Latest from Elizabeth
DevOps and the Dark Pools of Security Technical Debt
We live in a world of digital transformation where organizations across industries are embracing initiatives around automation, cloud deployments and containerization of applications—and for good reason. Enabling transformative technologies such as DevOps, for example, can deliver superior product differentiation, faster time to market for new applications and services and an improved overall customer experience. A […]
Sep 18, 2018 · 3 minAll articles by Elizabeth Lawler
Showing 1–4An open-source pipeline for trusted images
There are a lot of good reasons to use a trusted image (aka “foundation image”), including reliability, reduced time to launch, secure configuration. [We’ve discussed them previously] In this article we are going to describe a development and quality assurance process for making trusted (aka “foundation” or “golden”) images. First, this is the tool set […]
Trust and Computers Make the News
The Heartbleed bug in OpenSSL was major news this week. While you are waiting for sudo apt-get dist-upgrade to run on all your servers, let’s take a minute to reflect on how the SSL trust system works and about the kinds of system relationships that depend on it. Just to recap, SSL-based trust derives from […]
Trust & the trusted image
What is Your Trust Model? Information security conversations often start with the question “What is your threat model?” This blog asks: “What is your trust model?”. Trust is a complex subject and an integral part of managing DevOps-oriented organizations and highly automated IT infrastructures. Who (developers, ops) or what (code, process) is trusted to accomplish […]