Ariel Shuper

Entrepreneur, Product and Strategy executive, @Cisco a cloud native technologies fan, security focused. Tweets are my own opinion

[Ariel Shuper @ArielShuper]

Indeed, serverless functions outside AWS are used as a small corner cases. Interestingly, it’s the whole “serverless” motion which is more popular in AWS extending to new services every year while in the other cloud providers it’s steal a catch-up game.

[Steve Bryen @steven_bryen]

It seems like @awscloud is the only provider really pushing Lambda/Functions for a broad range of workloads today. Hard to find solid @Azure use cases too.

Link to the full GCP blog - https://t.co/jlT1XhKwqd

[Tim Allclair @tallclair]

I'm really excited that Pod Security Admission is stable in #Kubernetes v1.25. It provides super-simple out-of-the-box pod security, and I'm optimistic that it will raise the bar for baseline Kubernetes hardening.

https://t.co/te02IFuX2f

[Ariel Shuper @ArielShuper]

@c0d3G33k I'm not sure I'd classify it as "shift left " security. Yes, it all runs in automatic pipelines and use open source tools, but the big question is what do you do with all the findings? how do you triage and prioritize them?

[Clint Gibler @clintgibler]

🛠️ Building an AppSec Pipeline for Continuous Visibility

@c0d3G33k describes @chargebee's approach using free and open-source tools

* SAST: Semgrep
* SCA: @owasp Dependency Check
* Secrets Scanning: Gitleaks
* SBOM: CycloneDx

Results ➡️ @defectdojo

https://t.co/EArAqJbpxj

[KnativeProject @KnativeProject]

Knative is celebrating 4 amazing years of being an #OpenSource project! 🎁

[Ariel Shuper @ArielShuper]

Attending the Open Source Summit this week? Interested in #Containerssecurity? #Kubernetessecurity? come to my session: https://t.co/2Qd5YsqB08 #ossummit @sched

[Outshift by Cisco @outshiftbycisco]

We are big fans 👍👍 of serverless applications...but even they are vulnerable to attacks and hacks 👾. Get the details on how to prevent others from tampering with your code before #deployment in this #CiscoTechBlog from @ArielShuper:

[Ariel Shuper @ArielShuper]

It’s a good question which requires evaluation when we test modern micro services applications. IMO some of the classical tests/techniques require a big change (and not simple adaptations like insertion to CI/CD pipelines)

[Tanya Janca | Shehackspurple @shehackspurple]

What is application security? Wrong answers only!

[Ariel Shuper @ArielShuper]

@urlichsanais @lumjjb @whoiskatrin @hashishrajan @urlichsanais I can assure you that it was by mistake and not intentional

[Ariel Shuper @ArielShuper]

Had great time presenting today at the #CNSecurityCon. It was great to present in person (and to see myself in a prerecorded session)

[Ariel Shuper @ArielShuper]

#KubeCon EU and #CNSecurityCon here we come

[Liran Tal @liran_tal]

I just wrapped up a Twitter List of all speakers on CNCF's #SecurityCon event in-case you want to follow-up on what they are up to: https://t.co/DjOSJpAaMe

It's colocated with KubeCon here in Valencia 🇪🇸
See y'all tomorrow on the 1st day 👋

[Outshift by Cisco @outshiftbycisco]

💻 This #TechnologyDay, take a deep dive into our #CiscoTechBlog for everything you need to see into the #FutureOfTech.
Kick off with this serverless security blog written special for today from #CiscoETI's @ArielShuper: https://t.co/VhoCRqmPTc

[Ariel Shuper @ArielShuper]

I'm excited to present how to sign and validate #serverless functions with @OpenSSF #cosignat next week @Cloud_Native SecurityCon next week #KubeConEU
#CNSecurityCon
https://t.co/lGeVgI1Tnb

[Ariel Shuper @ArielShuper]

Great signal for the emergence of a new standard in code/image security… https://t.co/RA5vgzdwsJ

[Ariel Shuper @ArielShuper]

@AstasiaMyers @HubSpot is my favourite

[Ariel Shuper @ArielShuper]

PM job interview really depends on how the specific company defines the PM role /their expectations. The PM spectrum is wide, between inbound and outbound

[Lenny Rachitsky @lennysan]

PMs: What advice and/or resources have you found to be the most helpful for preparing for a PM job interview?

[Ariel Shuper @ArielShuper]

Interesting addition to @DependencyTrack with #VEX adding more sense to Vulnerabilities findings, great step!

[Dependency-Track @DependencyTrack]

#OWASP Dependency-Track v4.4.0 now available and supports:

Vulnerability Exploitability Exchange (VEX) allows software creators to communicate the exploitability of vulnerable components to software consumers.

VEX is native to #CycloneDX and is vital for operationalizing SBOM.

[Ariel Shuper @ArielShuper]

Is #IaC files a new target for #software #supplychain attacks? great article from @xssfox about potential exploits https://t.co/4MCdalEX7e
Time to think about #codesigning extension for cloud deployments files

[Ariel Shuper @ArielShuper]

@JLLeitschuh No doubt that the CVE scoring and numbering requires revision. Saw lots of complains about the process and it’s outcome. Yet, it would be better to agree on a certain standard/unified scoring mechanism vs individual scoring

[Ariel Shuper @ArielShuper]

Just a bad luck🤣🤣

[Matt Fuller @matthewdfuller]

How did we decide that "Goat" would be used for intentionally-vulnerable test environments (WebGoat, Terragoat)? Did someone just look at a goat and think "wow, that's a vulnerable animal?" 🐐