►
Description
Join us for Kubernetes Forums Seoul, Sydney, Bengaluru and Delhi - learn more at kubecon.io
Don't miss KubeCon + CloudNativeCon 2020 events in Amsterdam March 30 - April 2, Shanghai July 28-30 and Boston November 17-20! Learn more at kubecon.io. The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects
How the Department of Defense Moved to Kubernetes and Istio - Nicolas Chaillan, Department of Defense
This session will showcase the DoD Enterprise DevSecOps initiative and its architecture. It describes how the Department of Defense is securing OCI compliant containers, moving to Kubernetes and Istio, ensuring abstraction and scale across hundreds of environments, including Clouds, on-premise and classified environments. It will particularly focus on the sidecar security stack leveraging Envoy and sidecar containers to ensure zero trust security and baked-in multi-layer security.
https://sched.co/UaZK
A
A
Sixteen
months
now
that
I
joined
the
Department
of
Defense,
and
in
case
you
don't
understand
my
French
accent,
we
don't
have
subtitles
so,
hopefully
you're
going
to
be
able
to
follow
on
the
screen,
what
I'm
saying,
but
that
tells
you
the
lack
of
talent
we
have
in
the
Department
of
Defense
and
we
need
Americans
to
help
and
join
us.
So
please
come
work
for
us,
so
I'm,
the
chief
software
officer
of
the
FDA
Air
Force,
but
I'm
also
the
DoD
and
price
deficit.
A
Appreciative
co-lead
with
the
CIO
of
the
DoD
CIO,
so
we're
pushing
deaf
sack
ups
for
the
entire
Department
of
Defense,
and
that
happened
in
16
months.
So
we'll
show
you
a
little
bit
of
of
what
we've
been
doing
but
I'm
gonna.
Ask
you
a
question.
First
I
guess:
I
can
walk
here.
We
go
I'm
gonna
stay
here,
a
little
question
for
show
of
hands
who
has
put
Q
manatees
on
a
fire
of
jet
before.
A
Okay,
who
has
path
Q
babies
on
the
plane,
few
more
hands?
What
about
a
ship
exciting?
So
I
guess
for
the
rest
of
you
guys.
You're
gonna
see
a
little
bit
about
what
we've
been
doing
on
the
final
jet.
We're
gonna
show
you
today
that
we
have
put
communities
on
f-16
and
how
that
happened.
But
first
I'm
gonna
show
you
a
little
bit
about
the
problem
and
what
we
were
facing
in
DoD
when
I
started,
which
is
really
initially
focused
on
waterfall
right.
A
So
we
have
teams
using
waterfall
dod-wide,
not
using
agile,
with
a
software
delivery
every
three
to
ten
years.
That's
obviously
a
very
slow
pace
with
the
process
too
accurate,
it's
software
that
can
take
anywhere
from
three
months
to
a
year.
So
you
have
a
very
slow
manual
process
to
accredited
software
with
manual
testing
manual
security
gates
and
that's
obviously
not
what
we
want
in
a
in
a
traditional
ccd
pipeline.
A
On
top
of
that,
we
have
massive
teams,
massive
programs
with
a
lot
of
people
and
our
corners
with
a
Dib
which
are
the
contractors
and
vandals
are
mostly
using
waterfowl.
Don't
really
understand
that
scale
or
gel,
which
is
19
years
old,
let
alone
DevOps,
which
is
10
years
old.
So
that's,
obviously
a
big
impediment
to
moving
faster
and
bringing
modern
software
best
practices.
So
on
top
of
that
you
had
a
lack
of
talent,
IT,
Enterprise,
Services
cloud
access
and
high-speed
Internet.
Even
DNS
can
be
a
problem
for
us
at
scale.
A
A
That's
the
defense
acquisition
lifecycle
management,
so
I
wanted
to
show
you
every
little
box
and
we're
going
to
go
over
every
little
box
here.
I'm
gonna
spend
a
if
you
have
a
month.
We
can
go
and
talk
about
each
box
here,
but
I.
Don't
think
I'm
gonna
do
that
right
now,
but
just
to
show
you
kind
of
the
current
model,
which
is
absolutely
not
broken
and
what
server.
A
So
that's
what
we
created
the
Duty
Enterprise
def
Cyclops
initiative,
and
what
I'm
excited
about
is
that
the
entire
stack
is
open
source
and
publicly
accessible.
Anyone
can
go
and
consume.
Our
hardened
containers
can
use
our
infrastructure
as
code
and
avoid
vendor
lock-in
because
we
picked
cube.
Indies
and
OC
I
complain,
containers
mostly
one
for
the
abstraction
two
to
avoid
vendor
lock-in
at
the
infrastructure
layer
at
the
platform
layer
and
really
bring
rapid
prototyping
to
life.
As
you
can
see,
we
created
the
centralized
artifact
repo.
That's
where
we
can
put
our
hardened
containers.
A
We
are
walking
on
170
containers
to
re-check
the
supply
chain
make
sure
they
are
as
secure
by
default
as
possible.
Nothing
on
that
hardening
is
really
dirty
secret.
Sauce,
so
any
company
can
really
use
that
it's
pretty
exciting,
because
it's
it's
stepping
up
the
game
when
it
comes
to
baked
insecurity
and
default
settings
that
are
already
kind
of
following
best
practices.
A
On
top
of
that,
so
you
see
the
two
links
here:
the
the
repo,
the
sous
cadre
post.
You
have
full
access
to
the
source
code
and
then
you
can
also
go
to
the
decal
repo,
which
is
the
binary
side,
and
you
can
open
an
account
and
get
access
to
the
binaries
as
well,
which
are
signed.
So
we
can
trust
the
containers
as
well.
What's
pretty
interesting
as
well?
Is
we
have
that
baked
in
security?
A
0Co
trust
stack
with
East
Joe,
so
we
picked
these
two
as
well
to
make
sure
we
could
have
a
zero
trust
onto
the
container
layer
and
we
also
use
K
native.
So
we
have
East
you
with
n
boy
as
well
down
to
the
function
layer
to
be
able
to
whitelist
access,
of
course,
blacklist
by
default,
denial
and
whitelist,
which
container
can't
which
container
very
important
for
us
to
reduce
the
attack
surface
and
be
able
to
to
mitigate
threats.
A
On
top
of
that,
you
had
kind
of
the
the
key
native
aspect
to
be
able
to
do
several
s
again.
We
don't
want
to
be
locked
into
any
club
provider.
You
have
to
remember
for
the
DoD,
we
have
classified
clouds,
we
have
environments
that
are
disconnected
and
deployed
at
you
know
different
scale.
So
if
you're
putting
committees
on
the
jet,
you
don't
have
time
as
an
API
or
the
Google.
Api
is
right
to
be
able
to
orchestrate
the
stack.
A
So
you
want
to
be
able
to
bring
everything
with
you
and
be
in
a
disconnected
mode,
which
is
much
harder
than
anything
else
right,
because
we're
very
used
to
updating
using
internet
and
having
connectivity
to
Internet
getting
the
dates
directly
from
Internet
right.
So
for
us
we
have
to
bring
the
entire
stack
with
us
and
really
do
that
in
a
than
in
a
disconnected
mode
right
with
no
internet.
We
also
use
OPA
or
the
open
policy
agents.
We
have
a
few
custom
policies.
A
A
That
was
a
big
win
for
the
department,
the
cloud
one
team
and
the
platform,
one
team,
so
cloud
one
is
really
the
infrastructure
team
bringing
compute,
storage
and
baked
in
cyber,
and
then
you
add
the
platform,
one
team
that
can
bring
a
CI
CD
pipeline,
the
QA
nice
cluster
and
everything
for
us
is
container,
is
running,
so
the
CI
CD
pipeline
itself
is
containerized.
Of
course,
we
had
also
to
bring
kind
of
that
training
at
scale.
A
We
have
a
hundred
thousand
people,
we
have
to
train,
so
you
can
imagine
the
complexity
of
training,
a
hundred
thousand
people,
and
we
want
to
do
it
in
a
self
paced
environment
self
training
model
where
they
can
go
to
to
a
tool,
be
able
to
watch
the
the
curriculums
from
commercial
companies
and
have
access
to
a
cloud
to
put
it
into
practice
and
not
just
learning
a
vacuum.
So
a
very
big
win
for
us
to
do
a
few
pilots
to
get
feedback
on
on
a
self-learning
capability.
That's
not
too
opinionated
to
a
qHD
stroke.
A
A
A
So
that's
just
an
example
of
a
pipeline.
For
us
everything
runs
on
humanity's
everything
is
containerize
using
the
hardened
containers.
We
don't
believe
in
one-size-fits-all
approach,
so
we
give
freedom
to
the
team
to
swap
you
know,
containers
for
us.
It's
kind
of
Lego
blocks
to
be
able
to
swap
between
products.
So
if
someone
likes,
you
know
sonarqube
better
than
45
or
checkmarks,
they
can
pick
same
concept.
For
you
know:
programming
languages,
we
support
16
programming,
languages,
23
databases,
so
that
reopens
the
door
to
picking
the
best
tool
to
get
the
job
done.
A
So
you
can
see
we
cover
every
aspect
of
of
the
lifecycle
to
make
sure
we
can
take
it
all
the
way
from
planning
to
to
continuous
monitoring,
which
is
really
the
corner
piece
for
us
of
that
set
ups.
A
lot
of
people
ask
us
why
we
use
dev
sack
ups
and
our
DevOps.
The
sack
for
us-
it's
not
just
we're
gonna-
do
some
static,
dynamic
crisis.
It's
really
the
country's
monitoring
side,
with
behavior
detection,
zero
trusts,
reducing
the
attack
surface
by
default
and
really
automating
that
so
the
development
teams
don't
have
to
think
about
it.
A
A
So
when
you
look
at
that
cycle,
continuous
agree
stack,
that's
how
we
called
it,
but
there's
a
few
things
you
know
for
the
technical
guys
here
that
are
not
psycho
I
get
it
could
be
demonstrates,
could
be
other
stuff,
but
we
call
it
the
cycle
to
keep
it
simple
for
the
people
in
the
Pentagon,
so
they
can
understand
what
we're
talking
about
more
or
less.
So.
In
this
case,
we
have
multiple
layers
right.
A
We
have
the
zero
trust
stack
using
East
geode
onto
the
container
or
the
function
layer
with
canid,
okay
native,
and
then
we
wanted
to
have.
You
can
think
of
the
DoD
having
thousands
of
cluster
right,
because
we
don't
have
a
big
cluster.
We
have
just
a
lot
of
small
clusters
right
each
weapon
system.
Each
system
is
business
system.
Cyber
offense
defense
system
is
going
to
have
their
own
little
cluster
at
different
classification
levels
right,
so
we
need
to
be
able
to
video
to
make
the
process.
A
A
Hence,
even
though
I
wear
a
suit,
I
have
socks,
pretty
cool
socks,
trendy
trendy
socks,
so
efk,
and
then
you
add,
on
top
of
that,
the
continue
scanning,
alerting
and,
of
course,
a
behavioral
detection.
For
us,
it's
not
just
scanning
of
CVS.
You
find
a
lot
of
products
today
on
the
container
scanning
side
that
I'll
focus
on
CBS,
which
is
great,
but
that's
really
not
enough.
A
Now
we're
going
to
start
showing
you
a
little
bit
of
the
f16
stuff.
So
first
you
know
the
the
team
built
pretty
cool
I
have
to
say
simulators
right.
So
if
you
look
at
this,
it's
kind
of
a
giant
earth
looking
bubble
thing
and
yes,
earth
is
not
flat,
I'm,
sorry,
so
it's
a
bubble,
kind
of
thing
right
and
if
they
have
like
projection
things
and
the
picture
on
the
left,
even
though
I
mean
you
can
barely
tell
whether
this
is
not
a
real
view
from
the
jet
right.
This
is
actually
all
inside
that
simulator.
A
Where
we
can
have
pilots
sit
and
play
with
a
software
updates
and
all
that
that's
pretty
cool
stuff,
but
then
I
went
to
the
team
called
Sony
cube,
cube,
cube
a
nice
sunny,
cube
so
Nick,
whatever
I
just
want
to
make
sure
they
understand
so
Sony
cube.
Is
that
team
that
I
went
to
them
and
said
you
know,
can
you
put
humanities
in
45
days
on
the
jet,
and
so
here
here's
what
happened.
B
B
Some
of
the
difficulties
putting
kubernetes
on
a
jet
so
far
have
been
mostly
along
the
lines
of
learning
and
understanding
the
ecosystem.
All
the
other
parts
and
pieces
that
are
necessary
to
secure
and
provide
visibility
for
what's
happening
have
been
a
struggle,
but
as
we
learn
and
continue
to
grow
in
knowledge,
those
sort
of
concerns
have
become
almost
second
nature,
and
it's
been
really
amazing
to
see
the
growth
in
capability
that
we're
now
able
to
just
put
together
rapidly,
knowing
the
the
building
blocks.
D
B
D
E
A
This
is
kind
of
what
it
looks
like
you
can
see
the
jet
behind
all
the
people
in
front
of
the
Jets
kind
of
blocking
the
view,
and
fortunately,
but
you
can
see
that
we-
we
have
a
screen
on
the
left
side
here
and
the
screen
is
really
a
mural
donut
on
the
top
screen.
So
we
can
see
better
for
the
picture,
but
really
it's
on
the
jet.
It's
running
East,
geo
and
humanity's
on
the
jet,
and
we
did
not
have
to
change
the
legacy
hardware
right.
So
this
is
all
running
on
the
legacy
hardware.
A
In
45
days,
the
point
for
the
team
was
ready
to
demonstrate
that
one
it
could
be
done,
but
to
also
benefit
from
the
flexibility
of
running
micro
services
and
bringing
new
containers
could
be
AI
machine
learning
capabilities
where
you
need
to
react
to
to
some
events,
and
you
also
need
to
be
able
to
be
resilient.
In
terms
of
you
know,
software
crashing
or
something
going
wrong.
So
for
us
that
that
kind
of
flexibility
was
really
critical
and
that's
why
we
we've
been
pushing
that
abstraction
layer.
A
So
of
course,
there's
always
a
hard
way
in
the
loop
test
for
us,
because
we
want
to
demonstrate
that
it's
gonna
behave
the
same
way
on
the
jet,
but
it's
pretty
exciting
to
see
that
you
can
emulate
and
automate
as
much
as
possible
both
on
the
cyber
scanning
side
and
the
testing
side
as
well.
So
if
Cubana
DS
is
good
enough
for
duty
weapon
systems,
it's
pretty
good
enough
for
your
business,
so
join
us.
A
A
F
Any
of
the
great
presentation,
two
questions,
one
is
synthesis
in
UD.
You
Tod,
assume
very
high.
They
clarified
in
the
environment.
Do
you
have
to
comply
with
a
bedroom?
Were
socks
in
that
way
before
you
can
deploy
so
that
first
question.
The
second
question
is:
what's
your
support
model,
do
you
live
around
the
community
or
you
work
with
any?
You
know
company
just
in
case
something
goes
wrong.
Yeah.
A
So
in
term
of
FedRAMP
FedRAMP
is
really
necessary
when
we
buy
something
as
a
SAS
or
passport
lock.
That's
why?
If
companies
have
a
cool
cap
ability,
if
they
give
it
to
us
as
a
container,
we
can
equate
the
container
and
run
it
inside
our
environment.
They
can
still
sell
the
managed
service
and
we
pay
per
use
and
all
that.
But
as
long
as
you
give
it
to
us
as
a
container,
we
can
accredit
it.
A
So
you
don't
have
to
go
through
FedRAMP,
which
can
take
a
year
and
quite
a
bit
of
pain,
so
FedRAMP
is
also
live
because
we
can
go
higher
to
unclassified
clouds
and
for
sure
for
us
all.
These
systems
are
going
to
classified
environment,
so
very
important
that
we
have
it
as
a
container
and
bring
it
with
us.
So
if
you
have
a
cool
cuts,
open-source
software
that
you're
supporting
as
a
company
giving
it
to
us
as
a
container
is
the
particular.
And
so
yes,
we
work
with
a
lot
of
companies.
A
We
have
about
25
companies
on
the
repo
commercial
tools.
Open-Source
tools,
like
you,
know
the
gate
labs
the
the
OpenShift,
the
PKS,
whether
it's
a
it's
a
kaveri
distro,
or
whether
it's
a
it's
a
container
kind
of
product,
whether
it's
it's
a
source
code,
repo,
whether
it's
a
cyber
scanning
tool,
any
kind
of
tool
can
be
accredited
by
us
and
we
cannot
create
Duty
wide.
So
that
gives
you
access
to
the
entire
Department
of
Defense
and
many
federal
agencies
also
using
the
containers.
So
you
get
access
to
DHS
and
DOJ
and
other
agencies
as
well.
A
G
Great
hey
grant
was
replicated
so
you
know
kind
of
more
on
this
topic,
you
know,
I
think
be
seeing
kubernetes
run
in
the
jet
is
really
quite
a
useful
and
interesting
example,
but
you
know
more
to
this
like.
Where
else
are
you
running
kubernetes
and
data
centers,
we're
using
it
to
power?
You
know
all
the
like
sort
of
normal
business
activities
that
the
air
force
is
doing.
Yeah.
A
That's
been,
of
course,
the
large
focus.
That's
you
know
the
jet
is
interesting,
but
it's
it's
a
tiny
piece
of
the
rest
of
the
work
we're
doing.
We
have
a
lot
of
business
systems,
moving
to
cloud
native
environments,
moving
to
micro
services
being
rebuilt
right
from
the
get-go,
so
a
lot
of
the
committees
cluster
is,
of
course,
for
the
backend
side
and
AI
machine
learning
capabilities
as
well
great.
A
Both
you
know,
we
believe
in
the
importance
of
being
able
to
walk
on
the
unclassified
and
push
it
up
right
and
so
being
able
to
have
that
end
class
environment.
What
you
can
bring
stuff
or
maintain
that
and
do
your
work,
it's
critical
for
us
and
then
you
know
pushing
it
up.
So
we
have
every
every
layer,
great.
C
A
I
think
you
know
we
wanted
to
move
fast,
we're
going
to
partly
supporting
at
least
two
or
three
different
static
meshes
on
the
long
run.
So
we
wanted
to
stop
somewhere.
You
know,
I,
think
any
boy
is
clearly
a
winner
when
it
comes
to
the
proxy
side:
east
geo
until
he's
part
of
the
CNC
F
or
something
like
that
is
still
debatable
right
and
so
for
us.
We
wanted
to
give
it
a
shot
and
put
it
to
tests
and
move
fast.
A
H
A
Yes,
so
the
the
pipeline,
you
know
we're
trying
to
do
as
much
as
we
can
on
the
unclassified
side
and
bring
it
up
and
often
you
know
what
specify
these
settings
or
configuration
settings
so
that
usually
is
kind
of
a
config
file.
Yeah
Mel,
you
know
at
the
end
of
the
pipeline
that
is
brought
you
know.
So
we
have
like
fake
data
right
and
fake
config
settings
on
the
end
class
site
to
do
as
much
as
we
can
on
the
in-class
side.
A
But
again
some
systems
also
the
agar-agar
is
amol
classified
and
that's
a
little
bit
harder.
So
we're
trying
to
bring
the
same
CCD
pipeline
to
all
the
classification
levels,
but
we're
trying
to
do
as
much
as
we
can
on
the
N
class
side
and
that's
why
you
know
we
use
the
containers
to
in
the
CD
pipeline.
So
there's
no
drift
between
environments
right,
so
you
can
think
of
and
class
having.
You
know
dev
test
staging
prod,
but
then
you
have
the
same
thing
on
secret,
TS
and
so
on
right,
so
that
complexify,
the
the.
A
If
you
had
to
maintain
these
CI
CD
pipeline
without
containers,
it
would
be
a
disaster
of
drifts
and
you
know
different
tools
with
different
versions,
so
very
important
that
we
pre
containers
for
that,
and
you
know
the
developer.
Experience
is
just
like
you
will
see
on
inside
any
company.
On
the
N
class
side
it
gets
a
little
bit
more
tricky
on
the
classified
environment
because
you
have
no
internets.
You
have
to
bring
stuff
with
you
from
the
N
class,
but
we're
trying
to
make
the
push
up
right.
A
I
I
A
I
I
think
it's
gonna
be
a
case-by-case.
You
know
program,
but
there's
no
plan
on
switching
until
until
we
get
to
the
real
scale,
you
know,
I
think
it
was
still
learning
very
fast.
A
lot
of
things
are
changing
and
each
team
is
allowed
to
make
their
own
decision
right.
So
we're
not
Monday
centrally.
These
kind
of
decisions
at
the
Air
Force
level
is
down
like
per
per
team
level.
J
A
So
I
mean
that's,
that's
a
20-hour
discussion
but
I
think
on
the
on
the
on
the
simple
side.
The
key
for
us
is
to
have
systems
where
you
know
federated
cluster
is
is
tough
for
us
because
of
classification,
you
know,
and
also
because
of
age.
You
know
what
have
data
if
one
cluster
get
hacked,
you
want
to
be
able
to
laterally
move
into
other
clusters.
A
You
know
so
we're
trying
to
really
reduce
the
attack
surface,
and
so
you
know
the
HP's,
for
us
is
like
more
hardware
when
it's
disconnected
it's
gonna
be
more
hardware,
so
we
can
have
redundancy
on
the
hardware
and
more
cluster
or
small
nodes.
You
know
both
on
the
control
plane
and
the
the
nodes
side
and
the
rest
is
getting.
You
know
more
and
more
complex
per
pair
program.
So
it's
tough
for
me
to
answer
the
question
so.
K
A
Think
a
lot
of
the
work
done
on
the
Coverity
side
is
not
very
well
designed
for
these
connected
environments.
You
know
I,
think
a
lot
of
it
is
supposed
to
be
on
cloud
public
clouds
and
using
cloud
API.
Is
it's
not
doing
always
a
good
job
when
it
comes
to
being
disconnected
and
being
agnostic,
I
feel
the
more
we
become
opinionated
in
term
of
the
stack
and
all
these
communities
distributions
now
I
think
we
have
90
now
on
the
CNC
F
certified
lists,
including
quite
a
few
that
are
from
China,
which
obviously
we
cannot
use.
L
A
So
it
enables
team
to
grow
and
so
I
think
it's
doing
a
pretty
good
job.
At
listing
all
the
steps,
both
in
terms
of
the
basic
static,
dynamic
analysis,
side
and
the
more
complex
you
know:
Contino
security
behavior.
You
know
zero
trust
for
pushing
both
at
the
endpoint
to
the
all
the
way
to
the
the
cluster
and
really
get
making
sure
that
no
one
is
getting
access
to
that
cluster.
Okay,.
A
What
we
like
about
envoy
first,
you
know
it's,
it's
open
source
and
there's
a
pretty
broad
community
and
it's
being
adopted
by
most
of
the
big
players.
So
that's
always
giving
us
reassurance
that
it's
something
that
we
can
use
when
you
start
having
companies
vetting
the
entire
stack
on
on
envoi.
That's
really
a
good
sign
that
it's
something
that's
going
to
be
supported
for
a
long
time,
so
envoi
is
also
supporting
a
lot
of
features,
even
though
we
want
to
kind
of
push
the
envelope
when
it
comes
to
new
capabilities
like
UDP.
A
A
N
A
We're
walking
on
it,
you
know
we
have
a
lot
of
partners
that
contribute
back,
whether
it's
a
VMware
or
Red
Hat.
So
often
we're
going
to
go
through
our
partners,
because
it's
easier,
they
already
contribute
back
and
it's
an
easier
process
and
for
the
DoD,
but
we
were
trying
to
do
better.
That's
why
the
repo
is
open.
People
can
come
and
do
pull
requests
and
really
walk
with
us,
and
we
of
course
anytime.
We
find
something
whether
it's
on
East
you
or
cube
a
days.
A
I
think
it's
getting
better,
you
know.
First,
we
have
it
Monday
in
duty
to
be
able
to
publish
20%
of
our
software
open
tools,
that's
not
classified,
which
is
already
hard
to
do,
because
it's
not
just
about
making
it
open
source
is
sustaining
it
and
making
sure
there
is
a
community
behind
it.
As
you
know,
if
it's
just
a
stale
project,
it
doesn't
bring
any
value
to
the
Oh
community.
So
one
is
we
want
to
do
right
by
the
community
and
have
real
teams
behind
the
the
projects.
A
That's
why
the
the
container
stack
for
us
and
the
hardening
of
containers
is
something
where
we're
spending
quite
a
bit
of
money
to
sustain
and
continuously
update
the
containers
and
making
sure
we
we
keep
track
of
that
and
really
the
cultural
shift,
pretty
obvious.
I.
Think
security
by
efficient
is
just
not
gonna.
Work.
I.
Think
people
start
to
understand
that,
after
you
put
a
system
into
the
hands
of
a
hacker
at
DEFCON
and
they
get
in
into
15
minutes
or
ten
minutes
or
five
minutes,
even
though
they
knew
nothing
about
it.
A
You
know
prior
to
accessing
it.
That's
usually
good
evidence
that
office
keishon
is
not
good
enough
and
open
source
actually,
but
a
lot
of
eyes
on
code
and
making
sure
that
we
actually
pay
attention
to
the
beauty
of
the
code
as
well
so
very
important
to
DoD
today
to
to
have
that
also
stack.
That's
now
locked
into
one
company.
P
Hi,
thank
you
for
the
talk
Jory
Morrison
for
mitre
I'm.
Seeing
a
lot
I
know
we
all
are
seeing
a
lot
of
agile
devops
transformations
across
the
DoD
right
now
and
so
I'm
wondering
how
you
plan
to
make
these
service
offerings
available,
more
broadly,
outside
of
small
sections
of
the
Air
Force
and
across
the
entire
DoD,
and
also
the
second
part
of
that
question.
What
is
the
point
of
convergence
between
this
initiative
and
other
initiatives?
We're
going
on
right
now,
like
castle
run
that
have
a
tremendous
amount
of
momentum,
but
maybe
have
slightly
different
approaches.
P
A
A
Obviously,
Cass,
Aaron
and
and
the
entire
force
has
different.
You
know,
teams
working
on
software
cuz.
Everyone
is
moving
to
the
same
stack
than
we
are.
They
started.
You
know
pretty
early,
they
learn
a
lot.
They
brought
a
ton
about
you
I
think
we
would
not
have
been
able
to
do
what
we're
doing
now
without
castle
run
right.
They
they
kind
of
opened
the
the
culture
shift
and
they
demonstrated
that
you
can
get
it
done,
but
now
we're
moving
to
the
enterprise
right.
That's
broader
scale.
A
In
fact
the
Air
Force
is
supporting
all
of
the
Ori,
not
just
the
Air
Force
right,
so
the
Navy,
the
army,
as
well
and
so
cloud
one
and
from
one
all
kind
of
the
two
team
will
be
able
to
bring
a
dev
psych
ops
pipeline
in
a
week
with
an
ATO
right
and
that's
kind
of
the
goal
for
us
is
to
have
that
enterprise
capability
that
that
anyone
can
go
and
leverage
without
having
to
rebuild
all
these
of
these
tacks.
So
you
know
we
have
a
full
briefed
on
the
on
the
plan.
Q
With
a
lot
of
this
cloud
native
tooling,
that
you're
bringing
in
and
skills
and
people
you'll
be
bringing
in
to
support
it,
what
sort
of
process
and
people
challenges
have
you
had
to
adapt
to
such
a
closed
environment?
What
sort
of
what
so
you
cut
off
with
the
idea
in
in
a
closed
environment
like
this,
bringing
in
people
who
have
got
skills
in
these?
You
know
traditionally
connected
and
open
platforms.
A
You
know
these
days,
obviously
a
lot
of
culture
shift
that
has
to
happen
for
the
teams
to
be
able
to
even
agree
to
using
these
kind
of
technologies.
So
it's
a
it's
a
training
in
the
value
of
the
return
on
investment
on
the
abstraction
layer.
I
think
we
get,
we
get
locked
into
a
lot
of
tools
and
for
us,
it's
very
important
not
to
get
locked
in
anymore
and
to
have
these
open
source
tacks
and
be
able
to
move
to
different
products.
A
A
A
S
A
On
the
right,
we
have
the
the
complete
in
fresh
dress
code
to
spin
up
an
open
ship,
for
example,
to
gov
cloud,
with
complete
automation,
already
Stig's
already
passing
the
the
requirements.
We're
gonna
do
better
and
improve
it.
I
think
the
documentation
is
lacking
right
now,
we're
doing
go
to
find
that
information.
The
repo
link
was
on
the
slide
here
and
that's
that
link
here.
The
two
links
you
see
there
yep,
thank
you
sure,
are
we
out
of
time.
Okay,
sorry,
no.
T
Just
one
more
just
one:
okay,
four
sorry,
but
enterprises
are
struggling
with
the
adoption
of
all
of
open-source
products
and
they
have
built
in
like
very
heavy
processes
around
getting
new
software
into
regulated
industries
like
financial
health
care
and
so
on.
You
are
on
the
level
you
know
up
there
insane
kinda
stuff.
So
how
heavy
is
the
process
of
incorporating
new
products,
new
software
solutions
into
your
environment,
and
is
there
any
it's
kind
of
a
little
bit
linked
to
the
question
before?
T
A
A
Repo
you're
gonna
find
that
back
to
the
community
right
and
then
the
process
to
equity,
the
software,
the
keys
to
use
the
same
to
so
we
have
a
CCD
pipeline
to
automate
the
same
process
scanning
and
then
the
key
for
us
is
a
country's
monitoring
side
to
really
see
what's
going
on
in
run
time
because
you're
not
going
to
detect
zero
days
right,
you
can
scan
static
crisis
all
day
long
with
the
number
of
updates
of
each
open
source
stacks.
It's
gonna
take
a
long
time
to
do
that
manually
or
even
automatically.