggest risk profile for your
34:48for your application and start from
34:50where working down from from that to to
34:53like further optimization
34:56yes and some security scanners take a
35:00lot of uh time and a lot of resources
35:02and as you mentioned if you have
35:04containers that run for for a long time
35:07probably can be a good practice to
35:11rebuild and redeploy even if nothing
35:15changes containers time to time yes yes
35:18yes and the the the like we have the
35:21open source following like the the
35:23industry normally tends to have one tool
35:26for one specific technology so the the
35:29mental overhead between switching
35:31between different tools I want tool for
35:33AWS one two four container one tool for
35:36misconfiguration and every tool Works
35:38slightly different so it's really really
35:40difficult for for us to just switch
35:42between all those tools because you need
35:44to know every tool every tool has a
35:46different rule say it has a different
35:47configuration it's like annoying and and
35:49this is why I we believe like this what
35:53we've seen with terraform like that is
35:55like that is missing in the security
35:57space and that's that's why we open
35:59source the inspect to essentially make
36:01make something like this available to
36:03everyone where we just have one approach
36:06we take this telephone approach bring
36:08this over to Security and make
36:09essentially have the same kind of
36:12automation for that as well
36:14um so we always have this check and
36:16balance where we have the one thing is
36:18doing something and configuring it and
36:20the other side is always checking so you
36:22have a really always a two like
36:24essentially it's a four eyes principle
36:25that you implement also with the tooling
36:27because you can't trust the tooling that
36:30that deploys something that is also
36:31doing it correctly so you always want to
36:33have different different tooling for
36:35deploying something and checking
36:37something so that you're always like 100
36:39sure yes like this this is going to be
36:42secure
36:43yes thank you for you very detailed
36:46answers as I see now for no questions
36:50more but probably somebody want to ask
36:53you directly something in our Discord
36:55chat
36:56sure thank you Valerie
36:59thank you Kristoff
37:03yes