Integrating threat modeling with DevOps
“Reflections on how it is possible to adopt threat modeling more effectively and efficiently, integrating it with modern DevOps methodologies and tools, and focusing on the value provided to all the various actors involved with the Software Development Lifecycle.” (from CloudSecList)
Threat Modelling Cloud Platform Services by Example: Google Cloud Storage
“A threat modelling exercise from NCC which demonstrated that user/tenant configuration choices matter when evaluating the overall security posture of an instance of Google Cloud Storage, and that a number of relative weaknesses can be improved through deliberate choices on behalf of the user.” (from CloudSecList)
We invested 10% to pay back tech debt; Here’s what happened
“A discussion of technical debt, both what it is, how it comes about, and looking at setting aside time on a recurring basis to continually pay it down.” (from Devops weekly)
Consider All Microservices Vulnerable – And Monitor Their Behavior
“Although all deployed microservices are vulnerable, there is much that can be done to ensure microservices are not exploited.” (from CloudSecList)
Getting Started With Java Development in 2023 — An Opinionated Guide
How do you get started with developing in Java? This post provides a nice opinionated introduction to the large Java ecosystem.
Build AWS Lambda Container Image with AWS CDK
A walkthrough of how to build a container image to run on AWS Lambda using AWS CDK.
Cloud Native and Kubernetes Security Predictions 2023
A speculative look into the perils and opportunities that 2023 holds for cloud native security. (from CloudSecList)
Risk Assessments for AWS Access are Not Just for Large Companies
Who has access to production? Who should have access to production? This post provides some advice on a method for doing a risk assessment. Some of this is specific to AWS and IAM, but much is applicable to any setup.
Leave a Reply