da Agency

Mirantis Partners with Kong for Destination: Decentralization Virtual Event

The post Mirantis Partners with Kong for Destination: Decentralization Virtual Event appeared first on Mirantis | Pure Play Open Cloud.
Mirantis will discuss the road to cloud-native and ways to secure decentralized applications
April 8, 2020, Campbell, CA — Mirantis, the open cloud company, today announced that it is partnering with Kong for the company’s Destination: Decentralization virtual event. Other partners for the event include Cloud Native Computing Foundation (CNCF), AWS, and DataDog. Mirantis will give two talks at the event about the road to cloud-native applications and ways platforms can help secure decentralized applications.
Destination: Decentralization, to be held on April 16th, is a free digital event about decentralizing software architectures in light of the rapid adoption of containers and microservices. The event will host virtual lectures and hands-on labs where attendees will learn how to adapt to this new technological landscape. Mirantis is also geared up to give two presentations at the event:
Two ways platforms can help decentralize applications (and cloud) while still controlling what matters most
Bryan Langston, Director of Architecture, will talk about trusted container registry best practices and Docker Enterprise’s experimental implementation of the NIST OSCAL security standard.
The long road to cloud-native applications: Inter-service communications, application architectures, and platform deployment patterns
Bruce Mathews, Sr. Solutions Architect, will cover the fundamentals of microservices architecture, inter-service communications from the Ops and Developer perspectives, and key design patterns for making service-mesh coordinated apps more operations-friendly.
Register now for Destination: Decentralization: https://konghq.com/events/destination-decentralization/#register 
The post Mirantis Partners with Kong for Destination: Decentralization Virtual Event appeared first on Mirantis | Pure Play Open Cloud.
Quelle: Mirantis

da Agency

Solutions and guidance to help content producers and creators work remotely

The global health pandemic has impacted every organization on the planet—no matter the size—their employees, and the customers they serve. The emphasis on social distancing and shelter in place orders have disrupted virtually every industry and form of business. The Media & Entertainment (M&E) industry is no exception. Most physical productions have been shut down for the foreseeable future. Remote access to post-production tools and content is theoretically possible, but in practice is fraught with numerous issues, given the historically evolved, fragmented nature of the available toolsets, vendor landscape, and the overall structure of the business

At the same time, more so today than ever before, people are turning to stories, content, and information to connect us with each other. If you need help or assistance with general remote work and collaboration, please visit this blog.

If you’d like to learn more about best practices and solutions for M&E workloads, such as VFX, editorial, and other post-production workflows—which are more sensitive to network latency, require specialized high-performance hardware and software in custom pipelines, and where assets are mostly stored on-premises (sometimes in air-gapped environments)—read on.

First, leveraging existing on-premises hardware can be a quick solution to get your creative teams up and running. This works when you have devices inside the perimeter firewall, tied to specific hardware and network configurations that can be hard to replicate in the cloud. It also enables cloud as a next step rather than a first step, helping you fully leverage existing assets and only pay for cloud as you need it. Solutions such as Teradici Cloud Access Software running on your artists’ machines enables full utilization of desktop computing power, while your networking teams provide a secure tunnel to that machine. No data movement is necessary, and latency impacts between storage and machine are minimized, making this a simple, fast solution to get your creatives working again. For more information, read Teradici’s Work-From-Home Rapid Response Guide and specific guidance for standalone computers with Consumer Grade NVIDIA GPUs.

Customers who need to enable remote artists with cloud workstations, while maintaining data on-premises, can also try out an experimental way to use Avere vFXT for Azure caching policies to further reduce latency. This new approach optimizes creation, deletion, and listing of files on remote NFS shares often impacted by increased latency. 

Second, several Azure partners have accelerated work already in progress to provide customers with new remote options, starting with editorial.

Avid has made their new Avid Edit on Demand solution immediately available through their Early Access Program. This is a great solution for broadcasters and studios who want to spin up editorial workgroups of up to 30 users. While the solution will work for customers anywhere in the world, it is currently deployed in US West 2, East US 2, North Europe, and Japan East so customers closest to those regions will have the best user experience. You can apply to the Early Access Program here, and applications take about two days to process. Avid is also working to create a standardized Bring Your Own License (BYOL) and Software as a Service (SaaS) that addresses enterprise post-production requirements.
Adobe customers who purchase Creative Cloud for individuals or teams can use Adobe Premiere Pro for editing in a variety of remote work scenarios. Adobe has also extended existing subscriptions for an additional two months. For qualified  Enterprise customers who would like to virtualize and deploy Creative Cloud applications in their environments, Adobe wanted us to let you know, “it is permitted as outlined in the Creative Cloud Enterprise Terms of Use.” Customers can contact their Adobe Enterprise representative for more details and guidance on best practices and eligibility.
BeBop, powered by Microsoft Azure, enables visual effects artists, editors, animators, and post-production professionals to create and collaborate from any corner of the globe, with high security, using just a modest internet connection. Customers can remotely access Adobe Creative Cloud applications, Foundry software, and Autodesk products and subscriptions including Over the Shoulder capabilities and BeBop Rocket File Transfer. You can sign up at Bebop’s website.
StratusCore provides a comprehensive platform for the remote content creation workforce including industry leading software tools through StratusCore’s marketplace; virtual workstation, render nodes and fast storage; project management, budget and analytics for a variety of scenarios. Individuals and small teams can sign up here and enterprises can email them here.

Third, while these solutions work well for small to medium projects, teams, and creative workflows, we know major studios, enterprise broadcasters, advertisers, and publishers have unique needs. If you are in this segment and need help enabling creative—or other Media and Entertainment specific workflows for remote work—please reach out to your Microsoft sales, support, or product group contacts so we can help

I know that we all want to get people in this industry back to work, while keeping everyone as healthy and safe as possible!

We’ll keep you updated as more guidance becomes available, but until then thank you for everything everyone is doing as we manage through an unprecedented time, together.
Quelle: Azure

da Agency

Using Azure Monitor source map support to debug JavaScript errors

Azure Monitor’s new source map support expands a growing list of tools that empower developers to observe, diagnose, and debug their JavaScript applications.

Difficult to debug

As organizations rapidly adopt modern JavaScript frontend frameworks such as React, Angular, and Vue, they are left with an observability challenge. Developers frequently minify/uglify/bundle their JavaScript application upon deployment to make their pages more performant and lightweight which obfuscates the telemetry collected from uncaught errors and makes those errors difficult to discern.

Source maps help solve this challenge. However, it’s difficult to associate the captured stack trace with the correct source map. Add in the need to support multiple versions of a page, A/B testing, and safe-deploy flighting, and it’s nearly impossible to quickly troubleshoot and fix production errors.

Unminify with one-click

Azure Monitor’s new source map integration enables users to link an Azure Monitor Application Insights Resource to an Azure Blob Services Container and unminify their call stacks from the Azure Portal with a single click. Configure continuous integration and continuous delivery (CI/CD) pipelines to automatically upload your source maps to Blob storage for a seamless end-to-end experience.

Microsoft Cloud App Security’s story

The Microsoft Cloud App Security (MCAS) Team at Microsoft manages a highly scalable service with a React JavaScript frontend and uses Azure Monitor Application Insights for clientside observability.

Over the last five years, they’ve grown in their agility to deploying multiple versions per day. Each deployment results in hundreds of source map files, which are automatically uploaded to Azure Blob container folders according to version and type and stored for 30 days.

Daniel Goltz, Senior Software Engineering Manager, on the MCAS Team explains, “The Source Map Integration is a game-changer for our team. Before it was very hard and sometimes impossible to debug and resolve JavaScript based on the unminified stack trace of exceptions. Now with the integration enabled, we are able to track errors to the exact line that faulted and fix the bug within minutes.”

Debugging JavaScript demo

Here’s an example scenario from a demo application:

​

Get started

Configure source map support once, and all users of the Application Insights Resource benefit. Here are three steps to get started:

Enable web monitoring using our JavaScript SDK.
Configure a Source Map storage account.

End-to-end transaction details blade.
Properties blade.

Configure CI/CD pipeline.

Note: Add an Azure File Copy task to your Azure DevOps Build pipeline to upload source map files to Blob each time a new version of your application deploys to ensure relevant source map files are available.

 

Manually drag source map

If source map storage is not yet configured or if your source map file is missing from the configured Azure Blob storage container, it’s still possible to manually drag and drop a source map file onto the call stack in the Azure Portal.

 

Submit your feedback

Finally, this feature is only possible because our Azure Monitor community spoke out on GitHub. Please keep talking, and we’ll keep listening. Join the conversation by entering an idea on UserVoice, creating a new issue on GitHub, asking a question on StackOverflow, or posting a comment below.
Quelle: Azure

da Agency

Learn to build secure and reliable systems with a new book from Google

In the new “Building Secure and Reliable Systems: Best Practices for Designing, Implementing, and Maintaining Systems” book, engineers across Google’s security and SRE organizations share best practices to help you design scalable and reliable systems that are fundamentally secure. Reliability matters for businesses throughout all kinds of ups and downs. We’ve also heard that security is an essential tool for many of you building your own SRE practices, and we’re pleased to bring the followup “Building Secure and Reliable Systems” book to practitioners across industries. We think it will be an essential read for those of you tasked with ensuring the security and reliability of the systems you run. Just as the SRE Book quickly became foundational for practitioners across the industry, we think that the SRS Book will be an essential read for people responsible for the security and reliability of the systems they run. More than 150 contributors across dozens of offices and time zones present Google and industry stories, and share what we’ve learned over the years. We provide high-level principles and practical solutions that you can implement in a way that suits the unique environment specific to your product.What you’ll find in the SRS bookThis book was inspired by a couple of fundamental questions: Can a system be considered truly reliable if it isn’t fundamentally secure? Or can it be considered secure if it’s unreliable? At Google, we’ve spent a lot of time considering these concepts. When we published the SRE book (now inducted into a cybersecurity hall of fame!), security was one rather large topic that we didn’t have the bandwidth to delve into, given the already large scope of the book.Now, in the SRS book, we specifically explore how these concepts are intertwined. Because security and reliability are everyone’s responsibility, this book is relevant for anyone who designs, implements, or maintains systems. We’re challenging the dividing lines between the traditional professional roles of developers, SREs, and security engineers. We argue that everyone should be thinking about reliability and security from the very beginning of the development process, and should be integrating those principles as early as possible into the system life cycle. In the book, we examine security and reliability through multiple perspectives:Design strategies: For example, best practices to design for understandability, resilience, and recovery, as well as specific design principles such as least privilegeRecommendations for coding, testing, and debugging practicesStrategies to prepare for, respond to, and recover from incidentsCultural best practices to help teams across your organization collaborate effectively“Building Secure and Reliable Systems” is available now. You can find a freely downloadable copy on the Google SRE website. You can also purchase a physical copy from your preferred retailer.
Quelle: Google Cloud Platform

da Agency

New AI-driven features in Dataprep enhance the wrangling experience

Since the inception of Cloud Dataprep by Trifacta, we’ve focused on making the data preparation work of data professionals more accessible and efficient, with a determined intention to make the work of preparing data more enjoyable (and even fun, in some cases!).The latest release of Dataprep brings new and enhanced AI-driven features to advance your wrangling experience a step further. We’ve improved the Dataprep core transformation experience, so it’s easier and faster to clean data and operationalize your wrangling recipes. We’ve been infusing AI-driven functions in many parts of Dataprep so it can suggest the best ways to transform data or figure out automatically how to clean the data, even for complex analytics cases. This effort has helped a broad set of business users access and leverage data in their transformational journey to become data-driven organizations. With data preparation fully integrated with our smart analytics portfolio, including ingestion, storage, processing, reporting, and machine learning, self-service analytics for everyone—not just data scientists and analysts—is becoming a reality.Let’s zoom in on a few new features and see how they can make data preparation easier.Improving fuzzy matching on rapid targetWhen you prepare your data using Dataprep, you can use the exploratory mode to figure out what the data is worth and how you might use it. You could also use exploratory mode to enhance an existing data warehouse or some production zones in a data lake.  For the latter, you can use Rapid Target to quickly map your wrangling recipe to an existing data schema in BigQuery or a file in Cloud Storage. Using Rapid Target means you don’t have to bother matching your data transformation rules to an existing database schema; Dataprep will figure it out for you using AI. With the new release, in addition to matching schemas by strict column name equality, we have added fuzzy-matching algorithms to auto-align columns with the target schema by column name similarities or column content. Here’s what that looks like:Dataprep suggests best matches between the columns of your recipe and an existing data schema. You can accept it, change it, or go back to your recipe to modify it so the data can match. This is yet another feature that helps load the data warehouse faster, so you can focus on analyzing your data.Adding local settings and improved date/time interface When you work on a new data set, the first thing that Dataprep will figure out is the data structure and the data type of each column. Doing so, with the help of some AI algorithms, Dataprep can more easily identify data errors based on expected types and how to clean those types. However, some data types, such as dates or currencies, may be more complicated to infer based on the region you’re located in or the region the data is sourced from. For this particular reason, we’ve added a local setting option (at the project level and user level) so that Dataprep can infer data types—in particular, date and time when there is ambiguity in the data.For example, in the image below, changing the local setting to France will tell Dataprep to assume the dates should be in a French format, such as dd/mm/yyyy or 10-Mars-2020. The inference algorithms will determine the quality score of the data and the suggestions rules to clean that particular date column in a French format. This makes your job a whole lot easier.As a bonus to the date type management, we’ve streamlined the date/time data type menu. This new menu makes it far easier to find the exact date/time format you are looking for, letting you search instead of look at a list of 100 values, as shown here:Increasing cross-project data consistency with macro import/export As you’re going through your data preparation recipes, you will necessarily surface data pattern issues, such as similar data quality issues and similar ways to resolve them. Sometimes cleaning just one column requires a dozen steps, and you don’t want to rewrite all these steps every time this data issue occurs. That’s what macros are for.A macro is a sequence of steps that you can use as a single, customizable step in other data preparation recipes. So once you have defined one particular macro to apply data transformations, you can reuse it in other recipes so all your colleagues can benefit from it. This is particularly handy when you open a data lake sandbox and give access to business users to discover and transform data. By providing a set of macros to clean data, you will bring consistency across users, and if the data evolves you can also evolve the macros accordingly.  With this new ability to import and export macros, you can maintain consistency across all of your Dataprep deployments across departments or stages of your projects (i.e., dev, test, production), create backups, and create an audit trail for your macros. You can also post or use existing macros from the Wrangler Exchange community, and build up a repository of commonly used macros, extending the flexibility of Dataprep’s Wrangle language.There are many more features that have been added to Dataprep, such as downloadable profile results, new trigonometry and statistical functions, shortcuts options, and many more. You can check them out in the release notes and learn more about Dataprep.Happy wrangling!
Quelle: Google Cloud Platform

da Agency

Helping contact centers respond rapidly to customer concerns about COVID-19

As COVID-19 has spread globally, people are turning to governments, healthcare organizations, and other businesses with questions about their health and wellness, finances, and more. This sudden, unprecedented demand is putting strain on customer support resources, and many organizations are telling us that they’re struggling to respond to customers effectively during this critical time.If your organization is facing these challenges, you can respond to your customers’ questions related to COVID-19 and your business with Contact Center AI, which can provide a first line of response through 24/7 conversational self-service support via chat or over the phone. As speed is especially important, we’ve launched the Rapid Response Virtual Agent program, a quick way to get up and running with Contact Center AI.To learn how to launch a virtual agent (chat or voice) check out the documentation. It includes information on how to integrate Dialogflow Messenger, which provides a customizable chat dialog for your agent that can be embedded in your website so you can easily deploy your chatbot on the web and make it engaging with rich UI support.We’ve also made it easier to add COVID-19 content to your virtual agent with the ability to integrate open-source templates from organizations that have already launched similar initiatives. For example, Verily, in partnership with Google Cloud, has launched the Pathfinder virtual agent template for health systems and hospitals. It enables you to create chat or voice bots that answer questions about COVID-19 symptoms and provide the latest guidance from public health authorities like the Centers for Disease Control and Prevention and World Health Organization (WHO).Designed to help government agencies, healthcare and public health organizations, nonprofits, and businesses in other industries impacted by COVID-19, such as travel, financial services, and retail, Contact Center AI’s Rapid Response Virtual Agent program is available around the world in any of the 23 languages supported by Dialogflow. Because time is of the essence, we will be working with our contact center partners, as well with our various systems integrator and consulting partners, to help ensure these deployments and integrations happen quickly.Contact center partners include:8x8AvayaCiscoFive9GenesysMitelTwilioVonageSystem integrator partners include:AccentureDeloitte Consulting LLPInfosysKPMGHCLTCSWiproMaven WaveQuantiphiSADASpringMLSome organizations have already begun working to create a resource to help with customer needs:Oklahoma Employment Security Commission”The Oklahoma Employment Security Commission has been experiencing unprecedented call volumes (over 60,000 daily) as a result of unemployment claims related to the COVID-19 pandemic. Contact Center AI, integrated into the commission’s website, is aiding with call diversion, helping reduce wait times, and providing the commission with an additional channel for addressing unemployment related questions.” – David Ostrowe, Secretary of Digital Transformation and Administration, Oklahoma StateUniversity of Pennsylvania“It’s been an amazing, collaborative effort getting this quickly created and launched, and we are grateful to the Google Cloud/Verily teams for their efforts. We are seeing a lot of people looking for an authoritative source of information, and being able to scale to meet the demand helps us disseminate accurate information more quickly.”We will use this both to help answer common questions and to assess symptoms and help with triage to make sure people are routed to the most appropriate clinical intake level. As the number of patients with concerns grows, we expect that having an automated and validated way of addressing inquiries will be an important part of ensuring the highest possible quality of response to concerns of different individuals. We will route patients with concerning symptoms to confer directly with a member of our clinical team while addressing more routine or lower acuity questions through the bot.” – Kevin G. Volpp, MD, PhD, Director, Center for Health Incentives and Behavioral Economics (CHIBE), University of PennsylvaniaThe work we’re doing today is part of our focus on helping businesses and organizations most impacted by the COVID-19 pandemic. As Google CEO Sundar Pichai and Google Cloud CEO Thomas Kurian explained in recent blog posts, our goal is to help people stay safe, informed, and connected during these extraordinary times. For more information on the Rapid Response Virtual Agent program, please see our website and the documentation on how to deploy your own virtual agent. Existing customers can contact your Google Cloud account manager, your contact center, or systems integration partners for assistance.
Quelle: Google Cloud Platform

da Agency

Detect large-scale cryptocurrency mining attack against Kubernetes clusters

Azure Security Center's threat protection enables you to detect and prevent threats across a wide variety of services from Infrastructure as a Service (IaaS) layer to Platform as a Service (PaaS) resources in Azure, such as IoT, App Service, and on-premises virtual machines.

At Ignite 2019 we announced new threat protection capabilities to counter sophisticated threats on cloud platforms, including preview for threat protection for Azure Kubernetes Service (AKS) Support in Security Center and preview for vulnerability assessment for Azure Container Registry (ACR) images.

Azure Security Center and Kubernetes clusters 

In this blog, we will describe a recent large-scale cryptocurrency mining attack against Kubernetes clusters that was recently discovered by Azure Security Center. This is one of the many examples Azure Security Center can help you protect your Kubernetes clusters from threats.

Crypto mining attacks in containerized environments aren’t new. In Azure Security Center, we regularly detect a wide range of mining activities that run inside containers. Usually, those activities are running inside vulnerable containers, such as web applications, with known vulnerabilities that are exploited.

Recently, Azure Security Center detected a new crypto mining campaign that targets specifically Kubernetes environments. What differs this attack from other crypto mining attacks is its scale: within only two hours a malicious container was deployed on tens of Kubernetes clusters.

The containers ran an image from a public repository: kannix/monero-miner. This image runs XMRig, a very popular open source Monero miner.

The telemetries showed that container was deployed by a Kubernetes Deployment named kube-control.

As can be shown in the Deployment configuration below, the Deployment, in this case, ensures that 10 replicas of the pod would run on each cluster:

In addition, the same actor that deployed the crypto mining containers also enumerated the cluster resources including Kubernetes secrets. This might lead to exposure of connection strings, passwords, and other secrets which might enable lateral movement.

The interesting part is that the identity in this activity is system:serviceaccount:kube-system:kubernetes-dashboard which is the dashboard’s service account.
This fact indicates that the malicious container was deployed by the Kubernetes dashboard. The resources enumeration was also initiated by the dashboard’s service account.

There are three options for how an attacker can take advantage of the Kubernetes dashboard:

Exposed dashboard: The cluster owner exposed the dashboard to the internet, and the attacker found it by scanning.
The attacker gained access to a single container in the cluster and used the internal networking of the cluster for accessing the dashboard (which is possible by the default behavior of Kubernetes).
Legitimate browsing to the dashboard using cloud or cluster credentials.

The question is which one of the three options above was involved in this attack? To answer this question, we can use a hint that Azure Security Center gives, security alerts on the exposure of the Kubernetes dashboard. Azure Security Center alerts when the Kubernetes dashboard is exposed to the Internet. The fact that this security alert was triggered on some of the attacked clusters implies that the access vector here is an exposed dashboard to the Internet.

A representation of this attack on the Kubernetes attack matrix would look like:

 

Avoiding cryptocurrency mining attacks

How could this be avoided?

Do not expose the Kubernetes dashboard to the Internet: Exposing the dashboard to the Internet means exposing a management interface.
Apply RBAC in the cluster: When RBAC is enabled, the dashboard’s service account has by default very limited permissions which won’t allow any functionality, including deploying new containers.
Grant only necessary permissions to the service accounts: If the dashboard is used, make sure to apply only necessary permissions to the dashboard’s service account. For example, if the dashboard is used for monitoring only, grant only “get” permissions to the service account.
Allow only trusted images: Enforce deployment of only trusted containers, from trusted registries.

Learn more

Kubernetes is quickly becoming the new standard for deploying and managing software in the cloud. Few people have extensive experience with Kubernetes and many only focuses on general engineering and administration and overlook the security aspect. Kubernetes environment needs to be configured carefully to be secure, making sure no container focused attack surface doors are not left open is exposed for attackers. Azure Security Center provides:

Discovery and Visibility: Continuous discovery of managed AKS instances within Security Center’s registered subscriptions.
Secure Score recommendations: Actionable items to help customers comply with security best practices in AKS as part of the customer’s Secure Score, such as "Role-Based Access Control should be used to restrict access to a Kubernetes Service Cluster."
Threat Detection: Host and cluster-based analytics, such as “A privileged container detected."

To learn more about AKS Support in Azure Security Center, please visit the documentation here.
Quelle: Azure