security – Rafaela Azevedo

Last month, I had the incredible opportunity to attend Conf42 Site Reliability Engineering 2023 Conference!

The conference as a whole was really interesting but my highlights are:

Replacing Privileged Users With Automated Just-in-Time Access Requests by Travis Rodgers

Managing privileged access to resources can be cumbersome, with developers often needing temporary access beyond their regular duties.
Just-in-time access solutions allow engineers to escalate privileges when necessary, applying the principle of least privilege in a secure manner.
Role-Based Access Control (RBAC): Implementing RBAC further enhances security by defining and assigning roles, reducing the need for admin accounts.

Building Automated Quality Gates into your CI pipelines by Craig Risi (My favourite)

How to incorporate automated quality checks at various stages of the CI pipeline to ensure the delivery of high-quality software.
It highlights the benefits of having automated quality gates in place, including early bug detection and prevention.
Practical guidance on implementing quality gates using tools and techniques such as static code analysis, code coverage analysis, and automated testing.

GPT: Revolutionizing Monitoring and Logging Systems by Clay Langston

Use GPT (Generative Pre-trained Transformer) to enhance logging and monitoring performance.
Maximize log value and improve system performance.
Automate the process by integrating with ELK (Elasticsearch, Logstash, and Kibana).
Construct effective prompts to extract valuable insights from logs.

Observability: one of the strongest muscles for SRE by Jhonnatan Gil Chaves

Focus on the big picture when implementing SRE practices.
Recognize the importance of the team and tools in SRE implementations.
Don’t overlook the broader view of your IT components.

CICD – The SRE-DevOps Overlay by Safeer CM and Garima Bajpai

Site reliability engineering (SRE) and DevOps practices have overlapping boundaries in many organizations.
Continuous integration and continuous delivery (CI/CD) are essential aspects of this overlap.
CI/CD serves as a prerequisite for many core SRE practices.

How to achieve the scalability, high availability, and elastic ability of your database infrastructure on Kubernetes by Trista Pan

How to make the clusters scalable, elastic, and highly available.
Traffic governance between applications and databases plays a crucial role in achieving these goals.
Effective way to manage and distribute traffic.

Measuring Reliability in Production Ramon Medrano Llamas

Identifying Critical User Journeys (CUJs) and recommendations for selecting appropriate metrics as SLI and SLO targets.
Practical insights and actionable steps for implementing SLIs and SLOs in your own applications.

If you missed out on Conf42 SRE 2023, fear not! The link with the abstract of the talks, the speakers and other details is here and you can also watch below the talks on youtube 🙌

This month I quickly attended the AWS Summit 2023 and here are my highlights from the conference:

The Data Metaverse Experience

The metaverse is relevant to businesses, with several concepts and technologies already being utilised, like PWC is able to see what is the best place to start a coffee shop as they have enough data to show where the competitors are, business around where people go out for lunch, nearest public transports.
Enterprise applications, such as employee training and simulating operations, are currently leading the way in metaverse adoption.
The metaverse may experience cycles of boom and bust, similar to other innovations like AI and the internet.
It’s possible to separate the reality from the hype and take practical steps to meet your company’s metaverse needs.
The metaverse promises a realistic 3D digital world with persistent elements and decentralized control.
Business implications include virtual reality visualization, enhanced customer experiences, and parallel production in physical and virtual environments.
Companies are already using the metaverse for employee recruitment, collaboration, digital twins, customer experience enhancement, and marketing/selling virtual products.

DON’T TRUST ANYONE

First, just sharing some worrisome statistics, so you can understand how security is important:
- There is a hacker attack every 39 seconds.
- Russian hackers are the fastest.
- 300,000 new malware is created every day.
- Multi-factor authentication and encryption are the biggest hacker obstacles.
- You can become an American citizen for $6,000.
- The average cost of a data breach in 2022 was $4.35 million, an increase of 2.6% from the previous year and 12.7% since 2020, according to the 2022 Cost of a Data Breach Report by Ponemon Institute.
- The cybersecurity budget in the US is $14.98 billion.
Hashicorp, showed what is the anatomy of a breach, how long a hacker might spend to get access to your system and how.
Be sure you limit humans interactions so you remove the errors.
Frequent rotate your tokens and make sure you request for the access in between stages.
(This was not in the talk, but nice tip) If you are curious about how social engineering is able to by pass access easily in companies, I recommend The Art of Deception book, it is unbelievable how people are so eager to help others and not be a burden they just give information away even if it is not following the protocol.

Make business and tech people happy

Community practice is extremely important, so if you are delivery lead be sure you promote regular knowledge sharing sessions, so people can contribute and also advocate for it.
All the teams need to follow some standards so they can move faster and the learning curve is not too long.
Tackle the tech debt to prevent and reduce inefficiency.
Promote webinars among the teams and also demos so people feel inspired to adopt and more aware of the updates.
All of these points will create a continuous improvement culture, were people feel they can take initiatives and feel more satisfied with their work.
Align strategic technical improvements with business goal (This is kind obvious 😂 Try to make everyone happy and find a middle ground)
Continuous process to have technical challenges in the team. You know software engineers love to learn, this is what drives most of us.
Measure and prove impact of each technical improvement with metrics, and make sure it has minimum or zero impact on BAU.

And of course free lunch and coffee !! Joking, I didn’t even have lunch on that day 😂 Couldn’t watch all the talks I wanted, but was amazing to connect with like minded people, refresh my mind and learn new things!