P0 Security, the company building the industry's first unified solution to secure cloud access and developer entitlements, today announced it has secured $5 million in seed funding, led by Lightspeed Venture Partners,

P0 Security Raises $5 Million in Seed Funding to Secure Access for Cloud Identities

In a joint communique issued in the opening hours of the UK government’s AI Safety Summit, all participating governments agreed to deepen their cooperation around the risks associated with artificial intelligence,

AI Summit: 28 governments and EU agree to safe AI development

In a letter on Monday announcing her resignation effective immediately, Kuttai — one of six human rights commissioners in Saskatchewan — said the decision did not come lightly. But to her ...

Child's rights 'must always take precedence,' says Sask. Human Rights commissioner after resignation

Save Emirates ID on your phone, pay fines, bills - all top services on one app. Dubai: With one app, you can now access more than 750 services from over 30 Abu Dhabi government entities and ...

UAE: Access over 750 Abu Dhabi government services on one platform - the ‘TAMM’ app

This strategic move is a significant milestone in DSN’s expansion journey – one that combines DSN’s expansive network and expertise with Terry’s Tag and Title Service’s deep-rooted ...

Dealer Services Network Acquires Terry’s Tag and Title Service

Ms. Fatima AIDaghar delivering the keynote speech Always being the pioneer in innovations and cutting-edge technologies, du is committed to network technology innovations, to construct a digital foundation for services. First, we adopt the 3D mesh ...

Digital Green Optical Network for All Service Development

Tamara Smith MP, Greens Member for Ballina, has today criticised the NSW government’s proposed Climate Change (Net Zero Future) Bill 2023, as residents of the Northern Rivers experience more frequent extreme weather events. The recent horrific Hamas ...

Byron homeless service receives one off funding

Credit: Keith Mwanalushi/Aviation Week Network AMSTERDAM—Continuing airworthiness ... It is now the latest service partner to opt for 8tree's dentCHECK-as-a-Service. “Having performed several ...

AMROS, 8tree Partner To Grow dentCHECK Service Network In Europe

The Kansas Department for Children and Families (DCF) is letting Kansans know about delays for those working with Child Support Services due to an ongoing network security issue. With the e-filing ...

Child Support Services impacted by Kansas Court’s network security issue

There has been a 35% increase in demand for services ... Ms Condon said: "One of the cases we were we're dealing with currently, the guards have said it's the worst case of human trafficking ...

Demand for services by human trafficking victims up 35% - report

Get the most recent info and news about One Human Service Network on HackerNoon, where 10k+ technologists publish stories for 4M+ monthly readers.

One Human Service Network

Meet the Winners of Startups in North and Central America

Introduction of five essential characteristics, three service models, and four deployment models of Cloud Security Cloud computing, which delivers information technology services over the internet, has grown a must for businesses and governments seeking to accelerate innovation and collaboration. On the other hand, Cloud security involves the procedures and technology that secure cloud computing environments against external and insider cybersecurity threats. According to " " (Special Publication 800–145): The NIST Definition of Cloud Computing Cloud computing is a model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that or service provider interaction. This cloud model is composed of five essential characteristics, three service models, and four deployment models. can be rapidly provisioned and released with minimal management effort This article will introduce the basics of Cloud Security and the differences with existing security architecture. What Makes Cloud Security Needs Special Attention? Conventional IT security has undergone an immense evolution due to the shift to cloud computing. While cloud models allow for more convenience and always-on connectivity, it requires new considerations to keep them secure. However, as a modernized cybersecurity solution, cloud security stands out from conventional IT models in a few ways. On-demand Self-service A consumer can unilaterally provision computing capabilities, such as server time and network storage, as needed automatically without requiring human interaction with each service provider. Broad Network Access Capabilities are available over the network and accessed through standard mechanisms that promote heterogeneous thin or thick client platforms (e.g., mobile phones, tablets, laptops, and workstations). Resource Pooling The provider's computing resources are pooled to serve multiple consumers using a multi-tenant model, with different physical and virtual resources dynamically assigned and reassigned according to consumer demand. There is a sense of location independence in that the customer generally has no control or knowledge over the exact location of the provided resources but may be able to specify location at a higher level of abstraction (e.g., country, state, or datacenter). Examples of resources include storage, processing, memory, and network bandwidth. Rapid Elasticity Capabilities can be elastically provisioned and released, in some cases automatically, to scale rapidly outward and inward commensurate with demand. To the consumer, the capabilities available for provisioning often appear to be unlimited and can be appropriated in any quantity at any time. Measured Service Cloud systems automatically control and optimize resource use by leveraging a metering capability1 at some level of abstraction appropriate to the type of service (e.g., storage, processing, bandwidth, and active user accounts). As a result, resource usage can be monitored, controlled, and reported, providing transparency for both the provider and consumer of the utilized service. Segmentation of Cloud Security Responsibilities Most cloud providers try to build a secure cloud for customers. However, their business model hinges on preventing breaches and maintaining public and customer trust. Cloud service providers (CSPs) can avoid cloud security issues with their service but , such as what data they add to it and who has access. can't control how customers use the service In each public , the cloud provider and cloud customer share different levels of responsibility for security. By service type, these are: cloud service type — Customers are responsible for securing their data and user access. Software-as-a-service (SaaS) — Customers are responsible for securing their data, user access, and applications. Platform-as-a-service (PaaS) — Customers are responsible for securing their data, user access, applications, operating systems, and virtual network traffic. Infrastructure-as-a-service (IaaS) The Concept of Shared Responsibilities Within all public cloud services, customers are responsible for securing their data and controlling who can access that data. Therefore, data security in cloud computing is fundamental to successfully adopting and getting the advantages of the cloud. — CSPs are responsible for protecting the infrastructure that runs all of the services offered in the Cloud. This infrastructure comprises the hardware, software, networking, and facilities that run the Cloud services. Cloud service providers' responsibility —will be determined by the Cloud service model that a customer selects. This determines the amount of configuration the customer must do as part of their security responsibilities. The customer's responsibility For example, organizations considering typical SaaS offerings like Microsoft Office 365 or Salesforce only need to plan how to fulfill their shared responsibility to protect data in the cloud. For abstracted services, such as Amazon S3 and Amazon DynamoDB, AWS operates the infrastructure layer, the operating system, and platforms, and customers access the endpoints to store and retrieve data. Customers are responsible for managing their data (including encryption options), classifying their assets, and applying IAM tools for the appropriate permissions. Alternatively, those considering IaaS offerings, like Amazon Web Services (AWS) or Microsoft Azure, that starts with: require a more comprehensive plan data and covers cloud app security, operating systems, and virtual network traffic. Each of the above can also increase data security risk; it requires the customer to perform security configuration and management tasks. For instance, if customers deploy an Amazon EC2 instance, they are responsible for: the management of the guest operating system (including updates and security patches), any application software or utilities installed by the customer on the instances, and the configuration of the AWS-provided firewall (called a security group) on each instance. Where is Your Cloud? There are mainly four cloud deployment models. Each one is unique with its offerings, specifications, advantages, and security concerns. are composed of multi-tenant cloud services where a client shares a provider's servers with other clients, like an office building or coworking space. These are third-party services run by the provider to give clients access via the web. Public cloud environments are based on a cloud service that provides the client with exclusive use of their cloud. These single-tenant environments usually are owned, managed, and operated offsite by an external provider. Private third-party cloud environments are also composed of single-tenant cloud service servers but operated from their own data center. In this case, the business runs this cloud environment to allow complete configuration and setup of every element. Private in-house cloud environments include the use of two or more cloud services from separate providers. These can be any blend of public and private cloud services. Multi-cloud environments use a mix of private third-party cloud and onsite private data centers with one or more public clouds. Hybrid cloud environments By framing it from this perspective, we learn that cloud security varies based on the type of cloud models. Final Words Introducing cloud technology has forced everyone to reevaluate cyber security. Your data and applications might be floating between local and remote systems — and always internet-accessible. For example, if you access Google Docs on your smartphone or use Salesforce software to look after your customers, that data could be held anywhere. Therefore, protecting it becomes more difficult than when it was just a question of stopping unwanted users from gaining access to your network. Unfortunately, malicious actors realize the value of cloud-based targets and increasingly investigate them for exploits. Furthermore, despite cloud providers holding many security roles on behalf of clients — they do not manage everything. All that leaves even non-technical users with the duty to self-educate on cloud security. That said, you are not alone in cloud security responsibilities. Being aware of the scope of your security duties will help to stay safe. Thank you for reading. May InfoSec be with you🖖.

Cloud Security 101

Cloud computing is a ubiquitous computing model that can provide convenient on-demand network access to a shared pool of configurable computing resources such as networks, servers, storage, databases, applications, services that can be rapidly provisioned and released with minimal management effort or along with service provider interaction. It’s a pay-as-you-go model, enterprises can lower the ( ); Operating expense ( ), and their infrastructure more efficiently, and scale as per the business requirements. Capital expenditure CAPEX OPEX Consumers can test the Cloud computing model to shift from the traditional way of businesses to the cloud through these five essential characteristics, three service models, and four deployment models. Five Essential Characteristics Cloud computing made fundamental changes the way IT services are delivered and consumed. 1. On-Demand Self-Service A user can provision computing capabilities, such as server time and network storage, as needed automatically without requiring human interaction with the service provider. 2. Broad Network Access All Capabilities are available over the network and accessed through standard mechanisms that support client platforms such as mobile phones, tablets, laptops, and workstations. 3. Resource Pooling The provider’s computing resources are pooled to serve multiple users using a multi-tenant model, with different physical and virtual resources. Computing resources are dynamically assigned and reassigned according to user demand. Examples of Computing resources include storage, processing, memory, and network bandwidth. 4. Rapid Elasticity Capabilities can be elastically provisioned and released, in some cases automatically, to scale rapidly outward and inward with user demand. To the consumer, the capabilities available for flexible provisioning often appear to be unlimited and can be appropriated in any quantity at any time. 5. Measured Service Cloud systems automatically control and optimize resource use by leveraging a metering capability at some level of abstraction appropriate to the type of services such as storage, processing, bandwidth, and active user accounts. Resource usage can be monitored, controlled, accounted, and reports providing transparency for both the provider and consumer of the utilized services over the usage period. : Benefits Elasticity and resilience Scalability and flexibility High-performance VM Support Development Tools Reduce operational and maintenance costs Reduce disaster recovery infrastructure costs Reduce operational complexity Capacity on demand Shared services through the cloud Cloud Automation Decreased deployment time Additional capacity can be added rapidly as needed Scaling down prevents paying for unused capacity Leverage a Cloud provider for infrastructure and Support many Frameworks and Languages Cloud Security Fast and SLA-based Recovery Cloud Computing Service Models There are many ways to take advantage of the cloud’s capabilities. The three service models associated with cloud computing are and . The following sections summarize the key concepts and advantages and disadvantages of each service model. Software as a Service (SaaS), Platform as a Service (PaaS), Infrastructure as a Service (IaaS) Software as a Service (SaaS) Platform as a Service (PaaS), and Infrastructure as a Service (IaaS) 1. Software as a Service (SaaS) The consumer uses the provider’s SaaS platform to access the applications running on a cloud platform. The applications support various client devices and accessible from a web browser, or a program interface. The consumer controls or changes the service provider’s cloud infrastructure network that includes operating systems, network servers, storage, or even individual application capabilities, with the possible exception of limited user-specific application configuration settings. Uses application/service for business process operations. Consumer Operations Example: Installs, manages, maintains, and supports the software application on a cloud infrastructure. Cloud Provider Operations Example: 2. Platform as a Service (PaaS) The consumer-created or developed applications by using required programming languages, and it will deploy on the PaaS platform. In this model, incorporating a pay-per-use or charge-per-use basis. It deploys the Applications on the abstraction, acts as a host, conceptually this layer sits above the physical layer which manifests one of the essential cloud computing characteristics. The underlying service provider infrastructure was not managed or controlled by the consumer that includes physical servers, networks, operating systems, or storage. On the contra, the consumer has control over the deployed applications and performs various configuration operations for the deployed application on the hosting environment. Develops, tests, deploys and manages applications hosted in a cloud environment. Consumer Operations Example: Provisions and manages cloud infrastructure and middleware for the platform consumers; provides development, deployment, and administration tools to platform consumers. Cloud Provider Operations Example: 3. Infrastructure as a Service (IaaS) The consumer provision storage, networks, and other fundamental computing resources where the consumer is able to deploy and run arbitrary software, which can include operating systems and applications. The consumer does not manage or control the underlying cloud infrastructure but has control over operating systems, storage, and deployed applications; and potentially limited control over selecting networking components. Creates/installs, manages, and monitors services for IT infrastructure operations. Consumer Operations Example: Provisions and manages the physical processing, storage, networking, and the hosting environment and cloud infrastructure for IaaS consumers. Cloud Provider Operations Example: Cloud Computing Deployment Models The significant aspects of cloud computing are designed to serve as a means for wide comparisons of cloud services and deployment strategies and to provide a baseline for discussion from what is cloud computing to how to best use cloud computing and deploy the cloud services. Private cloud Public cloud Hybrid cloud, and Community cloud 1. Private Cloud The cloud infrastructure is provisioned for exclusive use by a single organization or an entity comprising multiple consumer's business units. It is owned, managed, and operated by the organization, a third-party service, or some combination of them, and it may remain on or off premises based on the organization's requirements. 2. Public Cloud The public cloud infrastructure is provided for open use by the public is well known as the public cloud. It may own, managed, and operated by an individual, small-Large Enterprise, business, academic, or government organization, or some combination of them. It lies only on the premises of the cloud service provider. 3. Hybrid Cloud The cloud infrastructure is a composition of two or more distinct cloud infrastructures usually private, public, or community that remain unique entities to each other but are bound together by standardized or proprietary technology that enables data and application portability cloud bursting for load-balancing between clouds. 4. Community Cloud The community cloud, it provisions infrastructure for exclusive use by a specific community of consumers from organizations that have shared concerns such as own mission, enterprise security requirements, enterprise unique policies, and compliance standards. Its own, managed and operated by one or more of the organizations in the community cloud, a third party, or some combination of them, and it may exist on or off-premises. — — — — — — — — — — — — THE END — — — — — — — — — — — Greek Quotes: “Quality is not an act, it is a habit.” — Aristotle Thanks for reading! Have a pleasant day! Also published at https://medium.com/faun/what-are-cloud-computing-cloud-computing-deployment-and-service-models-592b83522463

Cloud Computing Systems 101: An Overview

If terms “data plane”, “control plane”, “API” and them being used in one sentence confuse you when it comes to service mesh — this article is for you. You might want to get familiar with if this article does not make sense or comes out of context. Service Mesh explained in plain English Note: The context of this article is service networking and service mesh. Adjacent technical domains apply these terms in a slightly different way, although within the same conceptual model. Life of a proxy before Service Mesh Let’s start with the basics. If you think about a proxy server (such as , , , or if you are not afraid to show your age even ), its job is to accept traffic over the network and send it to its destination, adding some value in-between. This added value, for example, could be caching, load-balancing (distribute traffic to multiple destinations), telemetry (generate some insights about passing traffic), security, or policy control (only allow certain types of traffic or encrypt it before sending to the destination). HAProxy Envoy Nginx Squid Like any other software proxy servers only do what you told them to do. How do you tell them what to do? Usually through the configuration. The operator describes desired behavior of the proxy, such as “If it is HTTP request to host send it to the backends that serve images, otherwise send it to a default backend” in a configuration file, starts up a proxy server binary and lets it do its job. www.myhost.com/images, With a scale, one proxy server becomes not enough to handle the traffic. You add more servers, launch more proxy binaries, and configure every one of them using configuration files. Passing around configuration files becomes tedious, and does not scale, but let’s accept this state of things for a moment. In this sub-optimal world, when architecting a distributed system, our deployment of proxy servers is the — a layer of software that processes your traffic, copying bits and bytes from the source of the traffic and sending them to its destination. data plane Data plane — software that processes your traffic by copying bits and bytes from the source of the traffic and sends them to its destination. A is a layer of software that configures data plane, telling it to send these bits and bytes around. As you noticed, in the model described earlier, there is no control plane, just a human operator crafting configuration files and sending them around. Granted, this operator might attempt to automate this operation with some tools, but it does not change the concept. control plane how and where The entrance of a control plane Setup without a control plane works just fine for static environments, where you can configure your proxies once and never touch them again. In a highly dynamic environment, like service mesh, the configuration of each proxy may change many times per minute (for example, services might come and go, endpoints might come and go, routing might change). Control plane — software that configures data plane based on the declared (desired) state of the service network. What you would want to do is to replace humans creating configuration files with a software that does the same. This software can accept an “intended configuration” from a human operator, observe the state of the environment and dynamically configure all proxy servers in a consistent and fast manner so that their behavior matches the “intended configuration” (also called declared or desired). Note that often function of the control plane is not uni-directional (from the control plane to the proxy server only). It also could accept communication proxy servers, such as telemetry reports, diagnostic information, or dynamic requests on how to handle the particular traffic. from We arrived at an architecture where we now have a data plane (proxies) and a control plane (software that computes and distributes the configuration to proxies). How would control plane talk to data plane exactly though? Introducing APIs So far, we based communication between the control plane and data plane on “configuration files”. Our control plane would need to “craft” these files, send their full copy around (copying them over the network, possibly, 1000s of times), proxy servers would need to load the content of the files, parse them, and hopefully do not fail in the process. Sounds sub-efficient. Instead, let us add an API ( ) working over the network. A proxy server would start up and listen on the network interface, ready to accept new configuration. There will be a protocol defining this API, of course, so that interaction between control and data planes is reliable, secure, and efficient. When the configuration of proxy servers needs to be changed — the control plane will send necessary changes to all proxy servers that will receive, validate, accept them and incrementally change the way they process traffic in runtime without a reload. If done right, this will drastically improve the reliability and performance of the control to data plane communication. Application Programming Interface This type of API is what we call . It would not be a surprise to learn that many proxy servers already provide this interface ( , , ). a data plane API Envoy xDS API HAProxy Data Plane API Nginx Controller API Not to be confused with the It is an API that the control plane provides to accept the declarative configuration that is later will be distributed to the data plane. While we do not always need control plane API, the benefits of introducing it lie in the standardization of interoperation with the other software layers. APIs are usually more expressive than simple configuration files, subject to versioning policy (you have a guarantee that things will not break) and more comfortable to automate through. For example, that allows you to configure the service mesh. control plane API. Istio has an API Proprietary, open, … universal? When thinking about data and control plane APIs, it is essential to understand whether they are proprietary or open, like any other piece of software (Richard Stallman reading this article would choke on the term “open”, but we’ll let it go). Proprietary API will tie you to the specific brand/implementation. The only way for you to control your proxy servers would be to use a proprietary control plane that comes with them (like for example). Nginx Controller API Open API, in contrast, is open. Meaning you are free to modify the API, develop your own software that works over the API and advance it in the direction you need (such as ). Envoy xDS API Open data plane APIs give you the flexibility to move from one control plane implementation to another without changing your choice of a proxy (data plane). If you did not like some control plane implementation — you could move on to another one. This flexibility is already being demonstrated by many control planes ( , ) adopting Envoy as their data plane proxy, not in the last turn due to its APIs. GCP Traffic Director Consul Open API sounds great, but can we do better? Imagine a world where any proxy server could be configured in a similar way, no matter what control plane you choose — your proxy stays the same. This would allow us to never worry about compatibility between data and control planes like we do not worry about compatibility between your laptop and wifi router (well, ok, we sometimes do, but you get the idea). We would call such API a Universal Data Plane API. It is, so far, mostly , but work has started to evolve Envoy’s xDS API into the universal API, and has a started on it. The future is promising. a vision CNCF working group Beyond proxies We’ve talked about proxies as subjects of the data plane API so far, but proxies are not the only beneficiaries. Applying these concepts to proxyless models (see “thin clients” in ) is also possible. For example, is adding support for the xDS API, meaning you should be able to start using it with control planes that support this API momentarily. Service Mesh architectural patterns gRPC In this case, you get a slightly reverse effect of “universality”. You can change your data plane implementation (Envoy -> gRPC) while sticking to the same control plane. Sounds more and more as a “universal” API, is not it? Create once, use everywhere. Learning more I hope this gives you a basic idea of the various “planes” and their API. For those curious ones who want to go deeper into the topic of data plane APIs, here is a list to explore: Explore Envoy’s as a good example of what Open API could be xDS API Poke into a sample implementation of the for these APIs control plane Install and see how control plane and data planes work seamlessly together through the xDS APIs Istio If you have any questions or suggestions, feel free to reach out at — DMs are open. twitter.com/@burnosalex

Data Plane, Control Plane, and Their APIs [Service Mesh Explained]

“You press a button. In a very short period of time, a car shows up.” On a recent , Chris Ballinger, CFO and Director of Mobility Services for the , said: podcast Toyota Research Institute You press a button. In a very short period of time, a car shows up. Takes you where you want to go, drops you off. The negotiation of payment, who you are, your reputation, the car’s reputation, the contract… All of those are potential applications for the kinds of things that Blockchain does so well. Toyota is . Truth be told: the problem with everybody owning a , is that cars are effectively . betting on Blockchain heavily car underutilized On average, . Yes, you read that right. cars are parked 95% of the time insurance, maintenance, parking, driving license renewals, etc. Is that overhead worth it if you’re only using your car 5% of the time? On top of that, owning a car comes with fixed costs: Mobility-as-a-Service Toyota is betting on a future where mobility is practiced on demand. In other words, . mobility becomes a service rather than a resource you own There is a (either stationed or roaming around), and you request one by using an application on your device. fleet of autonomous cars in a city The car takes you where you want to go, you pay for ride and you get off. It then becomes available again to drive somebody else. The ecosystem it must be capable of finding a recharging station — and all other services it needs — all by itself. Since there is nobody driving the car, Of course, companies like Toyota don’t plan to deploy recharging stations everywhere in the world for their vehicles. Instead, they envision an , much like there are petrol stations, car washes, insurance companies, etc. all around the globe. economy/ecosystem of services surrounding the car But the key difference with today is that with those services, as well as perform trades immediately: by exchanging currency or some other token representing value. the car must be able to communicate Hello, Smart Contracts. Creating a single central database in the world for all these partners and transactions is impracticable. Who would own it? Would it comply with all legal regulations across the globe? How secure would it be? Who would manage it? Centralization is not the answer. Enter the blockchain . Transactions on the Blockchain So say you’ve called an autonomous vehicle and it’s about to pick you up. I will abbreviate “transaction” with TX. Imagine this flow: , but since it was not carrying a human until it picked you up, it . Insurance: The vehicle has an insurance policy only covers the car As soon as you hop on, . It does this by making a TX with a smart contract that covers the car + 1 human . the vehicle upgrades the policy to cover one human (you) until the estimated time of arrival (ETA) It starts driving. But alas, it needs to . It makes a TX on the blockchain with another smart contract to pay the toll. A deposit is paid upfront for the entire length of the toll road. Toll roads: access a toll road It continues driving. When it leaves the toll road, it makes another TX with the previous smart contract. It gets the deposit back, minus the cost of the trip on the toll road (based on the number of kilometers). It drops you off at the destination. You pay the car by issuing a TX on the blockchain. The car pays the insurance fee, prorated by the amount of time you actually spent in the car (both the start and the end of the trip were registered on the blockchain). The car then downgrades the insurance to a “zero humans” coverage. Payment: vehicle + 1 human The car notices it’s low on battery and it’s also dirty. So it charges you a soiling fee via the blockchain, and also decreases your reputation by –1 points by making another TX on the blockchain. Battery and soiling: You littered a bit. Since it has collected your transportation fee, plus the soiling charge, it first finds a recharging station and recharges itself. It pays the owner of the station via a TX on the blockchain. Recharging: (it could be someone’s home!) Then it goes to a cleaning service and pays via a TX on the blockchain, to get itself shiny and hospitable again. Cleaning: (is this human-operated or automated? If human… is this what we’ve been relegated to? 🤔) That is, unless this happens to it: It is now available to pick up another passenger. A trap for self-driving cars. 👉 For about blockchain, make sure to on Medium. top articles follow both, consensusX and me If you enjoyed this article, please on Medium (clap/heart it!), and on Twitter, LinkedIn, etc. recommend it share it About the author My name is Raúl Kripalani and I’m a backend & distributed systems engineer. I currently work for on building a modular network stack for P2P networks called . Protocol Labs libp2p Feel free to connect with me on Twitter and/or LinkedIn .

Mobility-as-a-Service on the Blockchain

What Is Cloud Security Posture Management (CSPM)? Cloud security posture management (CSPM) is a cybersecurity toolkit that identifies cloud-based security issues, such as noncompliance and misconfiguration. First used by Gartner, CSPM is a type of that enables automation and enhances regulatory compliance. cloud security offering CSPM products work by continuously monitoring infrastructure in the cloud to identify security risks and areas where policies are inadequately enforced. They include tools that analyze cloud environments based on a predefined list of security risks and corresponding best practices. For example, one CSPM tool may alert the security team of urgent threats, while another tool might use automated processes to remediate the threats without human intervention. CSPM is useful for organizations that rely on cloud computing, especially when deploying a hybrid or multi-cloud environment. are most commonly used to implement security best practices in infrastructure-as-as-service (IaaS) offerings. CSPM capabilities However, CSPM can also be used to minimize compliance and configuration risks in and software-as-a-service (SaaS) setups. platform-as-a-service (PaaS) How CSPM Works CSPM tools focus on identifying and addressing security misconfigurations in the cloud. Some CSPM tools are limited to specific cloud services or environments with a rigid list of best practices. Thus, security teams should be familiar with the various tools available and the suitable context for each tool. For instance, one CSPM product might be effective for Azure, while another would be better suited to AWS. A CSPM suite should include tools that automatically respond to misconfiguration issues, such as excessive permissions. They achieve this by monitoring the cloud environment in real-time and automatically applying the recommended changes. It is also possible to configure CSPM based on specific security standards, such as HIPAA. Organizations often combine CSPM tools with a Cloud Access Security Broker (CASB). This product helps control data flows between the cloud environment and the organization’s on-premises infrastructure. 4 Reasons Why CSPM Tools Are Not Enough While CSPM is a useful toolkit to have, it is not enough to protect a complex cloud-based environment: CSPM Cannot Fix All Misconfigurations CSPM tools usually detect configuration issues effectively, but they cannot always fix a misconfiguration when they find it. Not all attack surfaces are easily patchable, meaning that automated remediation is insufficient. In some cases, a misconfiguration issue could take months to fix. A sophisticated threat monitoring solution may be more efficient in safeguarding the cloud environment by prioritizing high-risk security vulnerabilities and accepting the lower risk of others. CSPM Cannot Cover Other Security Risks Continuous monitoring for misconfigurations is useful for identifying compliance issues and risks like open ports. However, misconfiguration issues only represent a minority of security risks (most breaches in the cloud result from other issues). A more advanced threat detection platform can analyze the behavioral patterns in the cloud to identify indicators of compromise. Many cyber attacks are ongoing and involve a complex sequence of events rather than a one-off anomaly. CSPM tools don’t monitor the runtime environment, so they cannot identify suspicious behavior, such as an unexplained spike in network activity. Security teams should have visibility over the entire attack sequence. Ensuring Compliance Does Not Ensure Security Achieving perfect compliance does not equate to ensuring security. CSPM tools don’t identify threats that work around compliant configurations. Moreover, the organization’s configuration needs may change, as do compliance requirements, so security and development teams must consider new risks. CSPM tools do not provide alerts for breaches that slip through existing compliance measures. Security Requires a Combined Static-Dynamic Approach CSPM tools are static in nature—they monitor the configuration environment in a point-in-time analysis, so they miss issues that arise at another time. They don’t look at the impact of small changes over time, which could provide a more detailed picture. In contrast, a behavioral analysis-based tool can detect threats using artificial intelligence by establishing a normal behavior baseline for the cloud environment. Cloud Security Tools to Add to Your Security Stack Here are a few tools that can complement CSPM to provide a more holistic cloud security solution. Data Security Posture Management (DSPM) DSPM is a security approach that focuses on data in the cloud, treating data as the organization’s most valuable asset. Most organizations that operate in a multi-cloud environment handle large amounts of data, including sensitive data, creating a large attack surface. DSPM encompasses multiple approaches to protect data and maintain the organization’s security posture. It alerts the security team to the presence of sensitive data throughout the cloud environment, providing information such as who can access this data. Cloud Workload Protection Platform (CWPP) A CWPP is uniquely adapted to protect workloads in the cloud. It works by securing cloud-specific capabilities, including storage, computing, and networking. Legacy security solutions cannot adequately protect cloud workloads, given their complexity. The main advantage of a CWPP is its scalability and limited friction when protecting cloud workloads. It can help address security issues that arise as a result of inadequate security practices. This is especially useful for fast DevOps cycles, where teams often overlook security. Cloud Access Security Broker (CASB) A CASB is a service that enforces security policies in the cloud and on-premises. It provides a virtual checkpoint in between the cloud service user and the cloud provider, based on policies determined by the cloud service admin. CASBs ensure that an organization’s security policies are enforced whenever someone accesses a cloud-based resource. Many organizations are adopting CASBs to mitigate risk when using cloud-based services and ensure regulatory compliance. The CASB is useful for achieving security for cloud resources that are outside the organization’s control and traditional security perimeter. Cloud-Native Application Protection Platform (CNAPP) CNAPP covers multiple aspects of cloud security, including CSPM, CSNS (cloud service network security), and CWPP (cloud workload protection platform). It provides a unified platform to secure cloud-based applications throughout their lifecycle, rather than relying on separate cloud security tools. This approach helps to patch up the gaps that arise when using unrelated security solutions, ensuring greater visibility. This helps reduce the workload of the development and security teams while improving the overall organizational security posture. Conclusion In conclusion, while CSPM is an important tool in the cloud security stack, it should not be the only one. CSPM tools are static in nature and cannot detect more complex security threats that involve multiple malicious activities carried out over a long period of time. They also strongly focus on compliance requirements, which do not always align with the most pressing security needs in a cloud environment. To address these limitations, you should complement CSPM with other security tools. We covered several options, including DSPM, CWPP, and CASB. In addition, a new solution category called CNAPP packages together CSPM with these and other relevant security tools to provide a well-rounded cloud-native security solution. Of course, the choice of tools will depend on your security requirements, the technical aspects of your cloud environment, your budget, and the security expertise available in-house.

CSPM Is Not Enough: 4 Reasons You Need More Tools to Secure Your Cloud

Let's learn about via these 67 free stories. They are ordered by most time reading created on HackerNoon. Visit the to find the most read stories about any technology. Node /Learn Repo The most hated language powering web servers since PHP. 1. How to Set the Default Node.JS version with nvm 2. Crypto-Biometrics Helps Create Decentralized Pseudonymous Identities Using private biometric technology, Humanode will be the first crypto-biometric network where one human equals one node. 3. How to Act Like You're Working When You're not With RobotJS Learn how to automate your desktop but with a fun example. 4. How Libuv Thread Pool Can Boost Your Node JS Performance In this 5th instalment of my “Node JS Performance Optimizations” series, I show you how to increase Node JS performance with thread pool management. We achieve this by understanding how Libuv works, how the thread pool works and how to configure the number of threads based on your machine specs. 5. In Layman's Terms, What is the Difference Between Node and Deno? Worried that dinosaur or sock shaped "deno" is going to kill our favorite  Node? Let me help you to get out of this dilemma. 6. A Simple Sequential and Parallel Task List Runner for Terminal Taskz is a library for Node.js, a simple sequential and parallel task list runner for terminal. 7. Web Scraping Using Node.js While there are a few different libraries for scraping the web with Node.js, in this tutorial, i'll be using the puppeteer library. 8. Why Should I Use Nodemailer to Send Emails? A useful guide on how to use Nodemailer to send emails. 9. Power Up Your Logging in Node.js Power up your logging and build good developer habits. As your codebase grows you'll need to debug it more easily and one tool is logging. 10. What’s New in Swell 0.6.0? Swell is a cross-platform compatible (Mac, Linux, & Windows) desktop application and the leading API dev tool for testing and visualizing steaming TCP connections (i.e., WebSockets, SSEs, GraphQL subscriptions). Swell functions similarly to Postman, but with the added perks of full streaming and GraphQL support. Being an Open Source project, Swell is 100% free and open to outside contributions. For details on how it works, see our previous article here. 11. My List of Crypto-Programming Youtube Tutorials A collection of my youtube videos on creating bots for trading, creating smart contracts, building dApps, and integrating with Facebook, Amazon, and eBay APIs 12. How to Exploit Prototype Pollution? Prototype Pollution is a JavaScript related vulnerability. This article explains how it works and how to exploit it bypassing security checks of the app. 13. The Quickest and Most Secure Way to Run Your Blockchain Node This article tells you the quickest approach to running a blockchain node. You can save yourself a lot of time reading it! 14. Assign Types To Nested Objects In TypeScript TypeScript provides you with multiple ways to define type definitions for object properties. We'll look at a couple of them throughout this post. 15. The Differences Between Deno and Node Deno a pristine method to compose worker side JavaScript. It solves many of the problems as Node. 16. The Art & Science of Node Monitoring One of the hardest parts of designing a monitoring system is predicting everything that “might” go wrong. That only comes from experience, not just over time, b 17. How to Scrape Data From Any Website With JavaScript Learn how to scrape the web using scripts written in node.js to automate scraping data off of the website and using it for whatever purpose. 18. Exploring the Neo4J Graph Database In this article you'll learn more about the NoSQL Graph database - NEO4J. 19. How to Get a Cookie’s Expiry Value on a Server Browsers handle cookie expiry so they don’t pass the cookie’s expiry value to the server. 20. Node Providers The node provider market is crowded. New players have few opportunities: support long tailed assets, better UX, lower price. 21. When to Use Node.js for Your Web Application Want to know what is NodeJS and Why You Should Use It? Here is detailed blog covering every minute detail of NodeJS. 22. How to Deploy an Express Node.js Application to Heroku Quickly and Easily Deploy your Express Node.js application to Heroku in just a few steps. This is a step-by-step guide on how to deploy your app to Heroku. 23. Gearing Up for Marketing Mumbo Jumbo: A New Squeeze Page + Blog! Celebrating 20% gains in about a day, we're preparing to launch our first-ever marketing collabroation with the team and friends over at CryptoCatBot where we might even feature in their products section and/or get an email blast - for a marginal trade of referral commission, tbd - stay tuned for our glorious launch celebration in Telegram :) 24. What Roles Do API Methods Play On The Blockchain? Read on to find the detailed info on such Blockchain API methods as JSON-RPC, REST and WebSockets, the main use of API and how it's related to cryptocurrency. 25. When ORMs Disobey: A Mongoose Story In hindsight, it seems like mongoose was doing the sensible thing by simply ensuring that the document existed in the database. 26. Coinbase Cloud Node & NFT APIs Building upon his last publication, John Vester dives even deeper into Web3 by leveraging new tech by Coinbase Cloud to create a more functional dapp. 27. Node-RED Module for Visual NodeJS Programming In this article, I'm going to introduce you to a NodeJS module that allows you to create and deploy server-side processes by using a visual, drag n drop style. 28. HarperDB: Build Your Application Backend in One Place with Custom Functions Introducing the newest innovation from HarperDB: HarperDB Custom Functions. With the release of HarperDB 3.1 users are able to define their own API endpoints within HarperDB. What does that mean for you? HarperDB grows from a distributed database to a distributed application development platform with integrated persistence - one that can serve as a single solution for all of your backend needs. We’re collapsing the stack! 29. Cz-git Recipes - Easy to Commit 🔨 A more engineered, highly customizable, standard output format commitizen adapter. 30. What is a Dapp? And What it Most Definitely is Not. Definition 31. Moe-js - A Modern Template Engine for JavaScript I've been using Handlebars in Node.js apps for a long time now and while it always gets the job done, sometimes I find it awkward to use.  In particular I miss being able to use expressions and flexible logic flow directly in the templates.I know there's an argument for keeping logic and views separate and that views should be "logicless", but sometimes you just want a bit more control.  The existence of libraries like Swag, suggests that I'm not alone here so I got to thinking... 32. How To Earn With Play-to-Earn: Basics of Hottest Crypto Trend Right Now Play-to-Earn or GameFi protocols became mainstream in Q3-Q4, 2021 - and euphoria around them still gains steam. 33. Microservices Deserve Modern Programming Platforms: Java May Not be the Best Option Microservices are very popular today, even in traditional corporate IT shops. Often though they are implemented using languages, such as Java, born in the early ’90s and designed for a world of monolithic applications. Do you remember the big old Application Servers? 34. Is Node.js Worth The Hoopla? If you’ve gotten started programming with HTML and JavaScript (JS), you know how easy JS is to use. The interface is right at your fingertips. You can easily access your entire web page with simple commands. 35. Node-RED Configuration Explained In 600 Words Quickly get up and running with an advanced Node-RED Server. 36. NodeJS: Code Execution Monitoring With Inspector Have you ever desired to watch your code running, instead of just imagining it? 37. Deno🦕 - Is it a threat to Node? Deno 1.0 is launched on 13th May 2020 by Ryan Dahl — the original creator of Node.js 38. Building Your First Node-RED Flow: Basic Tutorial This post introduces a deep dive video tutorial where I teach you the fundamentals of Node-RED and at the same time, show you how to build a Weather dash 39. Building A Twitter Bot With Node.js - Part 2: Deploying to Server and Schedule Tweets In part 1, we learned how to create a simple Twitter bot with Node.js. In this article, we will go over how to deploy the bot and schedule tweets 40. Why use Node.js as your backend? Do you have an innovative idea that’s going to turn your web app into the next big thing? That’s great - but remember that software development is a process that has to be well-thought-out, and the most critical decision of what backend environment are you going to choose has to be made at the early beginning. 41. 🎉 Deno: 1.0: A Review of Features [We're Going Live] 🤠 Introduction 42. How to Manage Multithreaded Node JS Applications for Better Performance In this post I'm going to show you how to potentially triple your Node application's performance by managing multiple threads. 43. How to Build A Passwordless Authentication with Email and JWT In this quick article, you'll see how to prevent one of the OWASP Top 10 security issues for websites: authentication that hasn't been implemented correctly. 44. Final Bot Pre-Launch & Initial HN 2.0 Post! Hi folks! 45. Let's Build It: Real-time Session Invalidation How would we build an experience like the one above? Demo Repo Some applications need to limit users to a single client or browser instance. This post covers how to build, improve, and scale this feature. We begin with a simple web app with two API endpoints: 46. How To Create a Custom Webhook URL Using Autocode TLDR (30s) 47. 10 Common Sense Definitions of the Most Common Crypto Industry Terms “The limits of my language are the limits of my world.” 48. Top 10 Best Web Scraper And Data Scraping Tools Data extraction has many forms and can be complicated. From Preventing your IP from getting banned to bypassing the captchas, to parsing the source correctly, headerless chrome for javascript rendering, data cleaning, and then generating the data in a usable format, there is a lot of effort that goes in. I have been scraping data from the web for over 8 years. We used web scraping for tracking the prices of other hotel booking vendors. So, when our competitor lowers his prices we get a notification to lower our prices to from our cron web scrapers. 49. 6 Ways A Node Developer Can Drastically Boost Their Productivity These six productivity tips will supercharge your productivity as a Node developer. You'll save hours of time which you can then invest in other activities. 50. Rendering Markdown Pages with Express and Los Angeles Node and Express are great for building dynamic websites but often you'll also have some static content too. While its reasonably easy to author these pages in straight HTML a better option for this kind of content is often Markdown. 51. How to Add Knex to ExpressJS Apps and Connect to a Postgres Database Express is one of the most popular JavaScript frameworks for building backend APIs and Postgres is a really popular relational database. How do we connect them? 52. Skip the SSL w/ Serverless Telegram Bot via Now.js Note: these directions come without much conversation, let the hacking begin! 53. Basic Guide To Building Microservices With MongoDB, NodeJs, And Express Most of us have gone through tough times where you have a large scale application which has a bunch of features, API integrations, database connections, etc. New features and updates get released, and of course you need to fix the bugs and maintain the code. 54. How to Send and Schedule E-mails via a Node.js app As an application developer, how often we sense the need of a service that would send e-mails to specified or subscribed email ids? Even if there is no real need, we still fantasize about it while developing a pet-project or an app for fun, don't we 😁? 55. The Seven Best Admin Templates And Themes in React The appearance of Node.js became the new era for JavaScript because of the opportunity to synchronize frontend and backend. All JavaScript programs with help of 56. What Heroku is Good For You've probably heard about Heroku by now, but do you really know how Heroku works and when it should be a consideration? 57. Understanding the Node.js Event Loop JavaScript is single-threaded, so how does it handle asynchronous code without blocking the main thread while it waits for an action to complete? 58. Setting up a Serverless Contact form in React — using Nodemailer and Express Having a contact form always works better than just displaying an email address on our website. A contact form gives our visitors an easy way to get in touch with us. 59. HarperDB - How and Why We Built It From The Ground Up on NodeJS The founding team at HarperDB built the first and only database written in Node.js. Here's the story of this (what some called crazy) endeavor. 60. Delivering Static Web Content on Heroku [A How-To Guide] My primary goal is to find a solution that allows my limited time to be focused on providing business solutions instead of getting up to speed with DevOps processes. 61. How to Reset Password with Node.js and Angular [Part 2] In this 2nd part of our tutorial, we are going to continue our journey of creating reset password functionality. In the 1st part, we completed the back-end with Node.js Express and Node mailer, created an API which will use in this part in Angular. Let’s get started. 62. Node.js Inject: How to Conduct and Why to Use Today, I would like to show you how to execute custom JS code in another Node.js process and to get a proper result. These are relatively simple code examples, which demonstrate basic ideas of native code calls with the help of Frida framework. 63. 14 Top Node.js Open Source Projects: 2021 Edition Note that under open source projects we assume the following: 64. JavaScript Promises, Callbacks, and Async/Await for Beginners ES6 came with many new features, but one of the best features was the official introduction of Promises. Promises allow you to write clean non-callback-centric code without ever having to worry about callback hell. Even if you never write your own promise, knowing how they work is incredibly important, since many newer parts of the JavaScript API use promises instead of callbacks. The core idea behind promises is that a promise represents the result of an asynchronous operation. 65. Build Your Next eCommerce Store on NodeJS Top easiest ways to make an eCommerce store with Node.js. Shopify vs. buit-for-you solution. 66. Deep Dive Into Creating Node Project With Clean Architecture (Photo by Bench Accounting on Unsplash) 67. How to Create a RESTful API With HarperDB and FastifyJS Learn how to build a course management REST API with Node.js, HarperDB and FastifyJS. Thank you for checking out the 67 most read stories about Node on HackerNoon. to find the most read stories about any technology. Visit the /Learn Repo

67 Stories To Learn About Node

How many APIs does your organization use? That number could be in the hundreds - or higher when you account for your public, private, and partner APIs. Modern enterprises rely upon APIs for virtually all business functions, and nearly ⅔ of respondents to a recent survey stated that they . expect that list to grow in 2023 While APIs are often the unsung heroes that keep workflows running smoothly, their rise in popularity has forever changed enterprise security. The Modern API Landscape The modern API landscape is rapidly evolving. At the time of publishing, GitHub holds more than , and that number continues to climb. 2 million API-related repositories Organizations worldwide are shifting to an API-first development model, recognizing the power (and added value) in effectively leveraging APIs for their applications. An API-first approach flips development schedules on their head, leading with the design and build of APIs building the application itself. before This approach means prioritizing API design and collaborating cross-departmentally, gathering feedback from stakeholders before writing code or launching an application into production. API-first is customer-centric, ensuring the focus is on meeting the needs of end users and organizations. With Reward Comes Risk Digital payments, turn-by-turn directions, pulling up a menu via QR code, sending an SMS to someone in your contact list, checking the weather - APIs power day-to-day operations, and we don’t even consider it. In business, , transferring data, linking systems, powering logins, and generally helping organizations run at the speed of life. APIs are ubiquitous Of course, this convenience has increased risk. The siren song of API amenities has also caught the attention of bad actors looking to profit through nefarious means. showed that 41% of organizations experienced an API security incident in the previous year, and 63% of those included data breaches. 2022 numbers are still rolling in, and they’re expected to surpass previous figures. A January 2022 survey that API abuses will double by 2024, a stern message for those in charge of security strategies and budgets. With the , organizations can’t afford to overlook API security - and cybercriminals have plenty of incentive to remain vigilant. Gartner predicts cost of data breaches on the rise API Security Tactics The numbers are staggering, but it’s not all doom and gloom. APIs are here to stay, and the enterprise security landscape needs to adjust to keep one step ahead of cunning criminals. A reported in responding to an API attack. 73% of organizations lack confidence Organizations could stop most costly cyber breaches with the right API security tactics. Authentication and Encryption When it comes to security, authentication and encryption are paramount. The low-hanging fruit regarding data breaches is weak validation and transmission security. As a foundational approach to API security, organizations should have a clear and enforceable authentication policy, including 2FA or MFA for all logins. Encryption will keep sensitive information out of the wrong hands when transmitting data internally between applications or end users. API security strategy is only complete with these two elements firmly in place. Rate Limiting and DDoS Protection APIs are prime targets for bot attacks that can swiftly disable a website or application, causing organizations to lose credibility and customers. Rate limiting mitigates the risk of brute force or DDoS attacks by stopping bots before they take hold of traffic. Effectively, rate limiting does exactly what it says: it limits the amount of traffic or requests an IP address can send within a specified timeframe. In the case of brute force attacks, rate limiting stops a bot from rapid-firing thousands of passwords to access a user account. DDoS attacks appear when an IP address attempts to flood an API with repeated calls, causing the service to crash or rendering it unavailable to other users. Rate limiting stops these calls at the onset. API Catalogs You can’t protect what you can’t see. It’s not uncommon for an outdated catalog of APIs to be used within an organization. A robust security approach relies on fully understanding the environment and risk profile, including an up-to-date catalog of APIs and microservices. Additionally, organizations must do themselves a favor by keeping APIs themselves up to date. Outdated APIs or software versions are clear targets for cybercriminals and may have security vulnerabilities that could be easily mitigated with a version or release update. Risk-Aware Culture End users are the moving target of organizations, as it only takes one human error to cost a business dearly. Supporting strong security policies and establishing a risk-aware culture helps to ensure a slip-up doesn’t land data in the wrong hands. Cybersecurity should be a part of the organizational lexicon, starting at onboarding. Share with employees the risks and ways to prevent attacks and ensure they know where to report incidents should they arise. There’s No Going Back The enterprise technology landscape relies heavily on APIs and is more than a fad. Organizations must build robust security strategies that consider API risks to keep their network, data, and end users safe from attacks.

ONE HUMAN SERVICE NETWORK

onehsn.org

-- employees

Since n.d.

COMPANY RANKING

ONE HUMAN SERVICE NETWORK

EVERGREEN INDEX #7965

Representing this company? Click here to claim and customize this page!

One Human Service Network WIKI

Apply to get your Tech Company News Page live on HackerNoon.com today!

ONE HUMAN SERVICE NETWORK

onehsn.org

-- employees

Since n.d.

COMPANY RANKING

ONE HUMAN SERVICE NETWORK

EVERGREEN INDEX #7965

RELATED COMPANIESRANK

STORIES ABOUT ONE HUMAN SERVICE NETWORK

Representing this company? Click here to claim and customize this page!

One Human Service Network WIKI

Apply to get your Tech Company News Page live on HackerNoon.com today!