Atomic CLI scan

•

1 like•4,213 views

Lalatendu Mohanty

Introduction to OpenSCAP project and atomic CLI from Project Atomic to scan Linux containers and images for CVEs.

$whoami
● Lalatendu Mohanty
● Twitter: @lalatenduM
● lalatendu.org

System security (Software)
● Software vulnerabilities
● Configuration flaws

Configuration flaws
● Not following security policies
○ Example: Weak password settings
● Not using correct access control

Software vulnerabilities
● Undiscovered vulnerabilities
● Known vulnerabilities
○ Common Vulnerabilities and Exposures (CVE®)

Common Vulnerabilities and Exposures (CVE®)
● Publicly known cybersecurity vulnerabilities
● Example:
○ Heartbleed : CVE-2014-0160
■ OpenSSL
○ Shellshock: CVE-2014-6271
■ GNU Bash

atomic scan
● Scan a container or container
image for CVEs.
● Can scan all images or
containers at once.
● Plugin architecture for scan
tool.
From atomic CLI

How does this work?
● Detect the operating system
● Get the appropriate CVE feed from vendor
● Check the image or container with OpenSCAP
● Parse the results

CVE®
● CVE List is maintained The MITRE Corporation (not for profit)
● Sponsored by United States Computer Emergency Readiness Team.
● National Vulnerability Database (NVD):
○ Superset of CVE list.
○ Contains additional analysis, database and fine-grained search engine
○ Maintained by US National Institute of Standards and Technology (NIST)
○ Data represented using Security Content Automation Protocol (SCAP)

Heartbleed CVE page
● https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-0160

Heartbleed CVE in NVD
● https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0160

SCAP
● SCAP is a line of compliance standards managed by NIST.
● Provide a standardized approach to security e.g.
○ Automatically verifying the presence of patches
○ Checking system security configuration settings
○ Examining systems for signs of compromise

OpenSCAP
● Create a framework of libraries to improve the accessibility of SCAP and
enhance the usability of the information it represents.
● Awarded the SCAP 1.2 certification by NIST in 2014.

Demo SCAP Workbench
On Fedora 23
● $ sudo dnf install scap-security-guide
● $ sudo dnf install scap-workbench

References:
● http://developers.redhat.com/blog/2016/05/02/introducing-atomic-scan-
container-vulnerability-detection/
● https://access.redhat.com/documentation/en-
US/Red_Hat_Network_Satellite/5.5/html/User_Guide/chap-
Red_Hat_Network_Satellite-User_Guide-OpenSCAP.html
● https://cve.mitre.org/about/
● https://www.youtube.com/watch?v=DxMd0T9_apo

Questions?
Collaborate : https://github.com/projectatomic/atomic

Docker Engine 1.12 can be rightly called ” A Next Generation Docker Clustering & Distributed System”. Though Docker Engine 1.12 Final Release is around corner but the recent RC3 brings lots of improvements and exciting features. One of the major highlight of this release is Docker Swarm Mode which provides powerful yet optional ability to create coordinated groups of decentralized Docker Engines. Swarm Mode combines your engine in swarms of any scale. It’s self-organizing and self-healing. It enables infrastructure-agnostic topology.The newer version democratizes orchestration with out-of-box capabilities for multi-container on multi-host app deployments.

The journey to container adoption in enterprise

Igor Moochnick

Presented by Udo Seidel, Chief Architect and Digital Evangelist, Amadeus In the recent past there were quite some discussions about security in the context of introducing or using Docker. It is true that there are some gaps to be closed but the whole story does not start from square one either. At Amadeus we are using Docker to build our future-oriented services and to introduce devops culture. Due to the nature of our business we have to deal with Security certifications like PCI-DSS, SSAE 16 and ISO 27001. This talks described the challenges we were facing in that context and how we mastered them. The story has technical and non-technical aspects.

Docker serverless v1.0

Thomas Chacko

DockerCon EU 2015: Persistent, stateful services with docker cluster, namespa...

Docker, Inc.

Presentation by Michael Neale, co-founder, CloudBees In this presentation I will show how you can use and abuse namespaces to do things that you might not think were possible in docker. In doing this I will show how you can create a volume bind mount in a running container, and use "super privileged" containers to control other containers on the same machine. There are many uses for this, but at it also demystifies what some of the namespaces in linux are, and how they work (hint: everything is files, its unix!).

Continuous delivery workflow with Docker

Igor Moochnick

Beginning mesos

Aditya Patawari

Securing the Container Pipeline at Salesforce by Cem Gurkok

Docker, Inc.

Customer trust and security is paramount for Salesforce. While containerization is great for DevOps due to flexibility, speed, isolation, transient existence, ease of management and patching, it becomes a challenging environment when the sensitivity level of the data traversing the environment increases. Monitoring systems, applications and network; performing disk, memory and network forensics in case of an incident; and vulnerability detection can easily become daunting tasks in such a volatile environment. In this presentation we would like to discuss the infrastructure we have built to address these issues and to secure our Docker container platform while we rapidly containerize Salesforce. Our solutions focus on securing the container pipeline, building security into the architecture, monitoring, Docker forensics (disk, memory, network), and automation. We also would like to demonstrate some of our live memory analysis capabilities we leverage to assure container and application integrity during execution.

Docker - introduction

Michał Kurzeja

Troubleshooting Tips from a Docker Support Engineer

Jeff Anderson

Container Orchestration from Theory to Practice

Docker, Inc.

Join Laura Frank and Stephen Day as they explain and examine technical concepts behind container orchestration systems, like distributed consensus, object models, and node topology. These concepts build the foundation of every modern orchestration system, and each technical explanation will be illustrated using Docker’s SwarmKit as a real-world example. Gain a deeper understanding of how orchestration systems like SwarmKit work in practice and walk away with more insights into your production applications.

Docker 1.11 Meetup: Containerd and runc, by Arnaud Porterie and Michael Crosby

Michelle Antebi

Docker Security and Content Trust

ehazlett

Docker Introduction + what is new in 0.9 Jérôme Petazzoni

virtualization-vs-containerization-paas

rajdeep

Monitoring docker container and dockerized applications

Ananth Padmanabhan

Shipping python project by dockerWei-Ting Kuo

Docker SF Meetup January 2016

Patrick Chanezon

What's New in Docker 1.12 (June 20, 2016) by Mike Goelzer & Andrea Luzzardi

Mike Goelzer

Sysdig - Introducing a new definition of Monitoring

Ramit Surana

Windows Server and Docker - The Internals Behind Bringing Docker and Containe...

Docker, Inc.

Docker leverages capabilities in Linux like namespaces and cgroups to enable containers and then builds tooling on top to enable users to build distributed apps. A common question is "What about Docker support for Windows?" In this session the Windows engineering leads will dive deep into the primitives within Windows to enable an awesome Docker experience on Windows. This session will also include a live demo of Docker and Windows Server.

Monetising Your Skill

'Detola Amure

Open Source Tools for Container Security and Compliance @Docker LA Meetup 2/13

Zach Hill

What's hot

Docker and the Linux Kernel

Docker, Inc.

DockerCon EU 2015: Docker and PCI-DSS - Lessons learned in a security sensiti...

Docker, Inc.

Docker serverless v1.0

Thomas Chacko

DockerCon EU 2015: Persistent, stateful services with docker cluster, namespa...

Docker, Inc.

Continuous delivery workflow with Docker

Igor Moochnick

Beginning mesos

Aditya Patawari

Securing the Container Pipeline at Salesforce by Cem Gurkok

Docker, Inc.

Docker - introduction

Michał Kurzeja

Troubleshooting Tips from a Docker Support Engineer

Jeff Anderson

Container Orchestration from Theory to Practice

Docker, Inc.

Docker 1.11 Meetup: Containerd and runc, by Arnaud Porterie and Michael Crosby

Michelle Antebi

Docker Security and Content Trust

ehazlett

Docker Introduction + what is new in 0.9 Jérôme Petazzoni

virtualization-vs-containerization-paas

rajdeep

Monitoring docker container and dockerized applications

Ananth Padmanabhan

Shipping python project by dockerWei-Ting Kuo

Docker SF Meetup January 2016

Patrick Chanezon

What's New in Docker 1.12 (June 20, 2016) by Mike Goelzer & Andrea Luzzardi

Mike Goelzer

Sysdig - Introducing a new definition of Monitoring

Ramit Surana

Windows Server and Docker - The Internals Behind Bringing Docker and Containe...

Docker, Inc.

What's hot (20)

Docker and the Linux Kernel

DockerCon EU 2015: Docker and PCI-DSS - Lessons learned in a security sensiti...

Docker serverless v1.0

DockerCon EU 2015: Persistent, stateful services with docker cluster, namespa...

Continuous delivery workflow with Docker

Beginning mesos

Securing the Container Pipeline at Salesforce by Cem Gurkok

Docker - introduction

Troubleshooting Tips from a Docker Support Engineer

Container Orchestration from Theory to Practice

Docker 1.11 Meetup: Containerd and runc, by Arnaud Porterie and Michael Crosby

Docker Security and Content Trust

Docker Introduction + what is new in 0.9

virtualization-vs-containerization-paas

Monitoring docker container and dockerized applications

Shipping python project by docker

Docker SF Meetup January 2016

What's New in Docker 1.12 (June 20, 2016) by Mike Goelzer & Andrea Luzzardi

Sysdig - Introducing a new definition of Monitoring

Windows Server and Docker - The Internals Behind Bringing Docker and Containe...

Viewers also liked

Monetising Your Skill

'Detola Amure

Open Source Tools for Container Security and Compliance @Docker LA Meetup 2/13

Zach Hill

Practical Approaches to Container Security

Shea Stewart

Docker London: Container Security

Phil Estes

A talk given at Docker London on Wednesday, July 20th, 2016. This talk is a fast-paced overview of the potential threats faced when containerizing applications, married to a quick run-through of the "security toolbox" available in the Docker engine via Linux kernel capabilities and features enabled by OCI's libcontainer/runc and Docker. A video recording of this talk is available here: https://skillsmatter.com/skillscasts/8551-container-security

Understanding container security

John Kinsella

Docker Security: Are Your Containers Tightly Secured to the Ship?

Michael Boelen

Docker is hot, Docker security is not? In this talk the risks, benefits and defenses of Docker are discussed. They are followed up by some best practices, which can you use in your daily activities. What is clear is that there is still a lot to do to get your containers secured. Event: Docker Amsterdam Meetup - January 2015 This presentation was given by Michael Boelen, January 23rd at Schuberg Philis. The event was organized by Mark Robert Coleman with help of Harm Boertien. With a full house of people, Docker security was discussed. About the author: Michael Boelen is founder of CISOfy and researches Linux security to build tools and documentation, to simplify it for others. Examples are tools like Rootkit Hunter and Lynis, blog posts and presentations.

Docker Security workshop slides

Docker, Inc.

Get hands-on with security features and best practices to protect your containerized services. Learn to push and verify signed images with Docker Content Trust, and collaborate with delegation roles. Intermediate to advanced level Docker experience recommended, participants will be building and pushing with Docker during the workshop. Led By Docker Security Experts: Riyaz Faizullabhoy David Lawrence Viktor Stanchev Experience Level: Intermediate to advanced level Docker experience recommended

ContainerDays NYC 2016: "The Secure Introduction Problem: Getting Secrets Int...

DynamicInfraDays

How GitLab and HackerOne help organizations innovate faster without compromis...

HackerOne

Why You Need to Rethink Container Security

FlawCheck

Introduction to Infrastructure as Code & Automation / Introduction to Chef

Nathen Harvey

Your customers expect you to continuously deliver delightful experiences. This means that you’ll need to continuously deliver application and infrastructure updates. Hand-crafted servers lovingly built and maintained by a system administrator are a thing of the past. Golden images are fine for initial provisioning but will quickly fail as your configuration requirements change over time. It’s time for you to fully automate the provisioning and management of your infrastructure components. Welcome to the world of infrastructure as code! In this new world, you’ll be able to programmatically provision and configure the components of your infrastructure. Disposable infrastructure whose provisioning, configuration, and on-going maintenance is fully automated allow you to change the way you build and deliver applications. Move your applications and infrastructure towards continuous delivery. In this talk, we’ll explore the ideas behind “infrastructure as code” and, specifically, look at how Chef allows you to fully automate your infrastructure. If you’re brave enough, we’ll even let you get your hands on some Chef and experience the delight of using Chef to build and deploy some infrastructure components.

Veer's Container Security

Jim Barlow

Security best practices for kubernetes deployment

Michael Cherny

AWS Security Best Practices and Design Patterns

Amazon Web Services

AWS Security Architecture - Overview

Sai Kesavamatham

Monitoring, Logging and Tracing on Kubernetes

Martin Etmajer

London HUG 19/5 - Kubernetes and vault

London HashiCorp User Group

Docker Security - Secure Container Deployment on Linux

Michael Boelen

How to securely deploy your containers, by the author of rkhunter and auditing tool Lynis. Many introductory talks about Docker and its container technology, have been given. This attention to the subject is not surprising, seeing the amount of people "doing DevOps" now. With container technology being fairly new on the Linux platform, the security aspects of containers are often being overlooked. While Linux containers do still not fully contain from a security point of view, we can definitely improve the security level of them. In this talk, we have a look at the underlying Linux security measures, followed by the features Docker itself has to offer. The goal is to get an understanding how we can deploy containers in a secure way. After all, Docker is no longer just a toy, and our precious data is involved.

Container Orchestration Wars

Karl Isenberg

Video: https://youtu.be/C_u4_l84ED8 Karl Isenberg reviews the history of distributed computing, clarifies terminology for layers in the container stack, and does a head to head comparison of several tools in the space, including Kubernetes, Marathon, and Docker Swarm. Learn which features and qualities are critical for container orchestration and how you can apply this knowledge when evaluating platforms.

Docker Security Overview

Sreenivas Makam

Viewers also liked (20)

Monetising Your Skill

Open Source Tools for Container Security and Compliance @Docker LA Meetup 2/13

Practical Approaches to Container Security

Docker London: Container Security

Understanding container security

Docker Security: Are Your Containers Tightly Secured to the Ship?

Docker Security workshop slides

ContainerDays NYC 2016: "The Secure Introduction Problem: Getting Secrets Int...

How GitLab and HackerOne help organizations innovate faster without compromis...

Why You Need to Rethink Container Security

Introduction to Infrastructure as Code & Automation / Introduction to Chef

Veer's Container Security

Security best practices for kubernetes deployment

AWS Security Best Practices and Design Patterns

AWS Security Architecture - Overview

Monitoring, Logging and Tracing on Kubernetes

London HUG 19/5 - Kubernetes and vault

Docker Security - Secure Container Deployment on Linux

Container Orchestration Wars

Docker Security Overview

Similar to Atomic CLI scan

Ever Present Persistence - Established Footholds Seen in the Wild

CTruncer

AV Evasion with the Veil Framework

VeilFramework

"Automated Malware Analysis" de Gabriel Negreira Barbosa, Malware Research an...

SegInfo

The Future of Security and Productivity in Our Newly Remote World

DevOps.com

Andy has made mistakes. He's seen even more. And in this talk he details the best and the worst of the container and Kubernetes security problems he's experienced, exploited, and remediated. This talk details low level exploitable issues with container and Kubernetes deployments. We focus on lessons learned, and show attendees how to ensure that they do not fall victim to avoidable attacks. See how to bypass security controls and exploit insecure defaults in this technical appraisal of the container and cluster security landscape.

Higher Level Malware

CTruncer

IoT Malware: Comprehensive Survey, Analysis Framework and Case Studies

Priyanka Aash

Computer malware in all its forms is nearly as old as the first PCs running commodity OSes, dating back at least 30 years. However, the number and the variety of "computing devices" dramatically increased during the last several years. Therefore, the focus of malware authors and operators slowly but steadily started shifting or expanding towards Internet of Things (IoT) malware. Unfortunately, at present there is no publicly available comprehensive study and methodology that collects, analyses, measures, and presents the (meta-)data related to IoT malware in a systematic and a holistic manner. In most cases, if not all, the resources on the topic are available as blog posts, sparse technical reports, or Systematization of Knowledge (SoK) papers deeply focused on a particular IoT malware strain (e.g., Mirai). Some other times those resources are already unavailable, or can become unavailable or restricted at any time. Moreover, many of such resources contain errors (e.g., wrong CVEs), omissions (e.g., hashes), limited perspectives (e.g., network behaviour only), or otherwise present incomplete or inaccurate analysis. Hence, all these factors leave unattended the main challenges of analysing, tracking, detecting, and defending against IoT malware in a systematic, effective and efficient way. This work attempts to bridge this gap. We start with mostly manual collection, archival, meta-information extraction and cross-validation of more than 637 unique resources related to IoT malware families. These resources relate to 60 1 IoT malware families, and include 260 resources related to 48 unique vulnerabilities used in the disclosed or detected IoT malware attacks. We then use the extracted information to establish as accurately as possible the timeline of events related to each IoT malware family and relevant vulnerabilities, and to outline important insights and statistics. For example, our analysis shows that the mean and median CVSS scores of all analyzed vulnerabilities employed by the IoT malware families are quite modest yet: 6.9 and 7.1 for CVSSv2, and 7.5 and 7.5 for CVSSv3 respectively. Moreover, the public knowledge to defend against or prevent those vulnerabilities could have been used, on average, at least 90 days before the first malware samples were submitted for analysis. Finally, to help validate our work as well as to motivate its continuous growth and improvement by the research community, we open-source our datasets and release our IoT malware analysis framework and our IoT malware analysis framework.

IoT Malware: Comprehensive Survey, Analysis Framework and Case Studies

DefCamp

DevSecOps: essential tooling to enable continuous security 2019-09-16

Rich Mills

The State of the Veil Framework

VeilFramework

Introduzione a junit + integrazione con archibus

Davide Fella

Embacing service-level-objectives of your microservices in your Cl/CD

Nebulaworks

Shifting left - How to use Continuous Integration tools to bring security into the DevOps world In today's modern software factories, organizations are shifting security to the left. No longer just the purview of firewalls, security needs to be built in during development and deployment processes. By doing so, organizations can ensure they are limiting vulnerabilities getting into production while cutting costs of both downtime and code rework. Key Takeaways: ○ How to ensure that the use of open source doesn’t introduce vulnerabilities and other security risks ○ How to automate the delivery of trusted images using a policy-driven approach ○ Empowering developers to secure their applications, while maintaining segregation of duties ○ Ensuring the consistent flow of images through the pipeline, with no side-doors or introduction of unvetted images ○ Enforcing immutability of containers, preventing container-image drift

Web Application Security: Introduction to common classes of security flaws an...

Thoughtworks

Tw noche geek quito webappsecThoughtworks

OWASP AppSec EU - SecDevOps, a view from the trenches - Abhay Bhargav

Abhay Bhargav

s its biggest bottleneck and security is becoming the most pervasive bottleneck in most DevOps practices. Teams are unable to come up with security practices that integrate into the DevOps lifecycle and ensure continuous and smooth delivery of applications to customers. In fact, security failures in DevOps amplify security flaws in production as they are delivered at scale. If DevOps should not be at odds with security, then we must find ways to achieve the following on priority: - Integrate effective threat modeling into Agile development practices - Introduce Security Automation into Continuous Integration - Integrate Security Automation into Continuous Deployment While there are other elements like SAST and Monitoring that are important to SecDevOps, my talk will essentially focus on these three elements with a higher level of focus on Security Automation. In my talk, I will explore the following, with reference to the topic: - The talk will be replete with anecdotes from personal consulting and penetration testing experiences. - I will briefly discuss Threat Modeling and its impact on DevOps. I will use examples to demonstrate practical ways that one can use threat modeling effectively to break down obstacles and create security automation that reduces the security bottleneck in the later stages of the DevOps cycle. - I firmly believe that Automated Web Vulnerability Assessment (using scanners) no matter how tuned, can only produce 30-40% of the actual results as opposed to a manual application penetration test. I find that scanning tools fail to identify most vulnerabilities with modern Web Services (REST. I will discuss examples and demonstrate how one can leverage automated vulnerability scanners (like ZAP, through its Python API) and simulate manual testing using a custom security automation suite. In Application Penetration Testing, its impossible to have a one size-fits all, but there’s no reason why we can’t deliver custom security automation to simulate most of the manual penetration testing to combine them into a custom security automation suite that integrates with CI tools like Jenkins and Travis. I intend to demonstrate the use a custom security test suite (written in Python that integrates with Jenkins), against an intentionally vulnerable e-commerce app. - My talk will also detail automation to identify vulnerabilities in software libraries and components, integrated with CI tools. - Finally, I will (with the use of examples and demos) explain how one can use “Infrastructure as Code” practice to perform pre and post deployment security checks, using tools like Chef, Puppet and Ansible.

OpenCV (Open source computer vision)

Chetan Allapur

BlueHat v18 || Return of the kernel rootkit malware (on windows 10)

BlueHat Security Conference

Matt Oh, Microsoft We are seeing new technique used everyday by malware. But, it is very hard to find any impressive techniques used in the wild. Recently there was huge buzz about Detrahere malware which used internally known issues with certificate signing in Windows 10 kernel driver. Even though the certificate check bypass technique itself is very interesting, also I found that the tactics used by the malware is more impressive. Even though the malware is mainly focused on Ad-hijacking functionality through Netfilter driver installation, but it also has rootkit ability through file system driver hooking. This feels like old days coming back with various new arsenals. The rootkit detects kernel debugging settings and will destroy the system when it finds one. The unpacking process can be very challenging job, too as it uses kernel driver image hollowing technique (something similar to process hollowing) to deobfuscate itself and run unpacked code. Our patchguard doesn't seem like triggering on this action, because all the sections are pre-allocated with execute permission already. Through this talk, I want to present various techniques used by this malware focusing on the kernel level obfuscation and anti-analysis tactics. This will give us new insights on how new Windows rootkit malware might look like in the future and how detecting them from security systems and detonation systems can be a challenge.

DeViL - Detect Virtual Machine in Linux by Sreelakshmi

Cysinfo Cyber Security Community

Antifragility and testing for distributed systems failure

DiUS

Failure is inevitable. In our modern world filled with continuously delivered and increasingly complex distributed architectures (looking at you micro-services), it is important to be able to test and improve our systems under a range of failure conditions. In this talk, Matt discusses these complexities and the forces they exert on development teams, presenting some simple strategies and practical advice to deal with them.

Security Bootcamp 2013 - Difficulties of malware analysis - Nguyễn Chấn ViệtSecurity Bootcamp

LinuxCon 2011: OpenVZ and Linux Kernel Testing

Andrey Vagin

Similar to Atomic CLI scan (20)

Ever Present Persistence - Established Footholds Seen in the Wild

AV Evasion with the Veil Framework

"Automated Malware Analysis" de Gabriel Negreira Barbosa, Malware Research an...

The Future of Security and Productivity in Our Newly Remote World

Higher Level Malware

IoT Malware: Comprehensive Survey, Analysis Framework and Case Studies

DevSecOps: essential tooling to enable continuous security 2019-09-16

The State of the Veil Framework

Introduzione a junit + integrazione con archibus

Embacing service-level-objectives of your microservices in your Cl/CD

Web Application Security: Introduction to common classes of security flaws an...

Tw noche geek quito webappsec

OWASP AppSec EU - SecDevOps, a view from the trenches - Abhay Bhargav

OpenCV (Open source computer vision)

BlueHat v18 || Return of the kernel rootkit malware (on windows 10)

DeViL - Detect Virtual Machine in Linux by Sreelakshmi

Antifragility and testing for distributed systems failure

Security Bootcamp 2013 - Difficulties of malware analysis - Nguyễn Chấn Việt

LinuxCon 2011: OpenVZ and Linux Kernel Testing

Recently uploaded

FIDO Alliance Osaka Seminar: Passkeys and the Road Ahead.pdf

FIDO Alliance

Accelerate your Kubernetes clusters with Varnish Caching

Thijs Feryn

Elevating Tactical DDD Patterns Through Object Calisthenics

Dorra BARTAGUIZ

After immersing yourself in the blue book and its red counterpart, attending DDD-focused conferences, and applying tactical patterns, you're left with a crucial question: How do I ensure my design is effective? Tactical patterns within Domain-Driven Design (DDD) serve as guiding principles for creating clear and manageable domain models. However, achieving success with these patterns requires additional guidance. Interestingly, we've observed that a set of constraints initially designed for training purposes remarkably aligns with effective pattern implementation, offering a more ‘mechanical’ approach. Let's explore together how Object Calisthenics can elevate the design of your tactical DDD patterns, offering concrete help for those venturing into DDD for the first time!

How world-class product teams are winning in the AI era by CEO and Founder, P...

Product School

Generating a custom Ruby SDK for your web service or Rails API using Smithy

g2nightmarescribd

Have you ever wanted a Ruby client API to communicate with your web service? Smithy is a protocol-agnostic language for defining services and SDKs. Smithy Ruby is an implementation of Smithy that generates a Ruby SDK using a Smithy model. In this talk, we will explore Smithy and Smithy Ruby to learn how to generate custom feature-rich SDKs that can communicate with any web service, such as a Rails JSON API.

Dev Dives: Train smarter, not harder – active learning and UiPath LLMs for do...

UiPathCommunity

💥 Speed, accuracy, and scaling – discover the superpowers of GenAI in action with UiPath Document Understanding and Communications Mining™: See how to accelerate model training and optimize model performance with active learning Learn about the latest enhancements to out-of-the-box document processing – with little to no training required Get an exclusive demo of the new family of UiPath LLMs – GenAI models specialized for processing different types of documents and messages This is a hands-on session specifically designed for automation developers and AI enthusiasts seeking to enhance their knowledge in leveraging the latest intelligent document processing capabilities offered by UiPath. Speakers: 👨‍🏫 Andras Palfi, Senior Product Manager, UiPath 👩‍🏫 Lenka Dulovicova, Product Program Manager, UiPath

Leading Change strategies and insights for effective change management pdf 1.pdf

OnBoard

Encryption in Microsoft 365 - ExpertsLive Netherlands 2024

Albert Hoitingh

UiPath Test Automation using UiPath Test Suite series, part 3

DianaGray10

Kubernetes & AI - Beauty and the Beast !?! @KCD Istanbul 2024

Tobias Schneck

As AI technology is pushing into IT I was wondering myself, as an “infrastructure container kubernetes guy”, how get this fancy AI technology get managed from an infrastructure operational view? Is it possible to apply our lovely cloud native principals as well? What benefit’s both technologies could bring to each other? Let me take this questions and provide you a short journey through existing deployment models and use cases for AI software. On practical examples, we discuss what cloud/on-premise strategy we may need for applying it to our own infrastructure to get it to work from an enterprise perspective. I want to give an overview about infrastructure requirements and technologies, what could be beneficial or limiting your AI use cases in an enterprise environment. An interactive Demo will give you some insides, what approaches I got already working for real.

Slack (or Teams) Automation for Bonterra Impact Management (fka Social Soluti...

Jeffrey Haguewood

Sidekick Solutions uses Bonterra Impact Management (fka Social Solutions Apricot) and automation solutions to integrate data for business workflows. We believe integration and automation are essential to user experience and the promise of efficient work through technology. Automation is the critical ingredient to realizing that full vision. We develop integration products and services for Bonterra Case Management software to support the deployment of automations for a variety of use cases. This video focuses on the notifications, alerts, and approval requests using Slack for Bonterra Impact Management. The solutions covered in this webinar can also be deployed for Microsoft Teams. Interested in deploying notification automations for Bonterra Impact Management? Contact us at sales@sidekicksolutionsllc.com to discuss next steps.

Empowering NextGen Mobility via Large Action Model Infrastructure (LAMI): pav...

Thierry Lestable

Builder.ai Founder Sachin Dev Duggal's Strategic Approach to Create an Innova...

Ramesh Iyer

In today's fast-changing business world, Companies that adapt and embrace new ideas often need help to keep up with the competition. However, fostering a culture of innovation takes much work. It takes vision, leadership and willingness to take risks in the right proportion. Sachin Dev Duggal, co-founder of Builder.ai, has perfected the art of this balance, creating a company culture where creativity and growth are nurtured at each stage.

Securing your Kubernetes cluster_ a step-by-step guide to success !

KatiaHIMEUR1

Today, after several years of existence, an extremely active community and an ultra-dynamic ecosystem, Kubernetes has established itself as the de facto standard in container orchestration. Thanks to a wide range of managed services, it has never been so easy to set up a ready-to-use Kubernetes cluster. However, this ease of use means that the subject of security in Kubernetes is often left for later, or even neglected. This exposes companies to significant risks. In this talk, I'll show you step-by-step how to secure your Kubernetes cluster for greater peace of mind and reliability.

When stars align: studies in data quality, knowledge graphs, and machine lear...

Elena Simperl

AI for Every Business: Unlocking Your Product's Universal Potential by VP of ...

Product School

GenAISummit 2024 May 28 Sri Ambati Keynote: AGI Belongs to The Community in O...

Sri Ambati

De-mystifying Zero to One: Design Informed Techniques for Greenfield Innovati...

Product School

State of ICS and IoT Cyber Threat Landscape Report 2024 preview

Prayukth K V

The IoT and OT threat landscape report has been prepared by the Threat Research Team at Sectrio using data from Sectrio, cyber threat intelligence farming facilities spread across over 85 cities around the world. In addition, Sectrio also runs AI-based advanced threat and payload engagement facilities that serve as sinks to attract and engage sophisticated threat actors, and newer malware including new variants and latent threats that are at an earlier stage of development. The latest edition of the OT/ICS and IoT security Threat Landscape Report 2024 also covers: State of global ICS asset and network exposure Sectoral targets and attacks as well as the cost of ransom Global APT activity, AI usage, actor and tactic profiles, and implications Rise in volumes of AI-powered cyberattacks Major cyber events in 2024 Malware and malicious payload trends Cyberattack types and targets Vulnerability exploit attempts on CVEs Attacks on counties – USA Expansion of bot farms – how, where, and why In-depth analysis of the cyber threat landscape across North America, South America, Europe, APAC, and the Middle East Why are attacks on smart factories rising? Cyber risk predictions Axis of attacks – Europe Systemic attacks in the Middle East Download the full report from here: https://sectrio.com/resources/ot-threat-landscape-reports/sectrio-releases-ot-ics-and-iot-security-threat-landscape-report-2024/

The Future of Platform Engineering

Jemma Hussein Allen

Recently uploaded (20)