Preventing IT Firefighting with Better Infrastructure Security
summary
Cloud and on‑prem systems share one kernel so a single vulnerability can hit every container; one reported machine shows 2,258 days uptime that must be modernized. The infrastructure response centers on live patching — applied here as more than 2,000 lines across 50 files in real time for L1TF — plus Ksplice, seccomp and SELinux, and moving risky workloads into Cata containers that use hardware virtualization to limit cross‑tenant side channels.
AI-written summary · about
chapters (6)
- 0:00Start
- 1:01get good security policies put in place
- 3:40sharing processor resources with potentially antagonistic workloads
- 4:03defend against cross contamination with other containers
- 5:27think about live patching solutions for your production workloads
- 9:48insist on a regular maintenance cycle and applications that are designed with patching in mind
related talks
37mPlatform and Security Engineering
41mIdentifying and Mitigating Cloud and Container Threats
30mThe **** we've seen
17mSustaining Yesterday’s Linux: Delivering Security for Today’s Workloads- 41mIdentifying and Mitigating Cloud and Container Threats
50mAvoiding cloud security anti-patterns the right way
29mGet the Freaking Basics Right!
59mMadness of Vulnerability Management in Modern Cloud, Container, How to Win the Battle...