Why monitoring is an analytics problem
•
1 like•258 views
SignalFx uses an analytics approach to monitoring microservices. They instrument each microservice to collect metrics and log exceptions. All data is sent to an analytics service for analysis and detection of issues. For example, when a code push caused unexpected timeouts in an upstream service, SignalFx was able to quickly identify the outlier service through exception analysis, narrow down the problem to a specific exception, and find the root cause in just 15 minutes. Their analytics approach helps reduce mean time to resolution compared to traditional monitoring.
Report
Share
Report
Share
Download to read offline
Recommended
Tune your App Perf (and get fit for summer)
Sqreen is a security product that protects apps from attacks. During beta testing, some customers raised concerns about average response time, CPU usage, memory usage, and bandwidth when using Sqreen. The document discusses various techniques Sqreen uses to optimize performance, including asynchronous processing, reducing I/O, minimizing use of the ExecJS JavaScript engine, and setting up feedback loops to continuously monitor and improve performance.
Application Security from the Inside - OWASP
Presentation at the OWASP (Open Web Application Security Project) on how to make apps secure by protecting them from the inside.
Detecting and protecting from
1. SQL injection
2. Cross Site Scripting (XSS)
3. Third party components vulnerabilities
4. Shell injection
etc.
Operationalizing Docker at Scale: Lessons from Running Microservices in Produ...
Zenefits principal engineer Venkat Thiruvengadam and SignalFx engineer Maxime Petazzoni discuss operationalizing Docker at scale. Learn about the transition to a well-conceived microservices approach, the tools chosen to support these services, and the lessons learned from monitoring containers in production in a high-performance environment.
Tips to Reduce the Attack Surface When Using Third-Party Libraries
The number of cyber breaches due to vulnerable components has increased in the last years. Attacks come fast, exploits are automated, and damages are high.
The most common cause is the incorrect implementation of external libraries. This makes it difficult to maintain them, increases the technical debt and the risk of being breached via vulnerable components.
This presentation contains the most common situations when third party libraries are used, discusses the attack surface introduced by these components and explores the best practices to reduce it.
Henrique Dantas - API fuzzing using Swagger
The document discusses API security testing using Swagger specifications. It notes that APIs are good targets for security testing due to their closeness to databases and ubiquity. The solution presented involves automating security testing of APIs by leveraging existing Swagger specifications in a Python library, which allows for extensive and extendible fuzzing of APIs while integrating results and providing reports. The library uses the popular Swagger and Sulley tools for fuzzing.
Security at Greenhouse
The document summarizes security practices at Greenhouse, a company that provides recruiting optimization software. It discusses Greenhouse's use of a bug bounty program, third-party security audits, and processes to instill a culture of security. Greenhouse stores sensitive user data and aims to demonstrate its security to customers through these measures. The document provides examples of security issues found through the bug bounty program and audit and recommends security practices for Rails applications.
HITCON Defense Summit 2019 － 從 SAST 談持續式資安測試
議程會從 DevSecOps 開始，介紹如何將靜態安全測試（SAST）左移，導入開發流程中。
開場簡介 DevSecOps，介紹如何在敏捷開發中導入資安。並且介紹在 CI/CD pipeline 中可以導入的資安項目。
接著會以 SAST 為例來探討。分享整合開源工具的方法，以及實踐自動化和調整工具的經驗，來達到持續性、並且自動化的資安測試。
* DevSecOps Overview
* Security in CI/CD pipeline
* Open source SAST tools integration
* Continuous Integration: SAST improvement and vulnerabilities triage
End-to-end Testing for IoT Integrity
This presentation, given at Embedded World 2016, discusses a multi-stage strategy for ensuring that all the elements of the solution stack work correctly and the IoT solutions you deliver will meet quality requirements.
Recommended
Tune your App Perf (and get fit for summer)
Sqreen is a security product that protects apps from attacks. During beta testing, some customers raised concerns about average response time, CPU usage, memory usage, and bandwidth when using Sqreen. The document discusses various techniques Sqreen uses to optimize performance, including asynchronous processing, reducing I/O, minimizing use of the ExecJS JavaScript engine, and setting up feedback loops to continuously monitor and improve performance.
Application Security from the Inside - OWASP
Presentation at the OWASP (Open Web Application Security Project) on how to make apps secure by protecting them from the inside.
Detecting and protecting from
1. SQL injection
2. Cross Site Scripting (XSS)
3. Third party components vulnerabilities
4. Shell injection
etc.
Operationalizing Docker at Scale: Lessons from Running Microservices in Produ...
Zenefits principal engineer Venkat Thiruvengadam and SignalFx engineer Maxime Petazzoni discuss operationalizing Docker at scale. Learn about the transition to a well-conceived microservices approach, the tools chosen to support these services, and the lessons learned from monitoring containers in production in a high-performance environment.
Tips to Reduce the Attack Surface When Using Third-Party Libraries
The number of cyber breaches due to vulnerable components has increased in the last years. Attacks come fast, exploits are automated, and damages are high.
The most common cause is the incorrect implementation of external libraries. This makes it difficult to maintain them, increases the technical debt and the risk of being breached via vulnerable components.
This presentation contains the most common situations when third party libraries are used, discusses the attack surface introduced by these components and explores the best practices to reduce it.
Henrique Dantas - API fuzzing using Swagger
The document discusses API security testing using Swagger specifications. It notes that APIs are good targets for security testing due to their closeness to databases and ubiquity. The solution presented involves automating security testing of APIs by leveraging existing Swagger specifications in a Python library, which allows for extensive and extendible fuzzing of APIs while integrating results and providing reports. The library uses the popular Swagger and Sulley tools for fuzzing.
Security at Greenhouse
The document summarizes security practices at Greenhouse, a company that provides recruiting optimization software. It discusses Greenhouse's use of a bug bounty program, third-party security audits, and processes to instill a culture of security. Greenhouse stores sensitive user data and aims to demonstrate its security to customers through these measures. The document provides examples of security issues found through the bug bounty program and audit and recommends security practices for Rails applications.
HITCON Defense Summit 2019 － 從 SAST 談持續式資安測試
議程會從 DevSecOps 開始，介紹如何將靜態安全測試（SAST）左移，導入開發流程中。
開場簡介 DevSecOps，介紹如何在敏捷開發中導入資安。並且介紹在 CI/CD pipeline 中可以導入的資安項目。
接著會以 SAST 為例來探討。分享整合開源工具的方法，以及實踐自動化和調整工具的經驗，來達到持續性、並且自動化的資安測試。
* DevSecOps Overview
* Security in CI/CD pipeline
* Open source SAST tools integration
* Continuous Integration: SAST improvement and vulnerabilities triage
End-to-end Testing for IoT Integrity
This presentation, given at Embedded World 2016, discusses a multi-stage strategy for ensuring that all the elements of the solution stack work correctly and the IoT solutions you deliver will meet quality requirements.
Modern Web 2019 從零開始加入自動化資安測試
CI/CD 是現在企業常用的開發流程，敏捷的開發速度自然需要自動化的流程幫助我們加速驗證和部署。但為了求快速，資安測試和檢查往往在開發流程中會被捨去。
議題會大致分成兩大部分：資安測試以及 DevSecOps。
這次議題內容會講解如何在現有的 DevOps 開發文化中，加上自動化的資安測試。會介紹像是靜態測試（SAST）和動態測試（DAST），以及要套用哪些標準來提升測試的價值。並且以自身經驗，跟大家分享要導入這些資安測試時，在 CI/CD 每個階段不同的需求和做法。
同時也會簡單介紹 DevSecOps，希望能將資安融入在快速、敏捷開發的文化中，讓產品可以不斷推進，產品也可以持續保持在足夠的安全性上。
José Vila - ¿Otro parche más? No, por favor. [rooted2018]
Sigue siendo una tendencia mayoritaria en el ámbito del desarrollo de software que el analizar la seguridad del producto se postergue a las últimas etapas del proceso. Uno de los motivos suele ser el impacto económico de contar con un ciclo seguro de desarrollo, pesa demasiado al inicio del proyecto y por tanto se descarta tener una metodología integrada durante todo el proceso.
Este planteamiento se está volviendo cada vez más en contra de los desarrolladores y demás actores implicados. Una vez lanzado el producto al mercado, acaban teniendo que invertir recursos inesperados por culpa de problemas de seguridad. Parches, hotfixes, actualizaciones… se convierten en la solución monótona que, lo que consigue es acabar dificultando la usabilidad del producto. Seguro que a todos se nos vienen nombres a la cabeza.
El propósito de esta presentación es el exponer la necesidad de integrar metodologías de seguridad desde las etapas más tempranas del ciclo de vida de sus productos, los beneficios de tener presente el desarrollo seguro de productos y mostrar buenas practicas que favorecen a la mejora de la seguridad de los productos, generando software de mayor calidad.
Y si esto ya te lo han contado en otra CON… ¿por qué no lo estás poniendo en práctica?
Stephen Sadowski - Securely automating infrastructure in the cloud
This document summarizes Stephen Sadowski's presentation on securely automating infrastructure in the cloud. It discusses the tools and processes they used, including Terraform for infrastructure as code, Chef for configuration management, GitLab for source control and access management, Jenkins for continuous integration/delivery, ELK for logging, Sensu for monitoring, and PagerDuty for alerting. It emphasizes treating infrastructure like code, minimum necessary access, and ensuring security is built into processes from the beginning through techniques like encryption, access control lists, and compliance testing.
Javier Hijas & Ori Kuyumgiski - Security at the speed of DevOps [rooted2018]
This document discusses the evolution of a startup's cloud infrastructure and security practices as it grew and was eventually acquired by Check Point. It describes the startup's initial infrastructure using AWS with limited security controls. It then outlines how the infrastructure expanded across regions and availability zones over time using tools like Puppet, ELK, and Docker. Kubernetes was later adopted for orchestration. Check Point products were integrated to provide access control, IPS, antivirus, and other security capabilities. The document emphasizes that devops practices can be used by large enterprises and that security must be integrated as architectures become more agile and automated.
Alfredo Reino - Monitoring aws and azure
This document provides an overview of monitoring Azure and AWS cloud environments. It discusses why monitoring is important for threat detection, hunting and response. It outlines what aspects should be monitored, including operating systems, applications, network traffic, and cloud service logs. Specific AWS and Azure monitoring options are described, such as CloudTrail, VPC Flow Logs, and Azure Audit Logs. Integrating cloud logs with SIEMs and threat intelligence feeds is also covered. Endpoint monitoring tools are suggested to record process, file, registry and network activity on virtual machines.
Owasp Code Crawler Presentation
The document introduces OWASP Code Crawler, an open source tool for automated security code reviews of .NET and Java source code. It was built using C# and runs on Windows and Mono. The tool performs fast scans of source code, supports multiple languages, and generates HTML and PDF reports. It includes features like an integrated OWASP browser, email functionality, and team management capabilities. The core of the application and its functionalities are coded in a modular way using XML files for configuration and data storage. Future plans include integrating more closely with the OWASP Orizon project and keeping the code review patterns database up-to-date.
Software Security in DevOps: Synthesizing Practitioners’ Perceptions and Prac...
In organizations that use DevOps practices, software changes can be deployed as fast as 500 times or more per day. Without adequate involvement of the security team, rapidly deployed software changes are more likely to contain vulnerabilities due to lack of adequate reviews. The goal of this paper is to aid software practitioners in integrating security and DevOps by summarizing experiences in utilizing security practices in a DevOps environment. We analyzed a selected set of Internet artifacts and surveyed representatives of nine organizations that are using DevOps to systematically explore experiences in utilizing security practices. We observe that the majority of the software practitioners have expressed the potential of common DevOps activities, such as automated monitoring, to improve the security of a system. Furthermore, organizations that integrate DevOps and security utilize additional security activities, such as security requirements analysis and performing security configurations. Additionally, these teams also have established collaboration between the security team and the development and operations teams.
ATAGTR2017 Cost-effective Security Testing Approaches for Web, Mobile & Enter...
ATAGTR2017 Cost-effective Security Testing Approaches for Web, Mobile & Enter...Agile Testing Alliance
The presentation on Cost-effective Security Testing Approaches for Web, Mobile & Enterprise Application was done during #ATAGTR2017, one of the largest global testing conference. All copyright belongs to the author.
Author and presenter : Varadarajan V. G.Making the Shift from DevOps to Practical DevSecOps | Sumo Logic Webinar
In this webinar, Sumo Logic VP of Security and Compliance George Gerchow dives into how to make the shift to DevSecOps, discussing how to:
- Incorporate fundamental and high impact security best practices into your current DevOps operations
- Gain visibility into your compliance posture
- Identify potential risks and threats in your environments
[OPD 2019] Governance as a missing part of IT security architecture
The document discusses how governance is a missing part of IT security architecture. It proposes that security architecture should include technology, processes, and organization/people, similar to how Gartner describes the components of overall IT architecture. It presents capabilities maturity models and the secure development lifecycle as ways to incorporate governance into the design, development, testing, and operations of technology to ensure security is considered throughout the IT process.
Veracode Automation CLI (using Jenkins for SDL integration)
Example of integrating Veracode in the CI pipeline using an Open Source CLI.
Jenkins is used to automate scan and artefact download (into GitHub)
Customer Presentation - KCP&L
William Aune is the lead security analyst at KCP&L, an electric utility company serving over 800,000 customers. He has over 12 years of experience in IT security. KCP&L implemented Splunk in 2014 to centralize log management and has continued finding value from the platform. They index around 80GB of data per day from various sources. Some examples of how Splunk has helped KCP&L include identifying a vendor issue from firewall and DoS appliance logs, gaining geographic context with GeoIP, and detecting potential network scanning. Going forward, KCP&L aims to index more logs and develop custom apps to provide tailored insights for different teams.
Ernesto Bethencourt & Javier Sanz - OFRECIENDO SEGURIDAD DE AUTOCONSUMO A LOS...
¿Cómo logras que un grupo de desarrolladores trabajando con tecnologías modernas y filosofía DevOps permitan incluir la seguridad en su día a día sin sentirse “interrumpidos” o frenados y adopten una cultura de “DevSecOps”? ¿Cómo se logra escalar la seguridad en un modelo DevOps sin multiplicar por 100 tu equipo de seguridad? ¿Cómo hacerlo de forma transparente y “auto-mágica” para los desarrolladores, y aprovechando las soluciones existentes tanto Open como comerciales?
En i4s (Grupo BBVA) estamos construyendo Chimera para cubrir estos retos tan ambiciosos, entregando una serie de servicios de auto-consumo que los desarrolladores incluyen en sus pipelines al mismo tiempo que las áreas de seguridad usan esa información para gobernar la seguridad de los desarrollos. Todo esto abstrayendo soluciones especializadas que podemos intercambiar, complementar o combinar para ofrecer los mejores resultados. Chimera está desarrollado haciendo uso de las mismas tecnologías y arquitecturas punteras que usan los desarrolladores a los que tratamos de proteger, garantizando que pueda escalar al mismo ritmo que el crecimiento de la nueva plataforma Ether que estamos construyendo junto con BBVA.
https://www.rootedcon.com/ponentes#275
Fences and Gates: Designing Ops for DevOps
This document summarizes a presentation about designing operations for DevOps. It discusses:
1. Herding applications together under common fences and guardrails rather than chasing individual problems, to reduce operational complexity.
2. The difference between "Big P" high-level organizational policies and "Little P" technical guardrails that can be enforced by machines. Big P policies should map to Little P guardrails.
3. Closing the loop between development, deployment and operations by continually refining guardrails to prevent issues, rather than just fixing problems reactively. This allows operations to evolve with applications rather than oppose changes.
Integrating DevOps and Security
This document discusses integrating DevOps and security by bringing development, operations, QA, and security teams together. It outlines where security currently stands, emphasizing the need to change from a "rugged" security model that acts as a bottleneck. The document proposes tactics to scale security through empathy, automation, and feedback loops. Specific tactics include integrating security into defect tracking, preventative controls, deployment pipelines, monitoring, and emphasizing that security says "we could do it this way" rather than only saying no. The overall goal is to improve security while making work easier.
Owasp top 10 2017 (en)
LEARN MORE FROM MY BLOG
LINK : https://hackersploit101.blogspot.com/2021/01/brief-about-injection.html
The Dev, Sec and Ops of API Security - API World
The enterprise use of APIs is growing exponentially. Companies face a difficult choice. They must shift towards a software-based, digital approach to service and product delivery – or get left behind. Agile development, business pressure and the complexity of API security have made security teams life very complicated. And to make matters more complicated, the adoption of microservices architectures has multiplied the number of API endpoints that you have to protect.
Downside: The more APIs, the higher the security risk!
API security flaws are injected at many different levels of the API lifecycle: in requirements, development, deployment and monitoring. It is proven that detecting and fixing vulnerabilities during production or post-release time is up to 30 times more difficult than earlier in the API lifecycle. Security should be easy to considered at requirements phase, applied during development by attaching pre-defined policies to APIs and ensuring that security tests are performed as part of the continuous delivery of the APIs.
Upside: We’ll prep you with all the knowledge and tools you need to implement an automated, end-to-end API Security process that will get your dev, sec and ops teams speaking the same language.
In this presentation you will learn:
Security risks at each stage of the API lifecycle, and how to mitigate them.
How to implement an end-to-end automated API security model that development, security and operations teams will love.
How to think positive! Why a positive security model works.
Beyond Continuous Delivery
Presentation from SysOps/DevOps Wrocław MeetUp #8 (28.03.2019). I was sharing my experience of introducing DevOps in projects of various size. We started with agile ways of working with architecture (evolutionary approaches, ADR), talked about introduction of continuous security practices (DevSecOps) and ended with the ways of final business release of our applications.
Aging in Place: Housing Washington 2014 Conference SLIDE DECK
"Aging In Place: 5 Things to Remember for AIP Success" - Here is our slide deck for the Housing Washington Regional Conference 2014, to be held Oct. 6 - 8th at the Tacoma Convention and Trade Center. We speak on October 8th at 9:50am
Empowering The Mature Mind - SUMMER 2014 Newsletter
This newsletter from Empowering The Mature Mind provides information on their consulting and design services for aging in place housing solutions. It highlights an upcoming speaking engagement and their featured project remodeling a home for accessibility and independence for a paraplegic client. It also promotes their book on aging in place design and lists upcoming courses on the topic they are presenting locally in the Seattle area.
Reaching & Connecting with the BOOMER CONSUMER - by EtMM Aaron D. Murphy
Reaching & Connecting with the BOOMER CONSUMER - by EtMM Aaron D. MurphyAaron D. Murphy, Architect / CAPS
The document discusses strategies for marketing to baby boomers. It begins by providing statistics showing the size and spending power of the boomer demographic. It then discusses understanding boomers and establishing trust by listening to their needs and desires. The document outlines four approaches to age branding: age-denial, age-adaptive, age-irrelevant, and age-affirmative. It also provides tips for marketing to boomers such as cultivating relationships, being accessible experts, using a "give and go" communication strategy, and community outreach. Females over 40 are highlighted as key decision makers.More Related Content
What's hot
Modern Web 2019 從零開始加入自動化資安測試
CI/CD 是現在企業常用的開發流程，敏捷的開發速度自然需要自動化的流程幫助我們加速驗證和部署。但為了求快速，資安測試和檢查往往在開發流程中會被捨去。
議題會大致分成兩大部分：資安測試以及 DevSecOps。
這次議題內容會講解如何在現有的 DevOps 開發文化中，加上自動化的資安測試。會介紹像是靜態測試（SAST）和動態測試（DAST），以及要套用哪些標準來提升測試的價值。並且以自身經驗，跟大家分享要導入這些資安測試時，在 CI/CD 每個階段不同的需求和做法。
同時也會簡單介紹 DevSecOps，希望能將資安融入在快速、敏捷開發的文化中，讓產品可以不斷推進，產品也可以持續保持在足夠的安全性上。
José Vila - ¿Otro parche más? No, por favor. [rooted2018]
Sigue siendo una tendencia mayoritaria en el ámbito del desarrollo de software que el analizar la seguridad del producto se postergue a las últimas etapas del proceso. Uno de los motivos suele ser el impacto económico de contar con un ciclo seguro de desarrollo, pesa demasiado al inicio del proyecto y por tanto se descarta tener una metodología integrada durante todo el proceso.
Este planteamiento se está volviendo cada vez más en contra de los desarrolladores y demás actores implicados. Una vez lanzado el producto al mercado, acaban teniendo que invertir recursos inesperados por culpa de problemas de seguridad. Parches, hotfixes, actualizaciones… se convierten en la solución monótona que, lo que consigue es acabar dificultando la usabilidad del producto. Seguro que a todos se nos vienen nombres a la cabeza.
El propósito de esta presentación es el exponer la necesidad de integrar metodologías de seguridad desde las etapas más tempranas del ciclo de vida de sus productos, los beneficios de tener presente el desarrollo seguro de productos y mostrar buenas practicas que favorecen a la mejora de la seguridad de los productos, generando software de mayor calidad.
Y si esto ya te lo han contado en otra CON… ¿por qué no lo estás poniendo en práctica?
Stephen Sadowski - Securely automating infrastructure in the cloud
This document summarizes Stephen Sadowski's presentation on securely automating infrastructure in the cloud. It discusses the tools and processes they used, including Terraform for infrastructure as code, Chef for configuration management, GitLab for source control and access management, Jenkins for continuous integration/delivery, ELK for logging, Sensu for monitoring, and PagerDuty for alerting. It emphasizes treating infrastructure like code, minimum necessary access, and ensuring security is built into processes from the beginning through techniques like encryption, access control lists, and compliance testing.
Javier Hijas & Ori Kuyumgiski - Security at the speed of DevOps [rooted2018]
This document discusses the evolution of a startup's cloud infrastructure and security practices as it grew and was eventually acquired by Check Point. It describes the startup's initial infrastructure using AWS with limited security controls. It then outlines how the infrastructure expanded across regions and availability zones over time using tools like Puppet, ELK, and Docker. Kubernetes was later adopted for orchestration. Check Point products were integrated to provide access control, IPS, antivirus, and other security capabilities. The document emphasizes that devops practices can be used by large enterprises and that security must be integrated as architectures become more agile and automated.
Alfredo Reino - Monitoring aws and azure
This document provides an overview of monitoring Azure and AWS cloud environments. It discusses why monitoring is important for threat detection, hunting and response. It outlines what aspects should be monitored, including operating systems, applications, network traffic, and cloud service logs. Specific AWS and Azure monitoring options are described, such as CloudTrail, VPC Flow Logs, and Azure Audit Logs. Integrating cloud logs with SIEMs and threat intelligence feeds is also covered. Endpoint monitoring tools are suggested to record process, file, registry and network activity on virtual machines.
Owasp Code Crawler Presentation
The document introduces OWASP Code Crawler, an open source tool for automated security code reviews of .NET and Java source code. It was built using C# and runs on Windows and Mono. The tool performs fast scans of source code, supports multiple languages, and generates HTML and PDF reports. It includes features like an integrated OWASP browser, email functionality, and team management capabilities. The core of the application and its functionalities are coded in a modular way using XML files for configuration and data storage. Future plans include integrating more closely with the OWASP Orizon project and keeping the code review patterns database up-to-date.
Software Security in DevOps: Synthesizing Practitioners’ Perceptions and Prac...
In organizations that use DevOps practices, software changes can be deployed as fast as 500 times or more per day. Without adequate involvement of the security team, rapidly deployed software changes are more likely to contain vulnerabilities due to lack of adequate reviews. The goal of this paper is to aid software practitioners in integrating security and DevOps by summarizing experiences in utilizing security practices in a DevOps environment. We analyzed a selected set of Internet artifacts and surveyed representatives of nine organizations that are using DevOps to systematically explore experiences in utilizing security practices. We observe that the majority of the software practitioners have expressed the potential of common DevOps activities, such as automated monitoring, to improve the security of a system. Furthermore, organizations that integrate DevOps and security utilize additional security activities, such as security requirements analysis and performing security configurations. Additionally, these teams also have established collaboration between the security team and the development and operations teams.
ATAGTR2017 Cost-effective Security Testing Approaches for Web, Mobile & Enter...
ATAGTR2017 Cost-effective Security Testing Approaches for Web, Mobile & Enter...Agile Testing Alliance
The presentation on Cost-effective Security Testing Approaches for Web, Mobile & Enterprise Application was done during #ATAGTR2017, one of the largest global testing conference. All copyright belongs to the author.
Author and presenter : Varadarajan V. G.Making the Shift from DevOps to Practical DevSecOps | Sumo Logic Webinar
In this webinar, Sumo Logic VP of Security and Compliance George Gerchow dives into how to make the shift to DevSecOps, discussing how to:
- Incorporate fundamental and high impact security best practices into your current DevOps operations
- Gain visibility into your compliance posture
- Identify potential risks and threats in your environments
[OPD 2019] Governance as a missing part of IT security architecture
The document discusses how governance is a missing part of IT security architecture. It proposes that security architecture should include technology, processes, and organization/people, similar to how Gartner describes the components of overall IT architecture. It presents capabilities maturity models and the secure development lifecycle as ways to incorporate governance into the design, development, testing, and operations of technology to ensure security is considered throughout the IT process.
Veracode Automation CLI (using Jenkins for SDL integration)
Example of integrating Veracode in the CI pipeline using an Open Source CLI.
Jenkins is used to automate scan and artefact download (into GitHub)
Customer Presentation - KCP&L
William Aune is the lead security analyst at KCP&L, an electric utility company serving over 800,000 customers. He has over 12 years of experience in IT security. KCP&L implemented Splunk in 2014 to centralize log management and has continued finding value from the platform. They index around 80GB of data per day from various sources. Some examples of how Splunk has helped KCP&L include identifying a vendor issue from firewall and DoS appliance logs, gaining geographic context with GeoIP, and detecting potential network scanning. Going forward, KCP&L aims to index more logs and develop custom apps to provide tailored insights for different teams.
Ernesto Bethencourt & Javier Sanz - OFRECIENDO SEGURIDAD DE AUTOCONSUMO A LOS...
¿Cómo logras que un grupo de desarrolladores trabajando con tecnologías modernas y filosofía DevOps permitan incluir la seguridad en su día a día sin sentirse “interrumpidos” o frenados y adopten una cultura de “DevSecOps”? ¿Cómo se logra escalar la seguridad en un modelo DevOps sin multiplicar por 100 tu equipo de seguridad? ¿Cómo hacerlo de forma transparente y “auto-mágica” para los desarrolladores, y aprovechando las soluciones existentes tanto Open como comerciales?
En i4s (Grupo BBVA) estamos construyendo Chimera para cubrir estos retos tan ambiciosos, entregando una serie de servicios de auto-consumo que los desarrolladores incluyen en sus pipelines al mismo tiempo que las áreas de seguridad usan esa información para gobernar la seguridad de los desarrollos. Todo esto abstrayendo soluciones especializadas que podemos intercambiar, complementar o combinar para ofrecer los mejores resultados. Chimera está desarrollado haciendo uso de las mismas tecnologías y arquitecturas punteras que usan los desarrolladores a los que tratamos de proteger, garantizando que pueda escalar al mismo ritmo que el crecimiento de la nueva plataforma Ether que estamos construyendo junto con BBVA.
https://www.rootedcon.com/ponentes#275
Fences and Gates: Designing Ops for DevOps
This document summarizes a presentation about designing operations for DevOps. It discusses:
1. Herding applications together under common fences and guardrails rather than chasing individual problems, to reduce operational complexity.
2. The difference between "Big P" high-level organizational policies and "Little P" technical guardrails that can be enforced by machines. Big P policies should map to Little P guardrails.
3. Closing the loop between development, deployment and operations by continually refining guardrails to prevent issues, rather than just fixing problems reactively. This allows operations to evolve with applications rather than oppose changes.
Integrating DevOps and Security
This document discusses integrating DevOps and security by bringing development, operations, QA, and security teams together. It outlines where security currently stands, emphasizing the need to change from a "rugged" security model that acts as a bottleneck. The document proposes tactics to scale security through empathy, automation, and feedback loops. Specific tactics include integrating security into defect tracking, preventative controls, deployment pipelines, monitoring, and emphasizing that security says "we could do it this way" rather than only saying no. The overall goal is to improve security while making work easier.
Owasp top 10 2017 (en)
LEARN MORE FROM MY BLOG
LINK : https://hackersploit101.blogspot.com/2021/01/brief-about-injection.html
The Dev, Sec and Ops of API Security - API World
The enterprise use of APIs is growing exponentially. Companies face a difficult choice. They must shift towards a software-based, digital approach to service and product delivery – or get left behind. Agile development, business pressure and the complexity of API security have made security teams life very complicated. And to make matters more complicated, the adoption of microservices architectures has multiplied the number of API endpoints that you have to protect.
Downside: The more APIs, the higher the security risk!
API security flaws are injected at many different levels of the API lifecycle: in requirements, development, deployment and monitoring. It is proven that detecting and fixing vulnerabilities during production or post-release time is up to 30 times more difficult than earlier in the API lifecycle. Security should be easy to considered at requirements phase, applied during development by attaching pre-defined policies to APIs and ensuring that security tests are performed as part of the continuous delivery of the APIs.
Upside: We’ll prep you with all the knowledge and tools you need to implement an automated, end-to-end API Security process that will get your dev, sec and ops teams speaking the same language.
In this presentation you will learn:
Security risks at each stage of the API lifecycle, and how to mitigate them.
How to implement an end-to-end automated API security model that development, security and operations teams will love.
How to think positive! Why a positive security model works.
Beyond Continuous Delivery
Presentation from SysOps/DevOps Wrocław MeetUp #8 (28.03.2019). I was sharing my experience of introducing DevOps in projects of various size. We started with agile ways of working with architecture (evolutionary approaches, ADR), talked about introduction of continuous security practices (DevSecOps) and ended with the ways of final business release of our applications.
What's hot (18)
José Vila - ¿Otro parche más? No, por favor. [rooted2018]
José Vila - ¿Otro parche más? No, por favor. [rooted2018]
Stephen Sadowski - Securely automating infrastructure in the cloud
Stephen Sadowski - Securely automating infrastructure in the cloud
Javier Hijas & Ori Kuyumgiski - Security at the speed of DevOps [rooted2018]
Javier Hijas & Ori Kuyumgiski - Security at the speed of DevOps [rooted2018]
Software Security in DevOps: Synthesizing Practitioners’ Perceptions and Prac...
Software Security in DevOps: Synthesizing Practitioners’ Perceptions and Prac...
ATAGTR2017 Cost-effective Security Testing Approaches for Web, Mobile & Enter...
ATAGTR2017 Cost-effective Security Testing Approaches for Web, Mobile & Enter...
Making the Shift from DevOps to Practical DevSecOps | Sumo Logic Webinar
Making the Shift from DevOps to Practical DevSecOps | Sumo Logic Webinar
[OPD 2019] Governance as a missing part of IT security architecture
[OPD 2019] Governance as a missing part of IT security architecture
Veracode Automation CLI (using Jenkins for SDL integration)
Veracode Automation CLI (using Jenkins for SDL integration)
Ernesto Bethencourt & Javier Sanz - OFRECIENDO SEGURIDAD DE AUTOCONSUMO A LOS...
Ernesto Bethencourt & Javier Sanz - OFRECIENDO SEGURIDAD DE AUTOCONSUMO A LOS...
Viewers also liked
Aging in Place: Housing Washington 2014 Conference SLIDE DECK
"Aging In Place: 5 Things to Remember for AIP Success" - Here is our slide deck for the Housing Washington Regional Conference 2014, to be held Oct. 6 - 8th at the Tacoma Convention and Trade Center. We speak on October 8th at 9:50am
Empowering The Mature Mind - SUMMER 2014 Newsletter
This newsletter from Empowering The Mature Mind provides information on their consulting and design services for aging in place housing solutions. It highlights an upcoming speaking engagement and their featured project remodeling a home for accessibility and independence for a paraplegic client. It also promotes their book on aging in place design and lists upcoming courses on the topic they are presenting locally in the Seattle area.
Reaching & Connecting with the BOOMER CONSUMER - by EtMM Aaron D. Murphy
Reaching & Connecting with the BOOMER CONSUMER - by EtMM Aaron D. MurphyAaron D. Murphy, Architect / CAPS
The document discusses strategies for marketing to baby boomers. It begins by providing statistics showing the size and spending power of the boomer demographic. It then discusses understanding boomers and establishing trust by listening to their needs and desires. The document outlines four approaches to age branding: age-denial, age-adaptive, age-irrelevant, and age-affirmative. It also provides tips for marketing to boomers such as cultivating relationships, being accessible experts, using a "give and go" communication strategy, and community outreach. Females over 40 are highlighted as key decision makers.Lightning Talk: The History of SEO (in 3 Minutes) | Cardiff SEO Meet
This lightning talk summarizes the history of search engine optimization (SEO) in 3 minutes or less. It outlines 20 major events and developments in SEO from 1990 to 2015, including the creation of the World Wide Web, early search engines, the launch of Google, the introduction of Google's PageRank algorithm, and other important Google updates. The talk also lists challenges and donation amounts associated with a charity fundraiser where attendees can win prizes by correctly stating SEO terms.
Omer presentation
The textile industry is the backbone of Pakistan's economy, contributing approximately 46% to total output and 8.5% to GDP. Pakistan is the 4th largest cotton producer in Asia and the 3rd largest exporter of raw cotton. The textile industry provides employment for 38% of Pakistan's workforce and contributes over 60% to the country's total exports, which amounted to around $5.2 billion USD in 2013. However, the industry has faced a decline in growth rate due to issues like the global recession, security concerns, and high production costs from increased energy prices.
Viewers also liked (7)
Aging in Place: Housing Washington 2014 Conference SLIDE DECK
Aging in Place: Housing Washington 2014 Conference SLIDE DECK
Empowering The Mature Mind - SUMMER 2014 Newsletter
Empowering The Mature Mind - SUMMER 2014 Newsletter
Reaching & Connecting with the BOOMER CONSUMER - by EtMM Aaron D. Murphy
Reaching & Connecting with the BOOMER CONSUMER - by EtMM Aaron D. Murphy
Lightning Talk: The History of SEO (in 3 Minutes) | Cardiff SEO Meet
Lightning Talk: The History of SEO (in 3 Minutes) | Cardiff SEO Meet
Similar to Why monitoring is an analytics problem
AWS Loft Talk: Behind the Scenes with SignalFx
Slides from SignalFx CTO Phillip Liu's presentation at the AWS Loft in SF after DockerCon: Behind the Scenes with SignalFx.
Phil discussed how SignalFx deploys, runs, and operates a completely Dockerized microservices architecture for a production SaaS application dealing with large volumes of high resolution customer data.
Scaling security in a cloud environment v0.5 (Sep 2017)
This document summarizes a presentation on scaling security in cloud environments. The key points are:
1. Testing and automation are essential for scaling security in the cloud. All aspects of the cloud environment, from provisioning to deployment to scaling, need to be tested.
2. Performance tests should be run daily, including during high-volume periods, to test the behavior of the system under different loads. Quality assurance tests can serve as good performance tests when executed in random order.
3. Automated scaling is a powerful feature of the cloud but autoscaling rules and behaviors also need to be tested to ensure they work as expected under different conditions.
MuleSoft Surat Virtual Meetup#4 - Anypoint Monitoring and MuleSoft dataloader.io
The document summarizes an agenda for a MuleSoft meetup discussing Anypoint Monitoring, Anypoint Alerts, MuleSoft dataloader.io, and Runtime Manager insights. It provides information on monitoring application and API performance, setting alerts for errors or thresholds, using dataloader.io to import and export data, and gaining visibility into transactions with Runtime Manager insights. It also demonstrates Anypoint Monitoring dashboards and alert configurations.
Making Security Agile
Security process should be integrated with SDLC well to be successful. While many companies have already moved from Waterfall to Agile methodologies security remains behind more often than not. We have demonstrated in our presentation how security can move to agile by utilizing open source tools, customizing them to meet our needs and to implement a continuos security testing using dynamic scanners as well as manual testing.
It’s very important also to assure that false positives are not fed to the developers bug tracking systems and to assign a severity for each finding correctly. To make it happen we import all our findings to a security dashboard and review them before exporting to a bug tracking system.
Netflix Cloud Architecture and Open Source
A presentation on the Netflix Cloud Architecture and NetflixOSS open source. For the All Things Open 2015 conference in Raleigh 2015/10/19. #ATO2015 #NetflixOSS
MongoDB World 2018: Ch-Ch-Ch-Ch-Changes: Taking Your Stitch Application to th...
The document discusses the evolution of MongoDB and the introduction of MongoDB Stitch and Triggers. Key points include:
1) MongoDB Stitch allows developers to build event-driven functions that execute in response to events like database changes or third party webhooks.
2) Stitch Triggers coordinate change streams from MongoDB to pass change events to an event coordinator, which ensures functions execute correctly.
3) An example application called the MongoDB Swagstore is presented to demonstrate how Stitch Triggers could be used to update inventory, send shipping notifications, and more in response to database changes.
apidays LIVE Paris - Serverless security: how to protect what you don't see? ...
apidays LIVE Paris - Responding to the New Normal with APIs for Business, People and Society
December 8, 9 & 10, 2020
Serverless security: how to protect what you don't see?
Jean Baptiste Aviat, Co-founder and CTO at Sqreen.io
Top 10 Software to Detect & Prevent Security Vulnerabilities from BlackHat US...
BlackHat USA 2015 got recently concluded and we head a bunch of news around how BlackHat brought to light various security vulnerabilities in day-to-day life like ZigBee protocol, Device for stealing keyless cars & ATM card skimmers. However the presenters, who are also ethical hackers, also gave a bunch of tools to help software community to detect & prevent security holes in the hardware & software while the product is ready for release. We have reviewed all the presentations from the conference and give you here a list of Top 10 tools/utilities that helps in security vulnerability detection & prevention.
Dev{sec}ops
Keeping security top of mind while creating standards for engineering teams following the DevOps culture. This talk was designed to show off how easily it is to automate security scanning and to be the developer advocate by showing the quality of development work. We will cover some high-level topics of DevSecOps and demo some examples DevOps team can implement for free.
Pragmatic Pipeline Security
All organizations want to go faster and decrease friction in delivering software. The problem is that InfoSec has historically slowed this down or worse. But, with the rise of CD pipelines and new devsecops tooling, there is an opportunity to reverse this trend and move Security from being a blocker to being an enabler.
This talk will discuss hallmarks of doing security in a software delivery pipeline with an emphasis on being pragmatic. At each phase of the delivery pipeline, you will be armed with philosophy, questions, and tools that will get security up-to-speed with your software delivery cadence.
From DeliveryConf 2020
AWS live hack: Atlassian + Snyk OSS on AWS
The document discusses securing modern applications in AWS. It begins with an overview of the risk profile of modern applications, noting that they often incorporate a large amount of open source code and are deployed rapidly using containers and infrastructure as code. It then demonstrates how to "live hack" an application running on AWS. Next, it discusses how Snyk can help prevent such exploits by empowering developers, automating fixes, and providing security throughout the entire codebase. It also outlines additional security practices like minimizing container footprints, using secrets safely, and implementing network policies. Finally, it promotes attending additional security sessions and provides references for further reading.
Log Analytics for Distributed Microservices
This document summarizes a presentation on log analytics for distributed microservices architectures. It discusses how log analytics is needed to monitor these complex distributed systems and gain business insights. The presentation covers topics like distributed microservice log events, an introduction to log analytics, the log analytics market, and how log analytics relates to other big data components. It provides examples of scenarios where log analytics can be used and an overview of alternatives for log analytics solutions.
Bangalore OpenMSA DevDay - September 19, 2018
The document provides an agenda for a DevDay event on network and security automation using the OpenMSA. It includes introductions of the speakers, John Collins and Naveen Kumar. The agenda covers hands-on sessions on using microservices and workflows to perform tasks like provisioning security rules and automating network configurations across multiple devices from a single pane of glass. Questions from attendees are addressed, explaining how to submit questions online and that the OpenMSA community is open source and free for contributors.
Cncf checkov and bridgecrew
This document discusses a webinar about integrating infrastructure as code (IaC) security into the development lifecycle using Checkov. It notes that nearly half of open source Terraform and CloudFormation templates contain security issues. Checkov is introduced as an open source IaC scanning tool that supports multiple frameworks and cloud providers. The benefits of Checkov include lower remediation times, reduced security incidents, and simplifying compliance. Integrations with DevOps tools and the Cloud Native Application Platform Approach (CNAPP) are also discussed. A demo of Checkov is then shown including using it with VS Code and Azure DevOps.
Platform governance, gestire un ecosistema di microservizi a livello enterprise
A livello enterprise, le moderne architetture distribuite coinvolgono molti team differenti, centinaia di sviluppatori e operations e migliaia microservizi ed API in produzione. Come si può gestire questa
e o
un'esplosione di costi e preservando il time-to-market?
Code Coverage and Test Suite Effectiveness: Empirical Study with Real Bugs in...
Code Coverage and Test Suite Effectiveness: Empirical Study with Real Bugs in...Pavneet Singh Kochhar
In this paper, we analyse two large software systems to
measure the relationship of code coverage and its effectiveness in killing real bugs from the software systems.Empowering developers and operators through Gitlab and HashiCorp
Companies digitally transforming themselves into modern, software-defined businesses are building their foundation on cloud native solutions like GitLab and Hashicorp. Together, GitLab, Terraform, and Vault are empowering organizations to be more iterative, flexible, and secure. Join us in this session to learn more about how GitLab and Hashicorp are lowering the barrier of entry into industrializing the application development and delivery process across the entire application lifecycle.
OORPT Dynamic Analysis
This document discusses dynamic analysis techniques for understanding the runtime behavior of object-oriented programs. It describes various sources of runtime information, such as program output, resource usage, and internal instrumentation. Common tools for dynamic analysis include loggers, debuggers, and profilers. Reverse engineering techniques can combine static and dynamic views. Feature-based analysis aims to map features to source code by comparing execution traces.
BrownResearch_CV
This document provides a summary of Abby Brown's technical experience including book reviews and editor roles, software patents submitted and issued, research projects and presentations conducted, and technical memberships. Key details include serving as technical editor for two books on Tibco software, submitting several patents around automated tools for services, metadata, and network alarms, presenting on topics such as cloud computing and SOA, and holding memberships in technical organizations like IEEE, The Open Group, and OASIS.
Software Analytics: Data Analytics for Software Engineering and Security
Frodo Baggins presents on software analytics for software engineering and security tasks. The presentation discusses how software and how it is built and used is changing, with data now being ubiquitous and software having continuous development and release. Software analytics aims to enable software practitioners to perform data exploration and analysis to obtain useful insights. Examples of software analytics techniques discussed include XIAO for scalable code clone analysis, and SAS for incident management of online services. The presentation then shifts to discussing software analytics techniques for mobile app security, including WHYPER for natural language processing on app descriptions to link permissions to functionality, and AppContext for machine learning to classify malware.
Similar to Why monitoring is an analytics problem (20)
Scaling security in a cloud environment v0.5 (Sep 2017)
Scaling security in a cloud environment v0.5 (Sep 2017)
MuleSoft Surat Virtual Meetup#4 - Anypoint Monitoring and MuleSoft dataloader.io
MuleSoft Surat Virtual Meetup#4 - Anypoint Monitoring and MuleSoft dataloader.io
MongoDB World 2018: Ch-Ch-Ch-Ch-Changes: Taking Your Stitch Application to th...
MongoDB World 2018: Ch-Ch-Ch-Ch-Changes: Taking Your Stitch Application to th...
apidays LIVE Paris - Serverless security: how to protect what you don't see? ...
apidays LIVE Paris - Serverless security: how to protect what you don't see? ...
Top 10 Software to Detect & Prevent Security Vulnerabilities from BlackHat US...
Top 10 Software to Detect & Prevent Security Vulnerabilities from BlackHat US...
Platform governance, gestire un ecosistema di microservizi a livello enterprise
Platform governance, gestire un ecosistema di microservizi a livello enterprise
Code Coverage and Test Suite Effectiveness: Empirical Study with Real Bugs in...
Code Coverage and Test Suite Effectiveness: Empirical Study with Real Bugs in...
Empowering developers and operators through Gitlab and HashiCorp
Empowering developers and operators through Gitlab and HashiCorp
Software Analytics: Data Analytics for Software Engineering and Security
Software Analytics: Data Analytics for Software Engineering and Security
Recently uploaded
Bengaluru Dreamin' 24 - Personal Branding
Session on Personal Branding presented at Bengaluru Dreamin
快速办理(Vic毕业证书)惠灵顿维多利亚大学毕业证完成信一模一样
学校原件一模一样【微信：741003700 】《(Vic毕业证书)惠灵顿维多利亚大学毕业证》【微信：741003700 】学位证，留信认证（真实可查，永久存档）原件一模一样纸张工艺/offer、雅思、外壳等材料/诚信可靠,可直接看成品样本，帮您解决无法毕业带来的各种难题！外壳，原版制作，诚信可靠，可直接看成品样本。行业标杆！精益求精，诚心合作，真诚制作！多年品质 ,按需精细制作，24小时接单,全套进口原装设备。十五年致力于帮助留学生解决难题，包您满意。
本公司拥有海外各大学样板无数，能完美还原。
1:1完美还原海外各大学毕业材料上的工艺：水印，阴影底纹，钢印LOGO烫金烫银，LOGO烫金烫银复合重叠。文字图案浮雕、激光镭射、紫外荧光、温感、复印防伪等防伪工艺。材料咨询办理、认证咨询办理请加学历顾问Q/微741003700
【主营项目】
一.毕业证【q微741003700】成绩单、使馆认证、教育部认证、雅思托福成绩单、学生卡等！
二.真实使馆公证(即留学回国人员证明,不成功不收费)
三.真实教育部学历学位认证（教育部存档！教育部留服网站永久可查）
四.办理各国各大学文凭(一对一专业服务,可全程监控跟踪进度)
如果您处于以下几种情况：
◇在校期间，因各种原因未能顺利毕业……拿不到官方毕业证【q/微741003700】
◇面对父母的压力，希望尽快拿到；
◇不清楚认证流程以及材料该如何准备；
◇回国时间很长，忘记办理；
◇回国马上就要找工作，办给用人单位看；
◇企事业单位必须要求办理的
◇需要报考公务员、购买免税车、落转户口
◇申请留学生创业基金
留信网认证的作用:
1:该专业认证可证明留学生真实身份
2:同时对留学生所学专业登记给予评定
3:国家专业人才认证中心颁发入库证书
4:这个认证书并且可以归档倒地方
5:凡事获得留信网入网的信息将会逐步更新到个人身份内，将在公安局网内查询个人身份证信息后，同步读取人才网入库信息
6:个人职称评审加20分
7:个人信誉贷款加10分
8:在国家人才网主办的国家网络招聘大会中纳入资料，供国家高端企业选择人才
办理毕业证(UPenn毕业证)宾夕法尼亚大学毕业证成绩单快速办理
官方原版办理宾夕法尼亚大学毕业证【微信176555708】学历认证怎么做：原版仿制宾夕法尼亚大学电子版成绩单毕业证认证【宾夕法尼亚大学毕业证成绩单】、宾夕法尼亚大学文凭证书成绩单复刻offer录取通知书、购买UPenn圣力嘉学院本科毕业证、【宾夕法尼亚大学毕业证办理UPenn毕业证书哪里买】、宾夕法尼亚大学 Offer在线办理UPenn Offer宾夕法尼亚大学Bachloer Degree。（留信学历认证永久存档查询）采用学校原版纸张、特殊工艺完全按照原版一比一制作（包括：隐形水印，阴影底纹，钢印LOGO烫金烫银，LOGO烫金烫银复合重叠，文字图案浮雕，激光镭射，紫外荧光，温感，复印防伪）行业标杆！精益求精，诚心合作，真诚制作！多年品质 ,按需精细制作，24小时接单,全套进口原装设备，十五年致力于帮助留学生解决难题，业务范围有加拿大、英国、澳洲、韩国、美国、新加坡，新西兰等学历材料，包您满意。
◆◆◆◆◆ — — — — — — — — 【留学教育】留学归国服务中心 — — — — — -◆◆◆◆◆
【主营项目】
一.毕业证【微信：176555708】成绩单、使馆认证、教育部认证、雅思托福成绩单、学生卡等！
二.真实使馆公证(即留学回国人员证明,不成功不收费)
三.真实教育部学历学位认证（教育部存档！教育部留服网站永久可查）
四.办理各国各大学文凭(一对一专业服务,可全程监控跟踪进度)
如果您处于以下几种情况：
◇在校期间，因各种原因未能顺利毕业……拿不到官方毕业证【微信：176555708】
◇面对父母的压力，希望尽快拿到；
◇不清楚认证流程以及材料该如何准备；
◇回国时间很长，忘记办理；
◇回国马上就要找工作，办给用人单位看；
◇企事业单位必须要求办理的
◇需要报考公务员、购买免税车、落转户口
◇申请留学生创业基金
留信网认证的作用:
1:该专业认证可证明留学生真实身份
2:同时对留学生所学专业登记给予评定
3:国家专业人才认证中心颁发入库证书
4:这个认证书并且可以归档倒地方
5:凡事获得留信网入网的信息将会逐步更新到个人身份内，将在公安局网内查询个人身份证信息后，同步读取人才网入库信息
6:个人职称评审加20分
7:个人信誉贷款加10分→ 【关于价格问题（保证一手价格）
8:在国家人才网主办的国家网络招聘大会中纳入资料，供国家高端企业选择人才
选择实体注册公司办理，更放心，更安全！我们的承诺：可来公司面谈，可签订合同，会陪同客户一起到教育部认证窗口递交认证材料，客户在教育部官方认证查询网站查询到认证通过结果后付款，不成功不收费！
我们所定的价格是非常合理的，而且我们现在做得单子大多数都是代理和回头客户介绍的所以一般现在有新的单子 我给客户的都是第一手的代理价格，因为我想坦诚对待大家 不想跟大家在价格方面浪费时间
对于老客户或者被老客户介绍过来的朋友，我们都会适当给一些优惠。
学历顾问：微信：176555708
怎么办理(umiami毕业证书)美国迈阿密大学毕业证文凭证书实拍图原版一模一样
原版定制【微信:bwp0011】《(umiami毕业证书)美国迈阿密大学毕业证文凭证书》【微信:bwp0011】成绩单 、雅思、外壳、留信学历认证永久存档查询，采用学校原版纸张、特殊工艺完全按照原版一比一制作（包括：隐形水印，阴影底纹，钢印LOGO烫金烫银，LOGO烫金烫银复合重叠，文字图案浮雕，激光镭射，紫外荧光，温感，复印防伪）行业标杆！精益求精，诚心合作，真诚制作！多年品质 ,按需精细制作，24小时接单,全套进口原装设备，十五年致力于帮助留学生解决难题，业务范围有加拿大、英国、澳洲、韩国、美国、新加坡，新西兰等学历材料，包您满意。
【业务选择办理准则】
一、工作未确定，回国需先给父母、亲戚朋友看下文凭的情况，办理一份就读学校的毕业证【微信bwp0011】文凭即可
二、回国进私企、外企、自己做生意的情况，这些单位是不查询毕业证真伪的，而且国内没有渠道去查询国外文凭的真假，也不需要提供真实教育部认证。鉴于此，办理一份毕业证【微信bwp0011】即可
三、进国企，银行，事业单位，考公务员等等，这些单位是必需要提供真实教育部认证的，办理教育部认证所需资料众多且烦琐，所有材料您都必须提供原件，我们凭借丰富的经验，快捷的绿色通道帮您快速整合材料，让您少走弯路。
留信网认证的作用:
1:该专业认证可证明留学生真实身份
2:同时对留学生所学专业登记给予评定
3:国家专业人才认证中心颁发入库证书
4:这个认证书并且可以归档倒地方
5:凡事获得留信网入网的信息将会逐步更新到个人身份内，将在公安局网内查询个人身份证信息后，同步读取人才网入库信息
6:个人职称评审加20分
7:个人信誉贷款加10分
8:在国家人才网主办的国家网络招聘大会中纳入资料，供国家高端企业选择人才
【关于价格问题（保证一手价格）】
我们所定的价格是非常合理的，而且我们现在做得单子大多数都是代理和回头客户介绍的所以一般现在有新的单子 我给客户的都是第一手的代理价格，因为我想坦诚对待大家 不想跟大家在价格方面浪费时间
对于老客户或者被老客户介绍过来的朋友，我们都会适当给一些优惠。
留学挂科(UofM毕业证)明尼苏达大学毕业证成绩单复刻办理
精仿办理明尼苏达大学学历证书＜176555708微信＞【毕业证明信-推荐信做学费单＞【微信176555708】【制作UofM毕业证文凭认证明尼苏达大学毕业证成绩单购买】【UofM毕业证书】{明尼苏达大学文凭购买}】成绩单，录取通知书，Offer，在读证明，雅思托福成绩单，真实大使馆教育部认证，回国人员证明，＞【制作UofM毕业证文凭认证明尼苏达大学毕业证成绩单购买】【UofM毕业证书】{明尼苏达大学文凭购买}留信网认证。
明尼苏达大学学历证书＜微信176555708（一对一服务包括毕业院长签字,专业课程,学位类型,专业或教育领域,以及毕业日期.不要忽视这些细节.这两份文件同样重要!毕业证成绩单文凭留信网学历认证！）（留信学历认证永久存档查询）采用学校原版纸张、特殊工艺完全按照原版一比一制作（包括：隐形水印，阴影底纹，钢印LOGO烫金烫银，LOGO烫金烫银复合重叠，文字图案浮雕，激光镭射，紫外荧光，温感，复印防伪）行业标杆！精益求精，诚心合作，真诚制作！多年品质 ,按需精细制作，24小时接单,全套进口原装设备，十五年致力于帮助留学生解决难题，业务范围有加拿大、英国、澳洲、韩国、美国、新加坡，新西兰等学历材料，包您满意。
◆◆◆◆◆ — — — — — — — — 【留学教育】留学归国服务中心 — — — — — -◆◆◆◆◆
【主营项目】
一.毕业证【微信：176555708】成绩单、使馆认证、教育部认证、雅思托福成绩单、学生卡等！
二.真实使馆公证(即留学回国人员证明,不成功不收费)
三.真实教育部学历学位认证（教育部存档！教育部留服网站永久可查）
四.办理各国各大学文凭(一对一专业服务,可全程监控跟踪进度)
如果您处于以下几种情况：
◇在校期间，因各种原因未能顺利毕业……拿不到官方毕业证【微信：176555708】
◇面对父母的压力，希望尽快拿到；
◇不清楚认证流程以及材料该如何准备；
◇回国时间很长，忘记办理；
◇回国马上就要找工作，办给用人单位看；
◇企事业单位必须要求办理的
◇需要报考公务员、购买免税车、落转户口
◇申请留学生创业基金
留信网认证的作用:
1:该专业认证可证明留学生真实身份
2:同时对留学生所学专业登记给予评定
3:国家专业人才认证中心颁发入库证书
4:这个认证书并且可以归档倒地方
5:凡事获得留信网入网的信息将会逐步更新到个人身份内，将在公安局网内查询个人身份证信息后，同步读取人才网入库信息
6:个人职称评审加20分
7:个人信誉贷款加10分→ 【关于价格问题（保证一手价格）
8:在国家人才网主办的国家网络招聘大会中纳入资料，供国家高端企业选择人才
选择实体注册公司办理，更放心，更安全！我们的承诺：可来公司面谈，可签订合同，会陪同客户一起到教育部认证窗口递交认证材料，客户在教育部官方认证查询网站查询到认证通过结果后付款，不成功不收费！
我们所定的价格是非常合理的，而且我们现在做得单子大多数都是代理和回头客户介绍的所以一般现在有新的单子 我给客户的都是第一手的代理价格，因为我想坦诚对待大家 不想跟大家在价格方面浪费时间
对于老客户或者被老客户介绍过来的朋友，我们都会适当给一些优惠。
学历顾问：微信：176555708
办理新西兰奥克兰大学毕业证学位证书范本原版一模一样
原版一模一样【微信：741003700 】【新西兰奥克兰大学毕业证学位证书】【微信：741003700 】学位证，留信认证（真实可查，永久存档）offer、雅思、外壳等材料/诚信可靠,可直接看成品样本，帮您解决无法毕业带来的各种难题！外壳，原版制作，诚信可靠，可直接看成品样本。行业标杆！精益求精，诚心合作，真诚制作！多年品质 ,按需精细制作，24小时接单,全套进口原装设备。十五年致力于帮助留学生解决难题，包您满意。
本公司拥有海外各大学样板无数，能完美还原海外各大学 Bachelor Diploma degree, Master Degree Diploma
1:1完美还原海外各大学毕业材料上的工艺：水印，阴影底纹，钢印LOGO烫金烫银，LOGO烫金烫银复合重叠。文字图案浮雕、激光镭射、紫外荧光、温感、复印防伪等防伪工艺。材料咨询办理、认证咨询办理请加学历顾问Q/微741003700
留信网认证的作用:
1:该专业认证可证明留学生真实身份
2:同时对留学生所学专业登记给予评定
3:国家专业人才认证中心颁发入库证书
4:这个认证书并且可以归档倒地方
5:凡事获得留信网入网的信息将会逐步更新到个人身份内，将在公安局网内查询个人身份证信息后，同步读取人才网入库信息
6:个人职称评审加20分
7:个人信誉贷款加10分
8:在国家人才网主办的国家网络招聘大会中纳入资料，供国家高端企业选择人才
存档可查的(USC毕业证)南加利福尼亚大学毕业证成绩单制做办理
精仿办理南加利福尼亚大学毕业证成绩单（【微信176555708】）毕业证学历认证OFFER专卖国外文凭学历学位证书办理澳洲文凭|澳洲毕业证,澳洲学历认证,澳洲成绩单【微信176555708】 澳洲offer,教育部学历认证及使馆认证永久可查 ,国外毕业证|国外学历认证,国外学历文凭证书 USC毕业证，USC毕业证，USC毕业证，USC毕业证，USC毕业证，USC毕业证【微信176555708】，USC毕业证，专业为留学生办理毕业证、成绩单、使馆留学回国人员证明、教育部学历学位认证、录取通知书、Offer、（留信学历认证永久存档查询）采用学校原版纸张、特殊工艺完全按照原版一比一制作（包括：隐形水印，阴影底纹，钢印LOGO烫金烫银，LOGO烫金烫银复合重叠，文字图案浮雕，激光镭射，紫外荧光，温感，复印防伪）行业标杆！精益求精，诚心合作，真诚制作！多年品质 ,按需精细制作，24小时接单,全套进口原装设备，十五年致力于帮助留学生解决难题，业务范围有加拿大、英国、澳洲、韩国、美国、新加坡，新西兰等学历材料，包您满意。
◆◆◆◆◆ — — — — — — — — 【留学教育】留学归国服务中心 — — — — — -◆◆◆◆◆
【主营项目】
一.毕业证【微信：176555708】成绩单、使馆认证、教育部认证、雅思托福成绩单、学生卡等！
二.真实使馆公证(即留学回国人员证明,不成功不收费)
三.真实教育部学历学位认证（教育部存档！教育部留服网站永久可查）
四.办理各国各大学文凭(一对一专业服务,可全程监控跟踪进度)
如果您处于以下几种情况：
◇在校期间，因各种原因未能顺利毕业……拿不到官方毕业证【微信：176555708】
◇面对父母的压力，希望尽快拿到；
◇不清楚认证流程以及材料该如何准备；
◇回国时间很长，忘记办理；
◇回国马上就要找工作，办给用人单位看；
◇企事业单位必须要求办理的
◇需要报考公务员、购买免税车、落转户口
◇申请留学生创业基金
留信网认证的作用:
1:该专业认证可证明留学生真实身份
2:同时对留学生所学专业登记给予评定
3:国家专业人才认证中心颁发入库证书
4:这个认证书并且可以归档倒地方
5:凡事获得留信网入网的信息将会逐步更新到个人身份内，将在公安局网内查询个人身份证信息后，同步读取人才网入库信息
6:个人职称评审加20分
7:个人信誉贷款加10分→ 【关于价格问题（保证一手价格）
8:在国家人才网主办的国家网络招聘大会中纳入资料，供国家高端企业选择人才
选择实体注册公司办理，更放心，更安全！我们的承诺：可来公司面谈，可签订合同，会陪同客户一起到教育部认证窗口递交认证材料，客户在教育部官方认证查询网站查询到认证通过结果后付款，不成功不收费！
我们所定的价格是非常合理的，而且我们现在做得单子大多数都是代理和回头客户介绍的所以一般现在有新的单子 我给客户的都是第一手的代理价格，因为我想坦诚对待大家 不想跟大家在价格方面浪费时间
对于老客户或者被老客户介绍过来的朋友，我们都会适当给一些优惠。
学历顾问：微信：176555708
Ready to Unlock the Power of Blockchain!
Imagine a world where data flows freely, yet remains secure. A world where trust is built into the fabric of every transaction. This is the promise of blockchain, a revolutionary technology poised to reshape our digital landscape.
Toptal Tech is at the forefront of this innovation, connecting you with the brightest minds in blockchain development. Together, we can unlock the potential of this transformative technology, building a future of transparency, security, and endless possibilities.
Discover the benefits of outsourcing SEO to India
"Discover the benefits of outsourcing SEO to India! From cost-effective services and expert professionals to round-the-clock work advantages, learn how your business can achieve digital success with Indian SEO solutions.
成绩单ps(UST毕业证)圣托马斯大学毕业证成绩单快速办理
一比一原版制作UST毕业证【微信176555708】圣托马斯大学毕业证书原版↑制作圣托马斯大学学历认证文凭办理圣托马斯大学留信网认证,留学回国办理毕业证成绩单文凭学历认证【微信176555708】专业为海外学子办理毕业证成绩单、文凭制作，学历仿制，回国人员证明、做文凭，研究生、本科、硕士学历认证、留信认证、结业证、学位证书样本、美国教育部认证百分百真实存档可查】（留信学历认证永久存档查询）采用学校原版纸张、特殊工艺完全按照原版一比一制作（包括：隐形水印，阴影底纹，钢印LOGO烫金烫银，LOGO烫金烫银复合重叠，文字图案浮雕，激光镭射，紫外荧光，温感，复印防伪）行业标杆！精益求精，诚心合作，真诚制作！多年品质 ,按需精细制作，24小时接单,全套进口原装设备，十五年致力于帮助留学生解决难题，业务范围有加拿大、英国、澳洲、韩国、美国、新加坡，新西兰等学历材料，包您满意。
◆◆◆◆◆ — — — — — — — — 【留学教育】留学归国服务中心 — — — — — -◆◆◆◆◆
【主营项目】
一.毕业证【微信：176555708】成绩单、使馆认证、教育部认证、雅思托福成绩单、学生卡等！
二.真实使馆公证(即留学回国人员证明,不成功不收费)
三.真实教育部学历学位认证（教育部存档！教育部留服网站永久可查）
四.办理各国各大学文凭(一对一专业服务,可全程监控跟踪进度)
如果您处于以下几种情况：
◇在校期间，因各种原因未能顺利毕业……拿不到官方毕业证【微信：176555708】
◇面对父母的压力，希望尽快拿到；
◇不清楚认证流程以及材料该如何准备；
◇回国时间很长，忘记办理；
◇回国马上就要找工作，办给用人单位看；
◇企事业单位必须要求办理的
◇需要报考公务员、购买免税车、落转户口
◇申请留学生创业基金
留信网认证的作用:
1:该专业认证可证明留学生真实身份
2:同时对留学生所学专业登记给予评定
3:国家专业人才认证中心颁发入库证书
4:这个认证书并且可以归档倒地方
5:凡事获得留信网入网的信息将会逐步更新到个人身份内，将在公安局网内查询个人身份证信息后，同步读取人才网入库信息
6:个人职称评审加20分
7:个人信誉贷款加10分→ 【关于价格问题（保证一手价格）
8:在国家人才网主办的国家网络招聘大会中纳入资料，供国家高端企业选择人才
选择实体注册公司办理，更放心，更安全！我们的承诺：可来公司面谈，可签订合同，会陪同客户一起到教育部认证窗口递交认证材料，客户在教育部官方认证查询网站查询到认证通过结果后付款，不成功不收费！
我们所定的价格是非常合理的，而且我们现在做得单子大多数都是代理和回头客户介绍的所以一般现在有新的单子 我给客户的都是第一手的代理价格，因为我想坦诚对待大家 不想跟大家在价格方面浪费时间
对于老客户或者被老客户介绍过来的朋友，我们都会适当给一些优惠。
学历顾问：微信：176555708
一比一原版(USYD毕业证)悉尼大学毕业证如何办理
USYD硕士毕业证成绩单【微信95270640】《如何办理悉尼大学毕业证认证》【办证Q微信95270640】《悉尼大学文凭毕业证制作》《USYD学历学位证书哪里买》办理悉尼大学学位证书扫描件、办理悉尼大学雅思证书！
国际留学归国服务中心《如何办悉尼大学毕业证认证》《USYD学位证书扫描件哪里买》实体公司，注册经营，行业标杆，精益求精！
如果您是以下情况，我们都能竭诚为您解决实际问题：【公司采用定金+余款的付款流程，以最大化保障您的利益，让您放心无忧】
1、在校期间，因各种原因未能顺利毕业，拿不到官方毕业证+微信95270640
2、面对父母的压力，希望尽快拿到悉尼大学悉尼大学毕业证offer；
3、不清楚流程以及材料该如何准备悉尼大学悉尼大学毕业证offer；
4、回国时间很长，忘记办理；
5、回国马上就要找工作，办给用人单位看；
6、企事业单位必须要求办理的；
面向美国乔治城大学毕业留学生提供以下服务:
【★悉尼大学悉尼大学毕业证offer毕业证、成绩单等全套材料，从防伪到印刷，从水印到钢印烫金，与学校100%相同】
【★真实使馆认证（留学人员回国证明），使馆存档可通过大使馆查询确认】
【★真实教育部认证，教育部存档，教育部留服网站可查】
【★真实留信认证，留信网入库存档，可查悉尼大学悉尼大学毕业证offer】
我们从事工作十余年的有着丰富经验的业务顾问，熟悉海外各国大学的学制及教育体系，并且以挂科生解决毕业材料不全问题为基础，为客户量身定制1对1方案，未能毕业的回国留学生成功搭建回国顺利发展所需的桥梁。我们一直努力以高品质的教育为起点，以诚信、专业、高效、创新作为一切的行动宗旨，始终把“诚信为主、质量为本、客户第一”作为我们全部工作的出发点和归宿点。同时为海内外留学生提供大学毕业证购买、补办成绩单及各类分数修改等服务；归国认证方面，提供《留信网入库》申请、《国外学历学位认证》申请以及真实学籍办理等服务，帮助众多莘莘学子实现了一个又一个梦想。
专业服务，请勿犹豫联系我
如果您真实毕业回国，对于学历认证无从下手，请联系我，我们免费帮您递交
诚招代理：本公司诚聘当地代理人员，如果你有业余时间，或者你有同学朋友需要，有兴趣就请联系我
你赢我赢，共创双赢
你做代理，可以帮助悉尼大学同学朋友
你做代理，可以拯救悉尼大学失足青年
你做代理，可以挽救悉尼大学一个个人才
你做代理，你将是别人人生悉尼大学的转折点
你做代理，可以改变自己，改变他人，给他人和自己一个机会过暑假的小学生快乐的日子总是过得飞快山娃尚未完全认清那几位小朋友时他们却一个接一个地回家了山娃这时才恍然发现二个月的暑假已转到了尽头他的城市生活也将划上一个不很圆满的句号了值得庆幸的是山娃早记下了他们的学校和联系方式说也奇怪在山娃离城的头一天父亲居然请假陪山娃耍了一天那一天父亲陪着山娃辗转长隆水上乐园疯了一整天水上漂流高空冲浪看大马戏大凡里面有的父亲都带着他去疯一把山娃算了算这一次足足花了老爸元很
Should Repositories Participate in the Fediverse?
Presentation for OR2024 making the case that repositories could play a part in the "fediverse" of distributed social applications
办理毕业证(NYU毕业证)纽约大学毕业证成绩单官方原版办理
退学买【纽约大学毕业证认证】【办证微信176555708】【纽约大学文凭毕业证制作】【NYU学历学位证书哪里买】办理纽约大学学位证书扫描件、办理纽约大学雅思证书！
国际留学归国服务中心【如何办纽约大学毕业证认证】【NYU学位证书扫描件哪里买】实体公司，注册经营，行业标杆，精益求精！（留信学历认证永久存档查询）采用学校原版纸张、特殊工艺完全按照原版一比一制作（包括：隐形水印，阴影底纹，钢印LOGO烫金烫银，LOGO烫金烫银复合重叠，文字图案浮雕，激光镭射，紫外荧光，温感，复印防伪）行业标杆！精益求精，诚心合作，真诚制作！多年品质 ,按需精细制作，24小时接单,全套进口原装设备，十五年致力于帮助留学生解决难题，业务范围有加拿大、英国、澳洲、韩国、美国、新加坡，新西兰等学历材料，包您满意。
◆◆◆◆◆ — — — — — — — — 【留学教育】留学归国服务中心 — — — — — -◆◆◆◆◆
【主营项目】
一.毕业证【微信：176555708】成绩单、使馆认证、教育部认证、雅思托福成绩单、学生卡等！
二.真实使馆公证(即留学回国人员证明,不成功不收费)
三.真实教育部学历学位认证（教育部存档！教育部留服网站永久可查）
四.办理各国各大学文凭(一对一专业服务,可全程监控跟踪进度)
如果您处于以下几种情况：
◇在校期间，因各种原因未能顺利毕业……拿不到官方毕业证【微信：176555708】
◇面对父母的压力，希望尽快拿到；
◇不清楚认证流程以及材料该如何准备；
◇回国时间很长，忘记办理；
◇回国马上就要找工作，办给用人单位看；
◇企事业单位必须要求办理的
◇需要报考公务员、购买免税车、落转户口
◇申请留学生创业基金
留信网认证的作用:
1:该专业认证可证明留学生真实身份
2:同时对留学生所学专业登记给予评定
3:国家专业人才认证中心颁发入库证书
4:这个认证书并且可以归档倒地方
5:凡事获得留信网入网的信息将会逐步更新到个人身份内，将在公安局网内查询个人身份证信息后，同步读取人才网入库信息
6:个人职称评审加20分
7:个人信誉贷款加10分→ 【关于价格问题（保证一手价格）
8:在国家人才网主办的国家网络招聘大会中纳入资料，供国家高端企业选择人才
选择实体注册公司办理，更放心，更安全！我们的承诺：可来公司面谈，可签订合同，会陪同客户一起到教育部认证窗口递交认证材料，客户在教育部官方认证查询网站查询到认证通过结果后付款，不成功不收费！
我们所定的价格是非常合理的，而且我们现在做得单子大多数都是代理和回头客户介绍的所以一般现在有新的单子 我给客户的都是第一手的代理价格，因为我想坦诚对待大家 不想跟大家在价格方面浪费时间
对于老客户或者被老客户介绍过来的朋友，我们都会适当给一些优惠。
学历顾问：微信：176555708
HijackLoader Evolution: Interactive Process Hollowing
CrowdStrike researchers have identified a HijackLoader (aka IDAT Loader) sample that employs sophisticated evasion techniques to enhance the complexity of the threat. HijackLoader, an increasingly popular tool among adversaries for deploying additional payloads and tooling, continues to evolve as its developers experiment and enhance its capabilities.
In their analysis of a recent HijackLoader sample, CrowdStrike researchers discovered new techniques designed to increase the defense evasion capabilities of the loader. The malware developer used a standard process hollowing technique coupled with an additional trigger that was activated by the parent process writing to a pipe. This new approach, called "Interactive Process Hollowing", has the potential to make defense evasion stealthier.
快速办理(新加坡SMU毕业证书)新加坡管理大学毕业证文凭证书一模一样
学校原件一模一样【微信：741003700 】《(新加坡SMU毕业证书)新加坡管理大学毕业证文凭证书》【微信：741003700 】学位证，留信认证（真实可查，永久存档）原件一模一样纸张工艺/offer、雅思、外壳等材料/诚信可靠,可直接看成品样本，帮您解决无法毕业带来的各种难题！外壳，原版制作，诚信可靠，可直接看成品样本。行业标杆！精益求精，诚心合作，真诚制作！多年品质 ,按需精细制作，24小时接单,全套进口原装设备。十五年致力于帮助留学生解决难题，包您满意。
本公司拥有海外各大学样板无数，能完美还原。
1:1完美还原海外各大学毕业材料上的工艺：水印，阴影底纹，钢印LOGO烫金烫银，LOGO烫金烫银复合重叠。文字图案浮雕、激光镭射、紫外荧光、温感、复印防伪等防伪工艺。材料咨询办理、认证咨询办理请加学历顾问Q/微741003700
【主营项目】
一.毕业证【q微741003700】成绩单、使馆认证、教育部认证、雅思托福成绩单、学生卡等！
二.真实使馆公证(即留学回国人员证明,不成功不收费)
三.真实教育部学历学位认证（教育部存档！教育部留服网站永久可查）
四.办理各国各大学文凭(一对一专业服务,可全程监控跟踪进度)
如果您处于以下几种情况：
◇在校期间，因各种原因未能顺利毕业……拿不到官方毕业证【q/微741003700】
◇面对父母的压力，希望尽快拿到；
◇不清楚认证流程以及材料该如何准备；
◇回国时间很长，忘记办理；
◇回国马上就要找工作，办给用人单位看；
◇企事业单位必须要求办理的
◇需要报考公务员、购买免税车、落转户口
◇申请留学生创业基金
留信网认证的作用:
1:该专业认证可证明留学生真实身份
2:同时对留学生所学专业登记给予评定
3:国家专业人才认证中心颁发入库证书
4:这个认证书并且可以归档倒地方
5:凡事获得留信网入网的信息将会逐步更新到个人身份内，将在公安局网内查询个人身份证信息后，同步读取人才网入库信息
6:个人职称评审加20分
7:个人信誉贷款加10分
8:在国家人才网主办的国家网络招聘大会中纳入资料，供国家高端企业选择人才
Recently uploaded (16)
HijackLoader Evolution: Interactive Process Hollowing
HijackLoader Evolution: Interactive Process Hollowing
Why monitoring is an analytics problem
- 1. SignalFx Microservices and Devs in Charge: Why Monitoring is an Analytics Problem
- 2. SignalFx Microservices and Devs in Charge: Why Monitoring is an Analytics Problem Phillip Liu phillip@signalfx.com @SignalFx - signalfx.com
- 3. Agenda • My background • Microservices, a review • Analytics approach to monitoring • Code push side effects, an example • Summary
- 5. Experience [2013 - ] SignalFx - Founder, CTO, Software Engineer Microservices; Monitoring using Analytics [2008 - 2012] Facebook - Software Engineer, Software Architect Hyperscale SOA; Monitoring using Nagios, Ganglia, and in-house Analytics [2004 - 2008] Opsware - Chief Architect, Software Engineer Monolithic Architecture; Monitoring using Ganglia, Nagios, Splunk [2000 - 2004] Loudcloud - Software Engineer LAMP, Application Server; Monitoring using SNMP, Ganglia, NetCool [1998 - 2000] Marimba - Software Engineer Client / Server; Monitoring using SNMP, FreshWater Software [ … ]
- 7. A Microservices Definition Loosely coupled service oriented architecture with bounded context. Adrian Cockcroft
- 8. SignalFx’s Microservices More than 15 internal services. Spanning hundreds of instances. Across 3 AZs. Have dependencies on tens of external services.
- 9. Monitoring Challenges • High iteration rate leads to shortened test cycles • Integration test combinations are intractable • Catch problems during rolling deployments • Identify upstream/downstream side effects • e.g. backpressure • Identify brownouts before the customer • etc.
- 10. SignalFx Analytics Approach to Monitoring
- 11. Measure
- 12. Store
- 13. Analyze
- 14. Detect
- 16. Monitoring at SignalFx •We use SignalFx to monitor SignalFx •CollectD for OS and Docker metrics on all VMs •Yammer metrics for all Java app servers •Custom logger to count exception types •All metrics are sent to an analytics service •Each service deploy a their cadence •Push lab, then canary in prod, then rest of tier
- 17. Code Push Side Effects
- 18. Code Push Side Effects Push canary instance and Metadata API dashboard shows healthy tier.
- 19. Code Push Side Effects However, upstream UI dashboard showed unusual # of timeouts.
- 20. Code Push Side Effects In search of root cause. Always safe to start by looking at exception counts. Can’t derive much from all the noise.
- 21. Code Push Side Effects Sum the # of exceptions to create a single signal.
- 22. Code Push Side Effects Compare sum with time-shifted sum from a day ago.
- 23. Code Push Side Effects Look at an outlier host - an Analytics service host.
- 24. Code Push Side Effects java.io.InvalidObjectException: enum constant MURMUR128_MITZ_64 does not exist in class com.google.common.hash.BloomFilterStrategies at java.io.ObjectInputStream.readEnum(ObjectInputStream.java:1743) ~[na: 1.7.0_79] at java.io.ObjectInputStream.readObject0(ObjectInputStream.java:1347) ~[na:1.7.0_79] at java.io.ObjectInputStream.defaultReadFields(ObjectInputStream.java: 1990) ~[na:1.7.0_79] … Looking at Analytic’s logs revealed source of the problem.
- 25. Code Push Side Effects • Analytics across multiple microservices reduced time to identify problem. From push to resolution was ~15min • Service instrumentation helped narrowed down root cause • Discovery allowed us to create a detector using analytics to notify similar problems in the future
- 26. Other Examples • A customer started dropping data because they reverted to an unsupported API • Compare tsdb write throughput of two different write strategies • Create per-service capacity reports • Identify memory usage patterns across our Analytics service • Create a detector for every previously uncaught error conditions - postmortem output
- 27. SignalFx Summary
- 28. • Measure and Store as much metrics and events as possible • Use data analytics techniques to • Identify problems • Chase down root cause • Create analytics based detectors to notify you of recurrence
- 29. SignalFx Thank You! Phillip Liu phillip@signalfx.com WE’RE HIRING jobs@signalfx.com @SignalFx - signalfx.com