Diego Pacheco Tech blog

Security Matters. How do you know you are secure? One of the many practices is to run Threat Analysis considering attacking vectors.  Threat Modeling should be a continuous activity. Movements like DevSecOps aim to put security on the day-to-day work. Cybersecurity Ventures predicts costs will grow 15% per year over the next five years reaching 10.5 Trillion USD by 2025. Security is a never-ending game. Security is something companies will need to do forever. IF they cost more and more, maybe we should get better and learn more about security. Lack of security can destroy a brand, and damage the customer's trust and relationship with your solutions. Security is difficult because it cannot be fixed in a central place with one tool, it requires principles and continuous fighting. There are infinite amounts of attack vectors. Common attacking vectors include compromised credentials: users/passwords, weak credentials: low entropy passwords, Insider Threats: from bad actors,  Mi...

IAM is one of the most powerful tools in AWS. IAM is centralized and super powerful. However, IAM can be pretty complex. IAM is all about managing access to resources and services in AWS. AWS IAM is for free, meaning free of charge but you will pay(of course) by other services you end up using for computing and storage. IAM is made for fine-grained access control, with MFA, Active Directory Integration, and much more. AIM has auditing capabilities integrated with AWS Cloud Trail. IAM allows us to create individual users, groups, and credentials that should be rotated often. Today I want to share a slidecast about IAM. So Let's get started.

Encryption is super important nowadays.  However, it is straightforward to end up making the wrong choices and compromising your brand and customer experience. AWS CTO Warner Vogels once said Security is everybody's job. Today I want to share another Slidecast I made about Encryption. We will do a Deep Dive into the Encryption problem space, and also, we will see how to do the basics with Java Standard JDK. No Matter if you are a DevOps Engineer or Engineering, you might found this useful. I will cover Symmetrical encryption in-depth, RNGs, PRGNs, AES, AES Operational Modes, Rotation Challenges, AWS KMS, Java Code, and more. So without further due, let's get started! 

Security is the new black. Years ago Tests were not widespread as they are today and the same happened with DevOps where automation, Infra as Code, Versioning become the norm today. However, for security, we are not there yet. I believe this will change in the next years and more and more security is a concern where the teams need to care about and understand more about. Security can be pretty scary but at the same time is not rocket science and you can learn it for sure. Today I made a slidecast which I want to share with you guys and go over the security principles, common vulnerabilities and attack vectors, culture, trends, and much more. So Let's get started!

Threat Analysis is not a new concept. It's being around since the 90s. Threat Modeling is becoming more popular thanks to the DevSecOps movement. There are several other open-source Modeling tools such as  OWASP Threat Dragon and  Microsoft Threat Modeling Tool.  Threagile is an agile and open-source tool for Threat Modeling. The cool thing about Thredagile is that the tool is based on declarative modeling using YAML files. Threagile is built with Go language. One big advantage of open source software is that we can always look at the source code and even change it if we need it(i.e Understand how the RAA score works ). Security awareness is something that still needs to be work with engineering and product teams. This tool is a great way to tear down walls between InfoSec and engineering. Threagile is also dockerized making it very easy to use and play with it. Easily you can version the YAML file in your service repository and generate the reports as part of your J...

Security it's super important. Unfortunately, security is often forgotten and the price comes at scale and harassment to your brand and user experience. Spring-Boot is super popular among java solutions in the tech industry at the same time people often run servers without proper TLS configured. There is much mysticism and wrong vision about security. Secure Spring Boot using Tomcat for instance is not hard at all.  Today I want to share a video and code I made showing how we can secure the Spring-Boot 2.x application using Tomcat 9 and doing redirects where users try to reach 8080 port. Customers facing apps should definitely use TLS and HTTPS. However, it's so easy to do for the backend and the overhead is not that bad that we should do it as well. So let's get started. 

Regulated Industries like Financial/Fintech, Insurance/Insuretech, HealthCare/HealthTech requires more care in sense of security. However pretty much everybody else It's very likely your PII(Personal Identifiable Information) will be in form of plaintext(unencrypted) in your databases. When I use the word Encryption I mean Symmetrical encryption. Asymmetrical encryption often used for Certificates and Files. When we have data in our Datastores(Relational, Non-Relation, New-SQL, or BigData) we often rely on symmetrical encryption. Symmetrical encryption is being around for many decades. AES (Advanced Encryption Standard) is one of the most Standards. So if there are standards why encryption is hard? Security/Encryption it's a cross-cutting concern which is hard for lots of reasons and also ends up introducing other engineering challenges. Cloud computing also it's another force that will eventually more and more push companies to deal with security and therefore encryption. 

DevOps, as movement and set of principles, did a great job making Operations and development the same integrated thing pretty much. However, industry-wide implementations are not quite there. There is an overlap with SRE(Site Reliability Engineering), and quickly you find DevOps Engineerings, DevOps Architects, DevOps Directors, DevOps Managers. There are plenty of DevOps departments out there. The same noise happened with Agile, where the company structures do not change, and silos still exist. Now we are about to extend the reach of DevOps to Security. Belive me of not the naming does not bother me much. There is a DevSecOps manifesto.

In 2018 AWS CTO(Vogels) said : "Security is everyone's job". For the last 2 years, there was so many famous and big data leaks and breaks that made that statement be very true more than ever. Security often could mean worst performance and worst user experience so in order to get it right you really need to think about the designs before jumping into to code and consider performance and user experience has main requirements.  I was thinking about writing about how to do HMAC in Java for a while and recently Redis 6.0.0 come out and to my surprise, there was a refactoring on the password part in order to use HMAC.  Security easily could scare engineers often because it is not something well spread yet but I believe this will change soon. It does not matter if you have to deal with PII Data or not, security is super relevant because everybody is running their workloads at the cloud or with IoT and Edge devices which means more distribution, more code, more points of fail...