InfoQ Homepage Cloud Security Content on InfoQ
-
/articles/serverless-tenant-isolation/en/smallimage/logo-1650311080845.jpg)
Designing Secure Tenant Isolation in Python for Serverless Apps
Software as a Service (SaaS) has become a very common way to deliver software today. While providing the benefits of easy access to users without the overhead of having to manage the operations themselves, this flips the paradigm and places the responsibility on software providers for maintaining ironclad SLAs, as well as all of the security and data privacy requirements.
-
/articles/assessing-security-risks/en/smallimage/logo-1648281937034.jpg)
Strategies for Assessing and Prioritizing Security Risks Such as Log4j
The evolving threat landscape requires a comprehensive approach to mitigation. An effective strategy is built on visibility, assessing vulnerabilities in context, effective use of filtering technologies, and monitoring for evidence of intrusion.
-
/articles/emerging-software-vulnerabilities/en/smallimage/logo-1648107648928.jpg)
Insights into the Emerging Prevalence of Software Vulnerabilities
The software exploit landscape is constantly evolving and organizations need to be structured to stay ahead of these risks. A solid platform built on software best practices, education, and a good understanding of the threat landscape is critical to a strong defensive posture.
-
/articles/securing-docker/en/smallimage/logo-1645479973420.jpg)
Is Docker Secure Enough? Advice for Configuring Secure Container Images and Runtimes
Ensure that Docker is secure enough by fine-tuning the security approach to meet your use cases. It is important to have an understanding of the differences between the Docker image and the Docker runtime and the security implications and priorities for each. This article covers a number of techniques for ensuring appropriate security for Docker.
-
/articles/buildpacks-software-supply-chain/en/smallimage/logo-1633347463775.jpg)
Using Cloud Native Buildpacks to Address Security Requirements for the Software Supply Chain
Software supply chain attacks are increasing in severity and frequency, with no clear path laid out towards its mitigation. A simple way to trace the origin of vulnerable components is available in the form of Software Bill Of Materials (SBOMs), generated automatically when using Buildpacks.
-
/articles/DevSecOps-shiftleft-cybersecurity/en/smallimage/logo-1632922735916.jpg)
Virtual Panel: DevSecOps and Shifting Security Left
Recent attacks, that targeted SolarWinds, Colonial Pipeline, and others, have shown that development environments come ever more frequently on the radar of malicious actors. A virtual panel on the value of shifting left security, how to take responsibility for it, and the time-to-market pitfalls.
-
/articles/devsecops-supply-chain/en/smallimage/devsecops-key-to-securing-your-supply-chain-small-image-1626439698918.jpg)
DevSecOps: the Key to Securing Your Supply Chain in a Multi-Cloud Threatscape
Recent supply chain attacks require businesses to re-evaluate their approach to DevOps, specifically as it relates to security. The DevSecOps focus CI/CD platforms, testing and scanning across the SDLC, and a focus on minimizing manual efforts can not only improve security postures but also improve delivery of business value.
-
/articles/oerhlich-devops-culture/en/smallimage/eveline-oerhlich-on-building-an-effective-devops-culture-small-1621521013730.jpg)
Q&A with Eveline Oerhlich on Building an Effective DevOps Culture
The DevOps Institute recently released their latest report entitled "Upskilling 2021: Enterprise DevOps Skills Report". The report found that automation and security remain vital to business success. A focus on building the human skills of DevOps was also identified as companies with the best learning cultures were most likely to succeed.
-
/articles/access-management-reference-architecture/en/smallimage/logo-cloud-1618952496411.jpg)
A Reference Architecture for Fine-Grained Access Management on the Cloud
In this article, we will define a new reference architecture for cloud-native companies that are looking for a simplified access management solution for their cloud resources, from SSH hosts, databases, data warehouses, to message pipelines and cloud storage endpoints.
-
/articles/devops-secure-trends/en/smallimage/logo-devsecops-1618321217229.jpg)
Nine Trends That Are Influencing the Adoption of Devops and Devsecops in 2021
While it’s important to recognize the value of both DevOps and DevSecOps, they are not one-size-fits-all, monolithic, permanent paradigms. In this article, we’ll take a look at that ongoing development – isolating and explaining nine key trends that are driving and changing the adoption of DevOps, DevSecOps, and a number of related approaches to development and management.
-
/articles/book-review-cyber-securities/en/smallimage/cybersecurity-logo-small-1607015545941.jpg)
Q&A on the Book Cybersecurity Threats, Malware Trends and Strategies
The book Cybersecurity Threats, Malware Trends and Strategies by Tim Rains provides an overview of the threat landscape over a twenty year period. It provides insights and solutions that can be used to develop an effective cybersecurity strategy and improve vulnerability management.
-
/articles/secure-edge-systems/en/smallimage/secure-edge-systems-s-1586969874758.jpg)
Deploying Edge Cloud Solutions without Sacrificing Security
Security challenges exist with edge cloud solutions. Some are technical, and some relate to the way in which these services are used. This article looks at the why, what, and how of edge security.