A lot of code lines must be written… import java.io.BufferedReader; import java.io.IOException; import java.io.InputStreamReader; import java.net.InetAddress; import java.net.Socket; import java.net.UnknownHostException; import java.security.cert.X509Certificate; import java.text.MessageFormat; import java.util.ArrayList; import java.util.Enumeration; import java.util.Hashtable; import java.util.List;

Because sometimes it’s not possible to change sender and receiver and you must have a man in the middle.. import java.io.IOException; import java.io.OutputStream; import java.net.InetSocketAddress; import java.net.URI; import java.net.URLEncoder; import java.nio.ByteBuffer; import java.util.Base64; import java.util.concurrent.atomic.AtomicReference; import java.util.regex.Pattern; import java.util.zip.DataFormatException; import java.util.zip.Deflater; import java.util.zip.Inflater; import com.sun.net.httpserver.HttpExchange; import com.sun.net.httpserver.HttpHandler; import com.sun.net.httpserver.HttpServer…

As of time of writing Guacamole 1.4.0 available from DockerHub is built on old Debian with old libssh2 1.8.0 not supporting EC cryptography. To be able to use modern SSH we must bake own guacd container image. I decided to do it one time manually, so the Dockerfile is simplified…

The first choice for API security in the microservice architecture is OpenID Connect 1.0 and JWT. It’s important to know that there many ways to use JWT incorrectly. The JWT created as a result of interactive user authentication is copied to next (nested) API calls. It’s very easy to copy…

You installed very cool container security tool on every Kubernetes cluster in your enterpise. Some containers crush or hang, REST calls don’t work. Can we decompile the software to analyze what’s wrong? Yes, provided that we are in EU (see: https://eur-lex.europa.eu/EN/legal-content/summary/computer-programs-legal-protection.html) Decompilation * Prior authorisation from the rights-holder is not…

Conclusion: Microsoft with it’s cloud EDR is not yet ready on Linux. Competition has got more mature pro

Incident Response on AWS EC2 instance is easy. You need remote access and you just execute Incident Response script. What about EC2 instance hosting Kubernetes node without remote access to host OS? We can use privileged pod with host filesystem mounted. CONTAINERD=$(ps aux | grep -c “/usr/bin/containerd-shim-runc-v2”) INSIDE_PRIV_CONTAINER=0 [ $CONTAINERD -gt 0…

ForgeRock is a continuation of Sun Microsystems’ OpenSSO Enterprise (containing technologies from iPlanet/Sun ONE/DSEE, Glassfish AS, etc.). Open source components are available as OpenAM (https://github.com/OpenIdentityPlatform/OpenAM/releases). SentinelOne is a security platform supporting SAML SSO.

Mature organization uses internal reusable Malware Scanning API. Except clamav and standard command-line anti-virus Cyber Defence Center can expose as API malware detonation sandbox. Malware should not be run in a standard container because it can escape and infect the host. It should be run in the Firecracker or Kata…