Ramblings of a Unix Geek

A number of years back I saw a mail thread around Java performance.

If you’ve ever built any enterprise level system you’ll be aware of the needs of performance and resiliency.

WARNING: technical content ahead!

One of the golden rules of IT security is that you need to maintain an accurate inventory of your assets.

A while ago I wrote about some of the technology basics that can be used for data persistency.

We’re all used to using passwords as an authenticator.

Let’s say you run an ecommerce web site.

Identity and Access Management (IAM) historically consists of the three A’s Authentication What acccount is being accessed?

Over on Twitter, @TinkerSec live tweeted a pentest and created a moment thread of it.

Many people are at a large risk of a phishing attack.

Part of any good backup strategy is to ensure a copy of your backup is stored in a secondary location, so that if there is a major outage (datacenter failure, office burns down, whatever) there is a copy of your data stored elsewhere.

The ELF format is pretty common across various unix versions, having superseded previous binary formats such as a.out and COFF.

One of the major threats that companies are concerned about is “insider threat”.

A typical cloud engagement has a dual responsibility model.

The Siphonaptera has various versions.

There is a temptation in computer security circles to aim for the perfect.

There’s an old comment; “A Lie Can Travel Halfway Around the World While the Truth Is Putting On Its Shoes”.

Sometimes we can learn a lot from nursery rhymes; I’ve previously shown how A Hole In My Bucket can teach us about understanding problems and how this can lead to security issues.

Recently we heard news that the police had requested Alexa recordings to assist with a murder enquiry.

This blog post is of a more practical nature, and may be of use for people at home who ssh into servers and then come back later to find their session disconnected.

Have you tested your backups recently?

In previous posts I pointed out why TLS is important, how to configure Apache to score an A+ and how to tune HTTP headers.

A few months back I was invited to an RFG Exchange Rounds taping, on containers.

A couple of weeks back I got a new case for my PC.

Containers aren’t secure… but neither are VMs An argument I sometimes here is that large companies (especially financial companies) can’t deploy containers to production because they’re too risky.

My home server I was doing an upgrade on my home “server” today, and it made me realise that design choices I’d made 10 years still impact how I build this machine today.

In previous posts, and even at Cloud Expo, I’ve been pushing the idea that it’s the process that matters, not the technology when it comes to container security.

In previous articles I’ve explained how to use traditional SSH keys and why connecting to a wrong server could expose your password.

Modern web browsers have a number of settings to help protect your site from attack.

(Side note: in this post I’m going to use TLS and SSL interchangably.

In my previous post I wrote about some automation of static and dynamic scanning as part of the software delivery pipeline.

In many organisations an automated scan of an application is done before it’s allowed to “go live”, especially if the app is external facing.

In an earlier blog I wrote that SSH keys need to be managed.

Over on the Unix/Linux Stackexchange someone asked if ssh’ing to the wrong machine could cause their password to be exposed.

What is a HSM?

SSH is probably the most common method of logging into Unix machines over a network connection.

Something I’ve been pushing (and this is pretty much a truism amongst anyone who’s looked at “Cloud”) is the idea of automation.

In a previous blog entry I described some of the controls that are needed if you want to use a container as a VM.

In a lot of this blog I have been pushing for the use of containers as an “application execution environment”.

A phrase you might hear around cloud computing is lift and shift.

In this glorious new world I’ve been writing about, applications are non persistent.

A fair number of security advisories mention Man In The Middle (MITM) attacks.

In my spare time I’ve been playing on Unix StackExchange.

Sesh Murthy from Cloud Raxak asked me to co-present at Cloud Expo NY June 2016.

Containers and other elastic compute structures are good ways of deploying applications, especially if you follow some of the guidelines I’ve made in other posts on this topic.

A major problem many environments have is a lack of real network control inside the perimeter.

This is the content of a presentation I put together for Cloud Expo NY 2016.

Back in 1984 I thought I was pretty good at writing programs for my BBC Micro.

In previous posts I’ve written about small containers; don’t bundle a whole OS image with your app, just have the minimum necessary files and support.

Building a secure web application has multiple layers to it.