A recent Microsoft threat intelligence report called attention to "living off the land" techniques. I thought it would be interesting to see how containers and containerised applications inherently help to mitigate these techniques.

Living off the land and containers

Keycloak can support some interesting authentication and authorisation flows, one of which is creating users and assigning roles ahead of upstream identity provider authentication.

Pre-creating users and roles in Keycloak

Sigstore is an open source project enabling anyone to sign and validate software releases, including container images. This article takes a closer look at Sigstore and some of the innovation happening around the project.

Sigstore - Signature Sorcery

A recent FortiOS vulnerability is being actively exploited. Ansible can be used to implement a mitigation.

Automating Fortinet FortiGate devices with Ansible

Did you know that you can create Ansible playbooks with ChatGPT?

Creating Ansible playbooks with ChatGPT

In the last article I looked at automating some of the tests available for Windows servers and desktops in the ACSC Essential Eight assessment guide. This article looks at how we can measure assessment activity - how often are we assessing systems, and are they passing the tests?

Measuring Essential Eight Assessment Activity

Recently the Australian Cyber Security Centre released an Essential Eight assessment guide. This article looks at automating some of the tests in the guide with Ansible.

Automating the Essential Eight Assessment Guide

Ansible provides a way to automate functional verification tests. This article looks at an improved approach to automating functional verification tests that I introduced in an earlier article.

Improved Functional Verification Testing with Ansible

Functional verification provides a way that we can attest to the configuration of a device or system, and verify compliance controls. This article looks at a functional verification approach using Ansible.

Functional Verification Testing with Ansible

What do you do when you need to give away swag, but don't have a wheel? You build one on OpenShift!

The Red Hat Swag Wheel at Gartner

A quick look at the File Access Policy Analyzer, an open source tool simplifying application control implementation

Up and running with the File Access Policy Analyzer

RSA Conference 2022 again highlighted that many data breaches are due to unpatched systems. In this article I look at some of the technologies available to help organisations ensure that updates are applied across their hybrid cloud environments

Automated security patching with Ansible

Application control is a critical security control, allowing you to specifically authorise applications, processes and shared libraries. This blog introduces some ofthe resources you can use to learn more about application control, and get hands-on.

Hands-on with Application Control for Linux

Many organisations take the same approach to securing virtual machines, which I call 'Access & Agents'. While effective for virtual machines and other legacy infrastructure, this approach doesn't translate across to containers and Kubernetes, and this article looks at why.

Access & Agents

Did you know that you can scan the internal OpenShift registry for security issues? Read on to find out how.

Scanning the OpenShift Internal Registry

A quick guide on how to integrate a Kubernetes-native security platform with quay.io private repositories

Scanning Quay.io private repositories for CVEs

Automation allows organisations to scale security workflows across hybrid cloud environments. In this article I take a closer look at automating application control, and how you can use Ansible roles to create reusable automation content.

Automating application control

What's the difference between institutional and industry knowledge, and what can you do to bring these into balance?

Maintaining a knowledge balance

What does it mean to be "Kubernetes-native"? And what does Kubernetes-native security look like?

Kubernetes-native security and least surprise

Injecting integrity checks to application control processes is a winning security combination. Application control allows you to specify that only certain processes can execute on a system - but how do you know they are the right processes? How can you ensure that the code that you want to execute is the code that actually executes?

Application control and integrity checks

Application control seems to be one of those elusive security controls that organisations spend years chasing. How can we validate which processes are authorised to run on a system, and then enforce this?

Application control for everyone

How do you protect your threat intelligence sharing platform from compromise? Read on to learn how SELinux and podman can support a containerised MISP deployment.

Open source threat intelligence and SELinux

Compliance evokes images of checking boxes. The real purpose of IT system compliance is risk migitation, and it probably just needs a better name

All Posts

Living off the land and containers

Pre-creating users and roles in Keycloak

Sigstore - Signature Sorcery

Automating Fortinet FortiGate devices with Ansible

Creating Ansible playbooks with ChatGPT