archived the channel

Has anyone successfully compiled and maintained prometheus-server with boringcrypto (or other security module that provides FIPS that is NIST validated)?

For keeping up with CVEs and Hotfixes, I’m curious if any one keeps separate “maintenance” environments for that fast development/testing.

For a simple example, lets say you have environments:
• dev
• test
• stage
• prod
But then you get a CVE which needs to be patched fast, but there are unstable/unapproved features in dev+test:
• so you can’t promote the current build up to stage/prod, even if it is patched
Instead you need another “maintenance” environment which holds the same version as stage+prod and you do any hotfix/CVE testing there.
In my case, I’d need 2 environment: “maintenance dev” and “maintenance test”

@Shreyas has joined the channel

Anyone have recomendations on tooling for Compliance as Code? I used chef inspec like 5 years ago to implement controls for AWS accounts. It was quite nice for being "compliance" oriented and using a real programming language. I'm not sure of the future of inspec along with it's licensing change, is there something else comparable. Has compliance as code progressed at all? What resources can I consume to get ramped up on the current state of affairs. Everything I've found so far makes me think the whole movement died 2 years ago.

@jonjitsu has joined the channel

(Continuing SIEM discussion from office-hours)
Another great tool for SIEM related activities is Falco.
https://falco.org/
https://github.com/falcosecurity/falco

It came from SysDig and is CNCF Incubation.

https://sweetops.slack.com/archives/CHDR1EWNA/p1687980845340909

@Marcin has joined the channel

@Sam has joined the channel

@Soren Jensen has joined the channel

@Hans D has joined the channel

Another Security/Compliance tool to consider. Early version of it.
Goal is to audit clusters against the “EKS Best Practices Guide (EBPG)“:
https://aws.amazon.com/blogs/containers/hardeneks-validating-best-practices-for-amazon-eks-clusters-programmatically/

@Alanis Swanepoel has joined the channel

@Tom Atwood has joined the channel

@Justin Erny has joined the channel

@James has joined the channel

@Fizz has joined the channel

@Jeff May has joined the channel

I'm curious about how you folks, if you use RDBMS, manage the credential rotation requirements --

yeah, we do fedramp and ISO -- and one more iirc

Thanks for starting the channel. I’m required to meet nearly all the compliance/authorization types. (ISOs,SOCs,PCI,HiTrust,FedRAMP, …).

@Jim Conner has joined the channel

@Sean has joined the channel

@Hao Wang has joined the channel

Little background on us: 3Play Media Inc. takes in audio and video and processes it with combination of AI (really, ML, but who’s counting when “AI” is the hot hype word) and human review/correction to produce captions, subtitles, transcripts, audio descriptions, and other accessibility enhancements. We are Cloud Posse graduates (i.e. now in production). Our cloud product, the 3Play Platform, passes SOC 2 and GAAS audits and pentest on our EKS infrastructure/estate. Another part of 3Play passes separate TPN (Motion Picture Association) audit more oriented to on-prem processing model. We are also HIPAA, GDPR, CCPA/CPRA, FERPA, and Microsoft SSPA compliant (but we don’t formally audit against those). We’re consistently looking to harden and lock down (partly for security, partly to meet ever-rising, ever-encroaching customer demands esp. from media, entertainment, finance, and government customers/prospects). Currently using OneTrust Certification Automation (great for past 2 years, but seems to have stalled after Tugboat was acquired). Looking to upgrade program to better align with NIST SP 800-53 and friends and/or ISO 27001 (in addition to SOC 2 and TPN). We’ve talked about doing FedRAMP and have been requested to meet several crazy-deep custom finance infosec/GRC frameworks. They feel above our current station/capabilities, but we’re edging that direction to prepare for a future deal for which the business says “okay, it’s now worth it to comply, get going!”

Yesterday’s discussion on FedRAMP, compliance != security, and related topics was excellent. Good to know I’m not struggling with these things alone.

set the channel description: Discuss topics related to compliance. See also #security.

set the channel description: Discuss topics related to compliance.

@Jonathan Eunice has joined the channel

@Ozzy Aluyi has joined the channel

@Erik Osterman (Cloud Posse) has joined the channel