There are two pitfalls to avoid when writing a “year ahead” post. The first is writing a really boring article that just says “everything next year will be the same as last year.” Cool, nobody needed to read that. The second is making all dark horse predictions and advising your

For many organizations, the holidays bring a massive peak in activity. Retailers famously look to this time of year to finish in the black, expecting their largest wave of foot traffic and online orders during the 4-5 weeks between Thanksgiving and Christmas. Nonprofit organizations see a similar pattern, with December

Collaboration and community are important to me as I tackle any goal; whether it’s organizing dozens of visitors for the family holidays or helping a customer CISO solve an urgent business challenge. Throughout my years in the security industry, this mentality has led to a number of close relationships

KSOC, the platform designed to make Kubernetes secure by default, has taken another step toward transforming security for Kubernetes environments. With this release, customers now have more context around security issues and flexibility in responding to them. These advancements will help security teams tackle the challenge of Kubernetes security at

There are several components trying to interact with a Kubernetes API. From users to engineers to other applications, the list can be large and multi-tenancy is in full swing. With so many factors (people, apps, etc.) attempting to access a Kubernetes API, how can you control who (or what) can

KSOC [https://www.ksoc.com/], an event-driven SaaS technology built to quickly find and automatically remediate Kubernetes misconfigurations and security issues, announced today at KubeCon + CloudNativeCon North America 2022 enhancements to their Kubernetes security platform which are addressing the needs of organizations adopting Kubernetes. KSOC’s unique approach to Kubernetes

Regardless of where your Kubernetes cluster is running, whether it’s in the cloud with a Managed Kubernetes Service, on-prem with something like Kubeadm, or a raw Kubernetes cluster, you must ensure that what’s happening inside of your cluster is known by you and the appropriate parties (like the

Kubernetes for many organizations is this giant box of mystery. Engineers sort of know what’s running, but at the same time, they use a third-party tool and before they know it, there’s a service account running the third-party tool with full-blown admin access to every Kubernetes resource inside

From the desk of KSOC's security research team: The Kubernetes development team received reports that the Kubernetes API may have a Server Side Request Forgery vulnerability when using aggregated API servers. The team promptly patched multiple versions of Kubernetes in order to help remediate the issue, leaving it to Kubernetes

Individual engineering teams care about security, but typically for the platform or application architecture they’re working on. CISOs on the other hand must care about all security that’s happening inside of an organization. From infrastructure teams to application teams, the CISO is ultimately responsible. When it comes to

Most security breaches start with a faulty service account, password breach, or overlook of permissions given to a user or a service account. It could be any type of security breach from a fishing scam to a brute force attack. This occurs because there’s a major oversight to how

Thinking about when to implement security for Kubernetes is much like any other field of technology. If you’re a Systems Administrator or Infrastructure Engineer, you must understand certain platforms and systems prior to securing them. For example, if you’re running workloads in ESXi, you must first understand ESXi

Standard best practices for software development ask you to follow a ton of testing standards. From unit tests to mock tests to security tests with tools like Sonarqube and Veracode from a security static analysis perspective. When Infrastructure-as-Code and configuration languages started coming out, those same standards weren’t followed,

A recent article [https://www.bleepingcomputer.com/news/security/over-900-000-kubernetes-instances-found-exposed-online/] showed that over 900,000 Kubernetes endpoints (API servers) are sitting publicly on the internet. If you think that’s bad, remember that a Kubernetes API server being public is only about 5-10% of the security concerns that happen in

By Brooke Motta, CEO It’s my privilege to announce that — KSOC has raised $6 million in seed funding! I am thrilled to work alongside an incredible team of investors, advisors, customers, colleagues and thought leaders. It’s an exciting time. Many organizations have adopted cloud-native architectures, and according to