A Call for Proactive Security at Rocky Mountain InfoSec 2017
I was fortunate to attend last week’s Rocky Mountain InfoSec Conference in Denver. It was my first time attending, and I was pleased with the diversity of the audience and the depth of content across the attendees and speakers. A couple standout sessions to me were a DevOps Engineer from Distil Networks explaining in detail how he built their corporate PKI using a number of open source tools, and then a few local government folks covering their harrowing experience monitoring systems during election night.
How DreamHack Used ScaleFT to Secure the World’s Largest Digital Festival
From humble beginnings as a local LAN party in Sweden, DreamHack has grown to become the world’s largest Digital Festival, bringing 20,000+ people together for a weekend of gaming, music, art, and more. The event is such a technological spectacle that it has even held a spot atop the Guinness Book of World Records for the fastest Internet connection, and most generated traffic. From an infrastructure perspective, the event is especially unique and impressive because the large scale environment is setup and torn down in a matter of days by a group of highly passionate volunteer SREs, who refer to themselves as dhtech.
How Rackspace Leverages ScaleFT to Provide Secure Fanatical Support
Fanatical Support is more than a catchy tagline, it’s a core tenet of the Rackspace culture as a leading managed service provider. For many companies, migrating workloads to the cloud and adopting the inherent technologies requires the right partner to guide them along the way. Rackspace has continued to prove that they have the domain expertise and support structure to be that trusted advisor for companies of all kinds. Rackspace offers a number of managed services & support options on top of the major public clouds – AWS, Azure, and Google Cloud (coming soon).
A New Category is Born: Cloud Access Management
As we at ScaleFT near the two-year mark on our journey to reimagine how companies secure their sensitive resources, today was an exciting day for our industry as Okta went public with a strong first day showing. The public market has rewarded them, not only for their amazing performance as an Identity Provider for SaaS applications, but also because of the recognition that we’re approaching a decades-long growth opportunity – one that stems from a paradigm shift away from security architectures that rely solely on the network perimeter towards a cloud-based model largely based on the principles of Zero Trust.
Google Security Talks during RSA Conference 2017
For many years, the RSA Conference has been the security event that best represented the whole of the vendor ecosystem – good and bad. Those who dare enter the expo hall are met with an onslaught of swag and pitches, where the former justifies the latter. This year was no exception, with hundreds of vendors, sessions, and parties spread out over the week. The agenda was so deep that OneLogin built a dedicated website just for all the parties.
Usenix Enigma 2017 - Closing the Gap Between Security and Usability
I attended the Usenix Enigma conference this week in Oakland, which brought together some of the brightest minds in security across academia, government, and business. After watching a few of the videos from last year’s conference, I wanted to be there in person this time around. Everything about the conference was top-notch, with a diverse and thoughtful community really coming together for the greater good. A major theme echoed across the conference, from the sessions to the hallways – usability.
Google's Infrastructure Security Design Revealed
In recent years, Google has put tremendous effort into creating a security architecture that better maps to their global organization, the scale at which they operate, and the products that they offer. The BeyondCorp papers that we often reference here at ScaleFT have provided insight into their practices for how employees access protected resources, and now we’re fortunate to be presented an in-depth view into how they secure their entire infrastructure through the publication of a new whitepaper - Google Infrastructure Security Design.
Real World Crypto 2017: Day 3
This is the third and final post describing my favorite talks from Real World Crypto 2017. If you haven’t already, check out my previous posts: Day 1 Day 2 Video recordings from RWC 2017 are available here. The Physics of Building a Quantum Computer Evan Jeffrey from Google kicked off the day by discussing Google’s project to build a quantum computer. This talk was interesting for putting the post-quantum crypto talks from day one into real-world perspective.
BeyondCorp is security for the Cloud Native organization
The term Cloud Native usually references application-centric tools and patterns, so what does it mean to be a Cloud Native organization? It begins with the awareness that being a software company goes beyond simply making technology choices – it’s about creating a culture of innovation across the entire company that fully supports the release of software at a rapid pace through tight-knit collaboration and well-oiled processes. This represents the new face of IT, driving the business forward by tackling the ever-changing demands of the customer head on.
Real World Crypto 2017: Day 2
Yesterday I published my thoughts on some of my favorite talks from Day One of Real World Crypto 2017. The following are some highlights from Day Two. 0-RTT Key Exchange with Full Forward Secrecy In recent years two desirable properties for transport security have come to prominence: The first is Zero-RTT Key Exchange, which enables clients to securely send data to a server without waiting one or more round trips for a key exchange to complete.