InfoQ Homepage Security Content on InfoQ
-
/articles/k8s-external-secrets-operator/en/smallimage/logo-1659173750849.jpg)
Managing Kubernetes Secrets with the External Secrets Operator
Kubernetes doesn’t yet have the capabilities to manage the lifecycle of secrets, so sometimes we need external systems to manage this sensitive information. Once the amount of secret information we need to manage increases, we may need additional tools to simplify and better manage the process. In this article, we’ll take a detailed look at one of these tools, the External Secrets Operator.
-
/articles/devops-automation-workforce-shortages/en/smallimage/logo-1657557657269.jpg)
Using DevOps Automation to Combat DevOps Workforce Shortages
A focus on automation can help to combat the current staffing struggles many organizations have with DevOps roles. Effective automation can reduce the toil experienced by developers. Automation efforts should focus on security operations, deployments, continuous delivery, QA testing, and continuous integration.
-
/articles/secure-mobile-apps-parity-problem/en/smallimage/logo-1657020856056.jpg)
The Parity Problem: Ensuring Mobile Apps are Secure across Platforms
The problem of security parity is a big one, but it’s part of a larger problem: a general lack of security in mobile apps. By embracing automation for security implementation to the same or greater degree than it has been adopted for feature development, developers can ensure that every app they release for every platform will be protected from hackers, fraudsters, and cybercriminals.
-
/articles/zero-trust-security/en/smallimage/logo-1655816786121.jpg)
Diving into Zero Trust Security
The Zero Trust approach involves a combination of more-secure authentication approaches, such as MFA with profiling and posturing of the client device, along with some stronger encryption checks. This article shares some insights on Zero Trust Security for your organization and your customers, and how you can get started with it.
-
/articles/devops-and-cloud-trends-2022/en/smallimage/InfoQ-Trend-Report-logo-small-1648721970880-1655385008093.jpeg)
DevOps and Cloud InfoQ Trends Report – June 2022
This article summarizes how we see the "cloud computing and DevOps" space in 2022, which focuses on fundamental infrastructure and operational patterns, the realization of patterns in technology frameworks, and the design processes and skills that a software architect or engineer must cultivate.
-
/articles/devsecops-policy-management/en/smallimage/evolving-devSecOps-to-include-policy-management-small-image-1653470095778.jpg)
Evolving DevSecOps to Include Policy Management
A thorough implementation of policy management tools is required for effective compliance and security management in a DevOps environment. Companies that accept policy management in DevSecOps as a way of development and have adopted some level of policy management best practices tend to operate more efficiently.
-
/articles/what-why-programmable-proxies/en/smallimage/logo-1652716879366.jpg)
The What and Why of Programmable Proxies
A question which gets often asked is “What is a programmable proxy, and why do I need one?” This article tries to answer this question from different perspectives. We will start with a brief definition of what a proxy is, then discuss how proxies evolved, explaining what needs they responded to and what benefits they offered at each stage. Finally, we discuss several aspects of programmability.
-
/articles/devops-cloud-security/en/smallimage/iLukXSvI-1650439607166.jpg)
The Role of DevOps in Cloud Security Management
Different areas of cloud security must be examined to strengthen security in the cloud versus security of the cloud. This includes identifying requirements, defining the architecture, analyzing controls, and identifying gaps. Security must be both proactive and reactive, so it needs to be considered in every step of development.
-
/articles/serverless-tenant-isolation/en/smallimage/logo-1650311080845.jpg)
Designing Secure Tenant Isolation in Python for Serverless Apps
Software as a Service (SaaS) has become a very common way to deliver software today. While providing the benefits of easy access to users without the overhead of having to manage the operations themselves, this flips the paradigm and places the responsibility on software providers for maintaining ironclad SLAs, as well as all of the security and data privacy requirements.
-
/articles/assessing-security-risks/en/smallimage/logo-1648281937034.jpg)
Strategies for Assessing and Prioritizing Security Risks Such as Log4j
The evolving threat landscape requires a comprehensive approach to mitigation. An effective strategy is built on visibility, assessing vulnerabilities in context, effective use of filtering technologies, and monitoring for evidence of intrusion.
-
/articles/emerging-software-vulnerabilities/en/smallimage/logo-1648107648928.jpg)
Insights into the Emerging Prevalence of Software Vulnerabilities
The software exploit landscape is constantly evolving and organizations need to be structured to stay ahead of these risks. A solid platform built on software best practices, education, and a good understanding of the threat landscape is critical to a strong defensive posture.
-
/articles/securing-docker/en/smallimage/logo-1645479973420.jpg)
Is Docker Secure Enough? Advice for Configuring Secure Container Images and Runtimes
Ensure that Docker is secure enough by fine-tuning the security approach to meet your use cases. It is important to have an understanding of the differences between the Docker image and the Docker runtime and the security implications and priorities for each. This article covers a number of techniques for ensuring appropriate security for Docker.