Home on TCB Technologies, Inc.

OIDC and CICD: Why Your CI Pipeline Is Your Greatest Security Threat

Thu, 01 Feb 2024 16:00:00 +0000

Your CI/CD Process is chock full of credentials, and almost anyone in your company has access to it. Configuring your CI correctly is vital to supply chain security. We discuss how to reduce that attack surface by enforcing proper branch permissions and using OIDC to reduce long-lived credentials and tie branches to roles.

Presented at SRECon 2024 and BSides Seattle 2024

Improving Secure Pod-to-Pod Communication Within Kubernetes Using Trust Bundles

Wed, 01 Feb 2023 04:40:00 -0700

New features are being added to Kubernetes which allow for roots of trust to be specified for applications on a cluster. These mechanisms are being added as “trust bundles” (or trust anchor sets). We demonstrate the updates to our previous work in creating convenient mechanisms to provide certificates to every pod, allow pods access to them and use them for mutual authentication. Our work leverages work being done by the cert-manager project, the SPIFFE project and KEP-3257 for trust anchor sets to automate the creation of TLS certificates for every pod and establish patterns for mTLS. Finally, we compare and contrast this to current methods for providing cluster communication security (service meshes) and present areas for refinement. This is a significant rework of our previous presentation and software to work with changes to the Kubernetes Ecosystem as the concepts have been refined and evolved.

Why we're building a lemonade stand

Tue, 19 Oct 2021 00:40:04 -0700

TCBTech’s newest software release is a Lemonade Stand. At least, a virtual facsimile of one. We’ve been building a demo of microservices architecture on Kubernetes, including build, deployment, and CI phases. It’s used for our Meetup, Eastside Kubernetes Workshop, as a demo and hack project.

Architecture of Lemonade Stand:
Lemonade Stand is a small collection of Microservices. A “Lemonade Stand” service first requests a cup from the “Cup Supply” service. It then takes that cup ID, passes it to the “Lemonade Supply” service, and gets a filled cup back, which it returns to the customer.

Practical TLS Advice for Large Infrastructure

Thu, 14 Oct 2021 03:30:00 +0000

We will present practical advice for leveraging TLS to secure communications across your infrastructure. This applies to nodes and pods on Kubernetes or on other large deployment infrastructure. The current tools set for large leaves various gaps for deploying TLS and also causes friction within your infrastructure.

Protocols like ACME and tools like service meshes provide some support for distributing certificates but do not help with the larger problems of certificate authority architecture, nor provide advice for how to build certificates that strengthen your security posture.

Achieving Mutual TLS: Secure Pod-to-Pod Communication Without the Hassle

Wed, 09 Dec 2020 13:25:00 -0700

Security is important in almost all applications and TLS is used to secure communications between components and to end users or outside APIs. One difficulty with TLS can be managing certificates.

Presented at SRECon Americas 2020

Control Theory for SRE

Wed, 02 Oct 2019 14:00:00 +0000

Control Theory is a long and well-studied discipline in engineering. Nearly every large scale industrial process has dedicated control engineers, creating and maintaining safety and quality systems by assuring that parameters remain within bounds—or alert appropriately.

This session will teach you how to create a PID (Proportional, Integral, Derivative) controller to autoscale your Kubernetes deployment based on a custom target. This controller ensures smooth scale-up and scale down.

Presented at SRECon EMEA 2019

Quick Incident Response

Fri, 07 Sep 2012 16:35:09 +0000

“How do I fix this?” read the post from someone whose site was hacked. S/he wanted advice on how to find the hacker’s entry point. Good question, but the right question is: “What should I do when I discover my website has been hacked?” When you notice that someone (or something, like a bot) has tampered with your system you have a serious incident (not a bug) and you need a response plan (not a reaction or quick bug fix):

Process Analysis

Mon, 27 Feb 2012 18:18:40 +0000

Process Analysis

Business is built upon repetitive processes. As needs change, sometimes we continue using existing processes because they are ingrained, or simply because we cannot visualize effective changes. This is where TCB can help. TCB will work with you to more clearly define your business goals and the processes you are using to achieve them – computerized or manual. We will review your process structure and work with you and your staff to refine procedures that will better utilize your resources, saving you time, money or – hopefully – both!

Systems Integration

Mon, 27 Feb 2012 18:18:15 +0000

Systems Integration

Combining systems to achieve the maximum effect is as much an art as it is a science: a number of competing issues need to be balanced. These issues include concurrency of updates between systems, the timing of data refresh cycles, and security of data transmission with outside providers. Taking all related technical factors into account and ensuring that your business needs are met requires experience and an in-depth understanding of trade-offs inherent to your design. TCB can help you determine which systems, both hardware and software, best meet your needs. TCB consultants constantly strive to maintain an unparalleled level of knowledge regarding current hardware and software offerings in a variety of areas.

Software Development

Mon, 27 Feb 2012 18:17:49 +0000

Software Development

Design of software is key. TCB provides experienced architects for software design and development or systems integration projects, as well as offering project management for on- or off-site software development. We carefully negotiate the balance between business needs and technical reality to ensure that your solution is effective for both short- and long-term goals. Deliverable time frames are kept short using agile development techniques, so that your business can both make progress and provide feedback to the development team. Oftentimes the best choice of architecture and platform is more efficiently related to a development team’s skill set than to the inherent superiority of any one architecture. TCB can work with your development staff to plan and make the most effective use of the architecture which is right for your capabilities, or we can develop software for your needs. TCB has extensive experience with client-server, N-tier and web services application architectures.

Regulatory Compliance Preparation

Mon, 27 Feb 2012 18:17:22 +0000

Regulatory Compliance Preparation

There are a large number of business regulations governing data security and information technology operation. TCB has experience in auditing and managing regulatory compliance projects for both large (Fortune 500) and small companies. Preparation is key to being in compliance with various regulatory frameworks. TCB helps owners or managers identify which regulations apply to their businesses, define the overlap of the regulatory frameworks, and determine to which business areas each applies. This provides a road map for managing and demonstrating compliance.

Information Security Management

Mon, 27 Feb 2012 18:16:53 +0000

Information Security Management

Information Security is a high priority for any organization, and the large number of specialized solutions being offered today make protecting your data a difficult task. TCB Technologies staff have many years of experience in helping businesses identify their information assets and develop plans to protect them. Once a plan is in place, TCB helps you determine what steps to take and which products will be effective for your business. Mark Hahn, CISSP, oversees all security management processes personally, to ensure that your business is protecting itself and your clients.

Applications Security

Mon, 27 Feb 2012 18:16:24 +0000

Applications Security

Encryption and secure storage are just the starting points for a secure design. Strong identification and authorization of users and business partners are critical components, and all aspects of an application’s use must be evaluated to achieve maximum performance while maintaining appropriate security. TCB has extensive experience in designing secure applications and applying secure data protocols for financial services clients, as well as others with different security concerns.

Why TCB?

Mon, 27 Feb 2012 17:50:48 +0000

Our business is making your business better.

You’re the expert; it’s your business. We never would tell you how to run it. We will give you an unbiased analysis of how you could run it more effectively, and what tools would help. We all have those “AHA!” moments, when the impossible suddenly becomes clear. Our job is to bring those ‘aha’ moments to you more frequently, and with less effort on your part. TCB consultants come from outside your organization, so we are not invested in current processes. We take a fresh look at how things should work, then take a top-down/bottom-up approach. We combine our outsiders’ view with your staff’s experience and insights. We integrate the views and combine them to determine what changes would be most effective, and how best to achieve them. If you need to computerize manual processes, we’ll tell you, and then we’ll develop the process. If adding computerized bells and whistles will impress your clients and bring you more business, we’ll tell you. If the goodies are fun to have but add no business value, we’ll tell you that, too. We’ll work with you to implement new strategies, whether by modifying existing software, purchasing or developing new equipment, or just by developing clearer training and documentation. Whatever it takes to make your business the best it can be. Because our business is making your business better.

Contact Us

Mon, 27 Feb 2012 17:50:17 +0000

consulting@tcbtech.com

Search

Mon, 27 Feb 2012 17:49:33 +0000