Hello BOB - Cloud Native Cybersecurity with Bill of Behaviors with Constanze Roedig

https://is1-ssl.mzstatic.com/image/thumb/Podcasts211/v4/4a/fe/1c/4afe1c67-770d-b299-a29c-4e0ae8171b43/mza_6179291306106283136.jpg/600x600bb.jpg

PurePerformance

322 episodes

1 week ago

The brutal truth about digital performance engineering and operations.

Andreas (aka Andi) Grabner and Brian Wilson are veterans of the digital performance world. Combined they have seen too many applications not scaling and performing up to expectations. With more rapid deployment models made possible through continuous delivery and a mentality shift sparked by DevOps they feel it’s time to share their stories. In each episode, they and their guests discuss different topics concerning performance, ranging from common performance problems for specific technology platforms to best practices in development, testing, deploying and monitoring software performance and user experience. Be prepared to learn a lot about metrics.

Andi & Brian both work at Dynatrace, where they get to witness more real world customer performance issues than they can TPS report at.

Technology

RSS

All content for PurePerformance is the property of PurePerformance and is served directly from their servers with no modification, redirects, or rehosting. The podcast is not affiliated with or endorsed by Podjoint in any way.

Technology

https://d3wo5wojvuv7l.cloudfront.net/t_rss_itunes_square_1400/images.spreaker.com/original/09c519d8dbe8032d8ca3140cea272914.jpg

Hello BOB - Cloud Native Cybersecurity with Bill of Behaviors with Constanze Roedig

PurePerformance

27 minutes

1 month ago

Hello BOB - Cloud Native Cybersecurity with Bill of Behaviors with Constanze Roedig

On September 8 the world saw the npm supply chain attack. Fortunately the community reacted in record time to avert a disaster.
In todays episode we have Constanze Roedig, Key Researcher at SBA Research, who introduces us to the new buddy of SBoM (Software Bill of Materials): SBoB (Software Bill of Behaviors) and her thoughts on how that new approach to fingerprinting software can help cyber security teams.
What's a BoB? It's a detailed runtime behavior profile of software. It expands on the static validation option through SBOMs as it allows security teams to validate the correct execution behavior of deployed software at deploy time or continuously in production. Thanks to eBPF, a malicious behavior such as opening non expected ports or accessing non expected files can therefore be detected.
Listen to Constanze who shares the work she and Vadim Bauer, Owner of 8gear, have done on this topic. You will learn about how software vendors can create their own SBOBs, ship them with their container images and how security teams can get alerted or enforce any detected malicious behavior. Make sure to check out their GitHub repo, star it if you like it and try their hands-on tutorial!

Links:
Constanze LinkedIn: https://www.linkedin.com/in/croedig/
Vadim LinkedIn: https://www.linkedin.com/in/vadim-bauer/O
BobCtl GitHub Repo: https://github.com/k8sstormcenter/bobctl
Cloud Native Summit Munich Talk: https://www.youtube.com/watch?v=XETuwndd_mw&index=11&pp=iAQB
npm supply chain attack: https://www.infosecurity-magazine.com/news/npm-supply-chain-attack-averted/