►
From YouTube: APAC Hybrid Cloud Kopi Hour | Securing the Hybrid Cloud
Description
Looking to stay on top of the latest developments in security? Tune in to the upcoming episode of Kopi Hour, a live stream show that brings together experts from across the tech industry. We'll be discussing the latest State of Kubernetes Security report for 2023 and diving into some critical topics such as cloud security, threat detection and response, social engineering hacks, compliance with regulations, and much more.
Join Principal Specialist Solution Architect Shane Boulden, Application Platform Sales Specialist Franky Ho, and Red Hat Singapore Public Sector Chief Li Ming Tsai, for a lively conversation on the state of Hybrid Cloud Security today. There will even be live demos! Can't make it?
State of Kubernetes security report 2023: https://www.redhat.com/en/resources/state-kubernetes-security-report-2023
A
A
Out
there
welcome
back
to
another
APAC
hybrid
Cloud
copy
hour
and
just
as
a
reminder
for
those
who
have
not
joined
us
before
or
who
are
joining
us
many
times.
I
am
August.
Simonelli
I
am
a
technical
marketing
manager
at
red
hat
in
the
hybrid
platforms
business
unit-
and
this
is
the
aipac
live
stream
now
I
know
we
call
it
the
Kopi
hour
and
for
everyone
on
this
call,
they
know
who
it
is.
They
know
what
it
is,
but
I
like
to
put
this
little
reminder
up
that.
A
What
copy
is
it's,
this
wonderful
beverage
you
can
get
in
Singapore,
it's
not
a
radio
station
out
of
East
Omaha
or
anything
like
that
Kopi.
Something
like
that.
So
I
like
to
just
make
sure
we
all
know
that.
So
today
we
have
a
super
exciting
show
coming
up,
but
we
have
our
usual
co-host:
that's
Dev,
shambach
Dev!
Why
don't
you
go
ahead
and
say
g'day.
B
Hi
everyone
I'm
glad
to
be
back
on
another
episode
of
copy
hour.
My
name
is
Dev
shanbag
Consulting,
Services,
architect,
based
out
of
Melbourne
I'm,
really
excited
to
share
the
stage.
Today
we
have
some
International
guests
from
Singapore
and
our
favorite
Shane
Bolden
as
well
so
happy
to
be
part
of
this,
and
you
know
hear
from
the
experts
in
terms
of
security
and
software
supply
chain
security.
So.
A
A
Awesome,
thank
you
Deb.
So
exactly
Dev
we've
got
Today's.
Show
is
on
securing
the
hybrid
cloud
and,
as
Dev
said,
we've
pulled
together.
Some
of
our
our
best
security
people
in
the
region
and
I'll
go
ahead
and
just
do
some
introductions
we'll
go
alphabetically.
So
first
up
is
Shane.
Shane,
Bolton
Shane
go
ahead
and
say
hi.
C
Hey
everyone,
it's
Shane.
This
is
my
first
time
on
the
the
Kopi
hour,
so
I'm
a
solution
architect
in
Brisbane
in
Australia
and
I
support.
A
lot
of
kind
of
security
problem
sets.
How
do
we
pull
security
into
development?
How
do
we
secure
platforms
and
how
do
we
start
to
move
to
some
of
these
kind
of
cloud
native
security
models,
so
yeah
really
excited
for
for
today's
session?
Yes,.
D
E
Hi,
hey
hi
everyone,
and
thanks
August
and
deaf
for
inviting
me
here
right,
I'm,
living
for
Maria,
Singapore,
I'm,
the
private
sector
chief
for
Singapore
government
right
and
as
part
of
my
day-to-day
role,
I
help.
You
know,
government
agencies
Singapore,
transform
and
really
help
them
to
accelerate
the
adoption
of
container
technology
and
security
is
one
of
the
main
topics
that
you
know.
I
talk
about
day
to
day,
so
glad
to
share
my
thoughts
later
on
with
the
white
audience
and
looking
forward
to
speaking
to
you
all
later.
A
Yes,
thank
you.
So,
as
you
can
see,
we
have
a
great
group,
and
so
Dev
and
I
were
thinking
about
this
show
and
how
we
can
you
know
it's
an
obvious
topic
security,
but
it's
something
that
was
coming
up
in
our
daily
lives
right,
especially
here
in
Australia,
we
went
through
multiple
hacks
right,
we've
seen
a
bunch
of
things
going
on
where
you
know
big
providers,
telcos
Healthcare
Providers
are
seeing
data
get
leaked,
and
so
it
really
thought
I
got
us
thinking.
You
know,
how
can
we
you
know?
A
How
can
we
deal
with
this
and
I
wanted
to
get
you
guys
on
and-
and
you
know,
tell
me
a
bit
about
what
you're
seeing
out
there
I
mean
Shane
you're
here
in
Australia
you're,
seeing
it,
but
in
Taiwan
and
in
Singapore.
What
what
are
you
guys
seeing
I
mean?
Are
we
seeing
these
big
public
hacks
everywhere.
D
Yeah,
maybe
I
can
start
first
from
Hong
Kong
perspective,
I
think
it's
quite
interesting
for
the
phenomenal
till
I'm
Observer.
Regarding
the
customer
approaches
us
talking
about
Cloud
security,
because
we
know
that
is
involves
so
many
things
here.
Right,
no
matter
talking
about
technology
process,
culture
or
people
just
for
technology,
it
can
also
mean
so
many
things,
but
one
thing,
I
think
is
quite
common
for
Hong
Kong,
Enterprise
customers.
D
When
they
are
asking
for
cloud
security,
they
are
looking
for
TurnKey
run
time,
security,
okay,
two
things
here
right,
the
random
security-
why
they
are
so
put
so
much
emphasizes
that
because
they
believe
70
of
the
attacks
actually
is
coming
from
the
application
here,
and
the
other
thing
is
because
the
application
usually
is
customer
facing
and
also
is
the
business
I
mean
care
most
about
that.
So
then
this
is
the
last
line
of
defense,
or
the
first
line
of
attack
depends
on.
Where
is
your
real
point?
D
So
this
is
the
second
reason
they
why
they
so
care
about
that,
and
the
third
reason
is,
as
we
all
know
is
because
this
is
Mission.
Critical
data
is
sensitive,
so
it's
related
to
business
Revenue.
We
relate
to
the
reputation
of
the
company
and
also,
last
but
not
least,
the
customer
experience.
So
this
is
the
reason
why,
but
it
just
it,
it
doesn't
mean
that
those
customers
don't
know
or
even
don't
care
about
the
rest
of
the
security
talking
about,
for
example,
like
depth
and
offline
shift
life
secure
surface
supply
chain
right.
D
Well,
apart
from
runtime
security,
they
will
also
see.
Do
you
have
some
kind
of
TurnKey
solution?
I
think
this
is
something
that
we
would
like
to
explore
more
because
we
know
security
is
not
a
simple
switch,
turn
on
and
turned
off,
or
just
a
simple
set
of
hey
Mr
customer.
You
need
to
patch
this
or
patch
that,
but
this
is
still
still
true.
Alice
in
Hong
Kong.
That
kind
of
so-called
I
mean
the
20
solution.
A
D
Yeah
I
think,
unfortunately,
it's
not
that
common,
maybe
maybe
due
to
Chinese
culture.
We
don't
want
to
let
the
people
know
that
we
are
not
doing
good,
perhaps
because,
maybe
all
we
heard
about
once
a
year,
maybe
just
one
or
two
it's
not
coming
at
all.
But
whenever
this
happened
in
an
Enterprise
customer
when
they
approach
us,
we
can
feel
that
right
because
you
then
you
can
feel
the
anxiety.
You
can
feel
the
pressure
and
they're
really
looking
for
that
kind
of
solution,
but
I
think
it's
not
coming
in
Hong
Kong.
E
All
true,
right
and
I
think
it
really
resonates
with
what
Frankie
is
saying
right
and
especially
from
a
Singapore
government
perspective
right.
Cyber
security
has
always
been
at
the
Forefront
and
it
in
the
last
couple
of
years.
You
know
we
talked
we,
you
know
we
start
even
to
talk
about
zero
trust,
right,
zero
trial,
ZTA
and
sort
of
how
do
they
look
at
security
from
A,
New,
Perspective,
right
and
cyber
resiliency.
E
You
know,
cyber
security
has
always
been
in
the
top
of
the
mind
for
the
single
government
at
least
right,
and
the
emphasis
on
that
cannot
be
there's
a
lot
of
emphasis
on
that,
because
it's
really
about
public
services
that
the
government
offers
to
you
know
Singapore
right
to
the
citizens,
enter
the
public
right.
It's
a
public,
good,
Services
right
and
cyber
attacks
cyber
security.
You
know
if
anything
goes
wrong.
It's
it's
not
good
at
all.
Right
I
mean
sure
decent
go
down
things
like
that
right.
It's
just
bad
press
and.
F
A
C
It
almost
feels
like
there's
a
new
incident
in
the
news
every
week
at
the
moment
you
know
we've
seen
you
know
large-scale
data
exfiltration
that
impacts
Australians
and
and
their
identity,
we've
seen
kind
of
supply
chain
compromise
locally,
and
even
just
yesterday
there
was
a
a
report
from
the
Australian
cyber
security
Center.
They
released
on
kind
of
some
really
complex
malware
targeting
Australian
organizations,
so
you
know
malware.
That's
kind
of
you
know,
prolific
throughout
environments.
It's
really
difficult
to
detect.
C
A
B
Yeah
I
mean,
if
you
think
about
it
from
you,
know
the
last
few
years
point
of
view,
I
think
the
rise
in
incidents
of
you
know.
Cyber
security
attacks
has
increased
significantly
and
that
has
changed
the
conversation
from
a
customer
point
of
view,
wherein
you
know
they
initially
want
to
discuss
security
first
in
any
solution
that
we
discuss
with
them
and
that's
been,
you
know
quite
significant.
Initially,
you
know
before
the
pandemic.
It
was
more
about.
B
How
do
we
bring
optimization
or
you
know,
cost,
but
these
days
the
first
thing
and
the
priority
from
our
customers
is:
how
do
we
make
sure
you
know
everything
is
secure,
whether
it's
you
know,
data
addressed
data
in
transit,
and
you
know
these
are
some
of
the
things
that
kind
of
you
know
align
to
what
Frankie
and
Shane
and
Lee
kind
of
mentioned
right.
The
government's
thinking
about
it,
organizations
thinking
about
it,
and
it's
really
at
the
Forefront
of
all
the
discussions
that
we
have
from
a
field
point
of
view.
A
A
I'll
put
the
link
in
the
chat,
so
it's
there
and
you
find
that
here.
I'll
leave
that
up
so
I
wanted
to
just
go
through
some
of
this
and
explain
what
this
is
and
give
us
a
place
to
sort
of
launch
into
some
cool
stuff
we
can
have.
We
can
chat
with
our
guests
today
about
how
customers,
how
they're
dealing
with
this
with
customers
and
then
even
have
a
demo
and
such
so.
A
Basically,
what
this
report
is
was
a
if
it's
been
running
when
we
with
stack
rocks
and
now
Red
Hat
has
taken
on
sack
rocks.
So
it's
the
third
edition
this
year
they
surveyed
over
600,
devops
and
Security
leaders
last
year
was
300.
So
it's
a
it's.
It's
growing
and
we've
got
respondents
across
all
different
fields
and
and
Enterprises.
Now
the
report
is
it's
not
that
long.
A
It
came
out
mid-april
and
it's
you
know
20
or
30
pages,
so
I've
just
pulled
a
few
interesting
things
out
that
I
thought
we
could
kind
of
look
at
from.
You
know
the
blog,
that's
written
and
you
just
fill
out
your
details
and
you
get
it
so
it's
pretty
cool,
so
here's
some
of
the
notable
findings
that
are
worth
kind
of
calling
out.
A
C
B
A
That's
interesting
Dev,
because
that
makes
me
think
of
our
last
show
when
the
guys
were
talking
about
you
know
migrating
and
extending
clouds
multi-cloud.
It
needs
to
be
part
of
the
process.
It
can't
be
something
you
do
right.
You
look
at
this
first
statistic
that
says:
38
aren't
taking
security
seriously
or
investing
in
it
adequately.
It
shouldn't
be
an
issue
right
that
it
should
just
be
part
of
the
process.
I.
B
Like
how
Shane
defined
it
that
you
know,
developers
are
like
water
and
they'll
find
their
way
around
it,
and
you
know
it
kind
of
aligns
in
terms
of
how
organizations
want
to
move
to
the
new
ways
of
working
I.E.
You
know
Cloud
native
but
again,
I
think
in
terms
of
all
this
process,
the
difficulties
and
the
challenges
that
developers
face.
I,
guess
you
know
a
lot
of
it
has
to
be
simplified
from
a
product
point
of
view
and
I'm
really
interested
to
hear.
D
Yeah
I
just
want
to
add
a
comment
here
guys
because
he's
talking
about
the
kubernetes
Security
customer
may
they
have
some
kind
of
knowledge
regarding
for
the
cloud
security
as
a
whole,
but
down
to
kubernetes
container,
they
have
still
a
concern
whether
the
existing
I
mean
security
policy,
technical
confidence
and
control
is
enough
or
not.
So
the
simple
question
is:
are
we
really
secure
when
using
kubernetes?
So
this
is
called
some
kind
of
frustration
and
I
have
a
real
customer
here
in
in
Hong
Kong?
D
Yes,
because
this
is
a
normal
process
generation
talking
about
it's
definitely
no
matter
what
kind
of
Technologies
when
you
need
to
put
into
production
whatever
you
have
application
sort
of
thing,
you
still
need
to
pass
the
security
gains
well,
but
I
think
to
this
kubernetes.
The
infrastructure
operation
team
may
not
understand
bro
the
standard
from
the
security
team
regarding
kubernetes.
D
E
Yeah
I
think
a
lot
a
lot
of
customers
today,
at
least
from
my
perspective,
is
that,
where
is
the
middle
ground
right,
where's
the
milligram
and
what
is
what
is
just
enough
or
what
is
good
enough
from
a
security
standpoint
or
security
perspective
right,
because
they,
a
lot
of
them,
come
from
a
very
traditional
way
of
looking
at
security,
whether
it's
a
you
know,
edrs,
whether
it's
Siem,
whether
it's
antivirus
right,
but
as
they
start
a
job,
more
Cloud
native
or
container
technology.
That's
where
a
lot
of
times.
E
You
know
a
lot
of
customers
struggle
today,
because
in
the
cloud
native
world
you
know
whether
it's
kubernetes,
you
know.
Where
does
what
other
Technologies?
What
is
a
better
way?
What
is
a
more
I
would
say
more
appropriate
way
to
secure
the
systems
right
and
that's
where
you
know,
people
like
me
or
even
Frankie
or
Shane.
You
know,
will
talk
to
customers
right
to
help
them
to
look
at
this
new
tech,
Now
new
technologies.
You
know,
look
at
better
ways
to
secure
their
systems
right.
B
E
A
And
I
like
what
you
said
there,
they
they
may
not
know,
and
that's
why
I
think
Shane's
point
about
it
in
needing
to
just
be
part
of
the
process
is
so
important.
It
can't
be
something
that
they
don't
know
it
just
should
be
because
and
I
teased.
This
slide
already
I
like
this
slide.
There's
massive
consequences
right
I
mean
look
at
this.
The
one
that
really
stuck
out
here
was
Employee
termination
right.
A
So
in
the
past
12
months,
have
you
experienced
any
of
the
following
impacts
to
your
business
as
a
result
of
containers,
kubernetes
security
or
compliance
incidents
or
issues,
issues
or
incidents.
Employee
termination,
I
mean
there's
serious
consequences.
If
we
get
this
wrong,
it
is
highly
complex
systems
and
there's
you
know
it's.
You
know.
I've
got
the
the
report
here
and,
and
it's
straight
from
that
and
it's
yeah
it's
it's
very,
very
scary
that
that's
that
can
be
the
result.
C
And
I
think
it's
really
easy
to
get
to
get
caught
up
in
the
wrong
kinds
of
security,
workflows
that
that
aren't
kind
of
providing
value
into
those
processes
and
I
think
one
that
we
see
really
commonly
is
kind
of
fixating
on
vulnerabilities
and
cves
and
trying
to
achieve
like
zero
cve
in
in
production,
yeah
and
I.
Think
we
find
that
that
doesn't
work,
because
it's
it's
a
very
intensive
process
trying
to
pull
out
all
of
the
cves
from
those
those
workloads.
C
And
it's
not
focusing
on
those
that
are
important
to
the
organization
and
and
I
think
what
we've
seen
certainly
from
Red
Hat,
is
that
those
critical
cves
are
the
ones
that
are
being
targeted
in
the
wild.
So
they're
appearing
on
the
the
ciso
known,
exploited,
vulnerabilities,
catalog,
they're,
the
ones
that
are
getting
turned
around
into
scanning
Tools
in
a
number
of
hours
like
I,
think
that
is,
that
is
kind
of
high
value
security
workflows
that
that
need
to
be
incorporated.
A
E
A
People
see
whose
responsibility
it
is
right
and
it's
a
funny
spread
when
you
look
at
this,
so
whose
job
is
security,
so
these
are
devops
teams,
and
one
thing
the
the
report
did
talk
about
is
that
devops
and
devsecops
and
all
is
very
real
and
it's
happening
and
you
know,
grab
the
report,
but
the
numbers
are
looking
good.
Yet
we
still
have
results
like
this
right
so
who
what
team
is
responsible
at
stem?
It's
over
there?
A
E
Mean
I
the
way
I
look
at.
It
should
be
left
right
center.
Every
responsible
for
right,
everybody
needs
to
be
mindful
of
what
security
is
really
about
to
your
specific
domain,
or
you
know
whether
you're
in
front
guy,
whether
you're
a
network
guy,
whether
you're,
developer
or
you're,
a
devops
engineer
right
security
should
never
be
an
after-talk
right
and
you
know
I
think.
Obviously
your
earlier
slide
about
project
delay
is
also
an
important
thing
for
a
list
for
customers.
To
think
about
is
that
you
know
if
security
is
an
afterthought,
you
know
each.
E
C
I
think
I
think
we're
starting
to
see
that
you
know
creating
those
environments
that
support
security
baked
into
all
of
those
processes.
You
know
creating
guard
rails
on
platforms
so
that
it's
it's
more
difficult
to
get
outside
of
that
kind
of
of
security
boundary.
So
you
know
I,
think
I
think
it's
really
positive
to
see
how
teams
are
kind
of
supporting
each
other
now
to
to
bring
security
into
those
workflows,
yeah
and.
A
A
If
you
know,
leaming
says
everyone's
got
responsibility,
but
look
at
this
man
I
mean
look
at
all
the
different
areas
that
have
to
be
secure
and
thought
about,
and
you
know
you
know
how
to
make
it
work,
and
what's
even
crazy
here,
is
that
when
people
hit
issues
like
they
hit,
like
all
the
issues,
so
are
things
making
progress?
Is
it
a
losing
battle?
I
mean,
of
course
it's
not,
but
you
know
I
mean
like
Frankie.
When
you
see
something
like
this,
how
do
your
customers
feel?
How
do
they
feel
about
their
software
Supply
chains?
D
Yeah
I
think
it's
true
yeah.
They
would
like
to
cover
every
I
mean
security
standpoint,
but
perhaps
just
like
she
mentioned
about
the
main
security
rifle,
and
everyone
also
understand
what
the
meaning
of
everyone
is
responsible
for
security,
but
the
reality
I
think
is
it's
still
working
in
Silo,
okay,
just
like
when
you're
talking
about
devops
or
even
Dev
setups.
The
first
thing
is
not
about
the
technology.
D
It's
talking
about
whether
we
can
create
a
Cooperative
environment
and
then
we
are
live
with
I
mean
the
goal
that
we
are
trying
to
meet
in
here.
Talking
about
the
security
what
we
like
to
achieve
and
how
we
are
going
to
achieve,
then
we
can
kick
start
trying
to
explore
how
technology
can
help
no
matter
using
the
practices
like
just
like
kspm,
the
kubernetes
security
practice
posts,
the
security
approach,
chair
management
or
using
some
kind
of
tools
for
all
the
sca,
sasd,
DSD
kind
of
thing.
D
This
is
I,
think
still
the
reality
and
another
thing
I
think
it's
always
still
true.
Just
like
the
devops
teams,
or
in
here
maybe
we
use
self-op
teams.
Here
we
exploded
quite
funny
thing.
Customers
would
like
to
ask
us
from
our
experience.
What
is
that
team
I
mean
the
devil
teams
or
sell
of
Team
should
be
under
with
right,
because
we
know
that
oh,
it
should
be
coming
from
different
teams.
Joining
together
is
forming
a
little
team,
but
the
reality.
Well,
I,
don't
go
that
way.
You
won't.
D
It
won't
work,
because
we
don't
have
that
kind
of
luxury
that
kind
of
budget.
It
must
be
somehow
We
Gather
people
from
the
team,
maybe
full
time,
maybe
part-time,
and
then
it
must
be
report
to
one
of
the
existing
functional
units.
The
head
of
functional
unit,
so
give
me
some
hints
so
they'd
be
under
infrastructive
operation
team
or
the
Readiness
management
team
right.
A
Wow
yeah,
so
you
can
see
how
this
can
get
complex
and
then,
when
you
think
about
the
ways
that
things
need
to
be
protected-
and
this
is
my
last
slide
from
here-
where
we're
looking
at
what
are
the
top
security
services
security
concerns
that
these
various
people
who
are
being
pulled
in
and
thought
about
are
dealing
with
I.
Don't
think,
there's
anything
too
surprising
here,
but
it's
it's
kind
of
a
nice
split,
but
vulnerabilities
and
misconfigurations
right.
A
B
Plus
one
I
think
you
know:
that's
one
thing
that
I
want
to
hear
from
our
experts
as
well:
I
mean
when
I
think
when
I
saw
this
slide,
it
kind
of
brought
back
some
of
the
memories
in
terms
of
okay,
a
particular
you
know.
Role-Based
access
control
is
not
addressed
correctly
and
would
that
con
you
know,
constitute
as
misconfiguration.
You
know
a
code
in
of
application,
not
you
know
developed
properly.
Would
that
considering
a
misconfiguration?
How
do
we
Define
this?
You
know
how
can
it
lead
to
a
security
vulnerabilities?
E
You
look
at
misconfiguration
right
and
you
know
people
tend
to
underestimate
that
what
issues
can
misconfiguration
causes
right
because
a
lot
of
times
we
talk
about
security,
it's
all
about
cve,
it's
about
vulnerabilities,
it's
about
compliance
right,
but
when
you
look
at
you
know,
kubernetes
or
containers,
you
know
platform
in
general
right
the
configuration
of
the
platform
or
even
conclusion
of
the
application.
I
think
that's
important
right
and
then
how
do
you
then
use?
C
I
think
this
gets
really
interesting
when
you
know
when
we
start
to
look
at
Cloud
native
security,
because
we've
got
I
think
a
lot
more
flexibility
in
what
what
configuration
looks
like
for
those
workloads
so
like
a
really
a
really
common
example,
is
container
workloads
trying
to
run
as
the
root
user.
Now
we
consider
that
a
misconfigured
workload,
because
if
someone
can
access
it
access
it,
then
you
know
they've
got
a
lot
more
flexibility
in
what
they
can
do
as
an
attacker.
They
might
be
able
to
try
and
access
yeah.
E
A
A
Screen
you
can
because
I
wanna,
because
that's
what
I
was
going
to
bring
this
perfect
because
I
want
to
know.
So
how
do
you
talk
to
the
customers
about
it
right?
So
we're
we're
sitting
here
and
we're
doing
this
and
you're
saying
you
should
do
this
and
you
can
do
that.
I
want
to
see
this
so
yeah
Frankie.
Please
give
us
give
us
some
give
us
some
knowledge
here.
D
Yeah,
okay:
by
the
way,
can
you
see
my
full
screen
here?
Yes,
okay,
perfect.
Actually,
this
is
one
of
the
Ghana
report.
Talking
about
the
10
supply
chain
want
to
break
this
when
we
talk
to
customers
regarding
security,
we'll
leverage
this
as
one
of
the
Baseline
to
start
the
conversation
just
forget
about
the
number
you
try
to
derive
the
security
into
free
Parks
from
that
perspective,
because
Scarlet
predicts
that
similar,
like
a
reporter
by
2025
45
percent
of
localization,
would
experience
Securities
approaching
attack
right.
Our
report
even
earlier
I,
already
happen
now.
D
Okay,
for
this
year,
we
try
to
derive
the
security
into
three
parts
here,
meaning
that
the
first
part
is
quite
familiar
is
talking
about
the
pipeline
security.
So
that's
the
reason
we
have
that
side
now
being
here
in
the
conversation,
so
we
can
all
the
I
mean
the
bill
process
and
then
the
development
processing
here,
so
we
can
see
number
one
to
five:
are
the
other
one,
the
British
related
supply
chain?
That
may
happen
in
that
area
in
the
middle
part,
for
the
night
program
is
talking
about
the
core
security
or
recorded
platform
security.
D
Just
the
product
security
is
not
enough
to
still
make
sure
that
the
platform
is
secure.
You
have
the
never
policy,
you
should
have
the
role-based
access
control,
and
you
also
have
the
surface
mesh,
for
example,
is
one
one
part
of
it
and
you
can
see?
Is
the
right
hand.
Side
is
the
very
beginning
to
talk
about
right
now.
Most
customer
interested
in
most
areas
is
talking
about
the
parameter
or
we
call
the
waap
direct
application
and
API
protection
kind
of
thing.
D
So
we
actually,
we
have
discount
I
brought
up
Spectrum
talking
about
this
and
the
underneath.
You
can
see
the
security
controls
right
for
the
devs
a
lot.
You
can
see
a
lot
of
the
security
tools,
starting
from
the
bill
or
even
from
the
IDE
coating
process,
and
then
all
the
way
to
the
for
the
whole
software
development
supply
chain
for
the
platform.
One.
Maybe
you
familiar
with
all
the
routings,
but
just
one
of
them
I
would
like
the
high
neck
is
talking
about
the
cnapp
right.
D
A
D
It's
a
common,
maybe
you
can
see
some
of
the
security
vendor
they
claim-
or
they
say
oh
I'll
put
the
security
portal
offering
is
accept
this
cnapp
gotcha
right.
So
actually
it's
combined
quite
a
lot
of
capabilities.
One
of
this
is
maybe
you
definitely
heard
of
talking
about
the
cspm.
The
cloud
security
approach
management
actually
is
an
offering
that
we
are
trying
to
I
mean
to
form
a
cloud
perspective
with
how
we
are
going
to
do
mitigate
certain
kind
of
the
cloud
infrastructure
risks
right
and
the
right
hand
side
together.
D
A
C
Definitely
and
and
I
think
one
of
the
key
messages
there
is.
You
know
how
do
you,
how
do
you
bring
these
security
controls
to
workflows
in
a
way
that
it
feels
transparent
while
still
meeting
all
those
requirements?
You
know
how
do
you,
how
do
you
build
signing
or
kind
of
image
signing
into
a
workflow
in
a
way
that
feels
transparent
or
policy,
is
code
or
or
s-bomb
generation,
so
that
that
doesn't
become
a
developer
concern
and
becomes
one
of
those
High
friction
security
controls
that
that's
just
going
to
get
worked
around
I
think
that's!
D
D
Really
good
point
for
the
biggest
moves
that
people
look
at.
Both
security
are
just
try
to
avoid
attacks,
but
when
you
look
at
the
London
line,
I
mean
they
were
under
three
years.
Just
like
the
kubernetes
security
report,
we
just
show
misconfiguration.
Actually
this
is
another
I
mean
big
area.
The
customer
is
really
taking
care
about.
It.
E
E
I
think,
there's
also
a
lot
of
challenges
that
you
know
our
customers
face
today
and
therefore
the
emphasis
on
policy
as
code
and
on
IEC
right
decorative
through
kubernetes
construct
and
that's
very
important
right,
because
you
know
with
that
you
had
it
in
git,
for
instance,
you
have
the
full
audit
Trail,
you
do
a
pull
request
or
update
it.
You
have
kill
Ops
right
to
make
the
whole
sort
of
patterns
of
security
patterns.
If
you
will
right
to
be
enforced
onto
the
platform
right,
it's
no
longer.
Someone
goes
in.
E
Do
it
by
hand,
you
know
that's
what
we've
been
doing
for
VMS,
that's
what
we're
doing
for
badminton
right.
You
know
hardening
compliance,
do
it
once,
but
you
never
update
it
anymore.
You
never
go
back
and
check
on
it
anymore
right
and
the
processes
that
we
have
today.
I
think
it's
so
much
more
matured
right
to
have
those
you
know
things.
You
know
technology,
these,
those
capabilities
for
the
customers
and
for
partners
in
order
to
do
it
in
a
very
more
you
know,
effective
manner,
right
Shane.
What
are
your
thoughts
on
this.
A
C
On
basically
I
know,
it's
good
fun,
yeah,
absolutely
I,
think
I.
Think
you're
right
as
well.
I
mean
you
know.
How
do
we?
How
do
we
kind
of
create
that
kind
of
continuous
security
process
so
that
we're
we're
constantly
revisiting
those
controls?
We
can
capture
them.
We
can
manage
them
in
a
in
a
kind
of
devsecops
friendly
way
and,
like
we
mentioned,
bring
that
to
Platforms
in
a
way
that
it
feels
transparent
and
it
doesn't
create
friction
between
teams.
D
D
We
have
different
kind
of
security
that
we
can
incur
in
the
supply
chain
in
here,
and
it
also
try
to
explain
why
the
at
least
the
customer
in
homegirls
put
so
much
emphasize
on
the
runtime
security,
because
when
you
look
at
the
right
of
the
diagram
here,
you
can
see
all
the
I
mean
from
the
operation
perspective,
the
application
runtime,
all
nine
categories.
You
can
see
the
Nikolas
here
already
in
in
that
kind
of
I
mean
portion
when,
comparing
with
the
shift
left.
D
Okay,
talking
about
Steven,
IDE,
stealing
coating
process,
there's
still
I
mean
the
conversion
is
High
I
mean
in
huge
area
here
when
we
also
try
to
talk
to
a
customer
well
ready.
If
we're
trying
to
scaring
you,
no,
of
course,
no,
because
when
you
try
to
put
another
one,
is
here
try
to
reference.
Another
I
mean
the
periodic
table
when
you
try
to
see
security,
which
is
the
deep
blue
color
in
here
in
this
diagram,
you
can
also
find
out.
D
Actually
security
is
just
a
piece
of
the
ice
tip
here
right,
but
you
definitely
need
to
have
your
whole
picture
whenever
you
talk
about
the
devops,
because
we
have
quite
no
speaker
right
now
talking
about
whenever
I
talk
about
security.
Actually,
you
need
to
take
care
about
your
development.
Also,
your
adapter
locks,
yeah.
A
And
what
I
love
about
this
table
is
it?
It
shows
security
as
part
of
the
natural
world
of
all
of
this
right.
It's
just
some
elements
that
have
to
be
part
of
it
for
it
all
to
work
and
they
work
in
in
tandem
with
things
and
and
that
kind
of
thing
so
I
really
like
that,
but
I
find
myself
overwhelmed
and
I'm
curious.
You
know
when
you
sit
down
with
a
customer,
and
you
know
they
they
think
they're
doing
well,
and
is
it
hard
to
educate
them
and
I
know
what
we
mean.
A
A
D
E
Sure,
let
me
just
quickly
walk
through
the
audience,
with
the
way
how
you
know,
I,
look
at
things
and
how
you
know
we
help
some
of
you
know
customers.
This
is
just
an
example
right
and
because
the
reality
is
that
you
know
a
lot
of
customers
today
when
they
look
at
kubernetes,
they
look
at
containers
some
of
them.
E
Yes,
some
of
them
are
more
mature,
but
a
lot
of
them
are
starting
right,
even
though
kubernetes
is
going
to
run
for
what
about
seven
six
seven
eight
years
already
right,
but
some
of
this
organizations
are
just
beginning
to
you
know,
adopt
containers,
you
know
adopt
kubernetes
and
securities.
You
know,
as
usual,
is
a
important
conversations
right,
but
the
thing
about
security
is
that
the
sooner
you
have
that
conversation,
the
better
how
it
is-
and
you
know
you
should
never
have
that
conversation
at
the
end.
F
E
Live
and
whoa,
that's
big,
yeah
exclusion,
right!
It's
it's
never
going
to
work
and
that's
how
you
know
a
lot
of
these
customers
today.
You
know
when
they
look
at
it
and
the
problem
with
that
is
that
you
know
the
same
old
thinking,
the
same
old
results
and
some
of
these
customers
are
beginning
to
realize
that
oh,
the
cow
right,
the
current
processors
that
I
have
whether
it's
you
know,
AV
whether
it's
VM
based
solution,
the
way
how
container
works
it's
never
going
to
be
the
same
right.
I
mean
one
of
the
most
common
question.
E
I.
Think
Frankie
Shane,
you
probably
oh,
where
is
that?
Should
I
have
antivirus
right?
Should
I
run
the
antivirus
in
my
container?
Should
it
be
a
side
car?
How
do
I
do
that
right?
Because
on
my
VM,
which
is
you
know,
which
runs
a
monolithic
applications,
it
has
an
antivirus.
It
has
a
Edgar.
He
has
you
know
whatever
technologies
that
all
the
you
know,
four
or
five,
six,
seven,
eight,
nine
ten
agents
that
they
put
on
the
VM
right
to
secure
that
VM,
but
in
a
container
one
right,
it's
a
process.
E
It's
a
way
to
package
the
software.
You
know
it's
a
way
different
right
and
some
of
these
customers
that
I
work
with
they
start
to
realize
that
holy
cow
right.
You
know
the
old
way
of
if
I,
stick
on
the
old
way
right,
I'm
gonna
get
the
same
results
right,
I'm,
gonna,
just
fall
back
to
my
old
truth
and
Technologies
to
use
is
my
security
going
to
be
better?
Probably
not
right?
Is
it
going
to
be
the
right
way?
Probably
not
right,
so
this
the
way
how
you
know
some
of
these
customers?
E
E
E
Everything
needs
to
be,
you
know,
checked,
you
know
everything
needs
to
be
compliant
before
it
actually
goes
live
right,
but
the
way
how
we
look
at
this
problem
right
even
from
a
rehab
perspective,
just
like
cves
right-
it's
never
going
to
be
zero
risk
at
all.
But
then
how
do
you
become
more
of
a
manageable
risk
or
managed
risk?
You
know
perspective
right
because
a
lot
of
CVS
a
lot
of
vulnerabilities.
E
You
know
it's
going
to
be
it's
going
to
happen
every
day,
you're
going
to
have
like
100
CVS
every
week
right
about
what
the
most
important
CVS
that
is
going
to
be
critical
to
you
right.
What
is
the
most
impactful
to
you
and
how
do
you
then
look
at
it
from
a
managed
risk
perspective,
instead
of
serious,
because
to
do
patching
to
do
compliance
to
do
it
on
an
every
other
day
basis?
It's
not
just
going
to
be
it's
just
not
going
to
be
sustainable
right.
You
know
people
are
just
tired.
E
You
know
to
do
catching
because
it
just
takes.
You
know
too
long
to
patch
right
and
it
just
comes
and
go
right.
It
is
every
other
month,
every
other
week.
You've
got
to
do
that.
Exercise
right.
Are
you
going
to
be
targeting,
for
you
know
zero
CVS,
but
that's
not
real
right
and
then
how
are
technology?
Like
you
know,
you
know,
see
CV
scanning
tools
for
containers,
how
to
then
have
a
sort
of
acceptable
profile
to
say
that
you
know
this
is
something
that
is
manageable
to
us.
E
This
is
something
that
it's
that
we
can
accept
it
right
and
we
can
actually
go
through
the
pipeline
without
any
concerns
at
all
right,
because
the
reality
is
that
you
know
you're
going
to
get
CVS
every
other
day,
and
then
how
do
you,
then?
You
know
manage
such
a
risk
right,
because
the
next
slide
is
going
to
be
important
right
and
next
slide.
How
do
you
then
work
with
the
cyber
security
in
the
whole?
E
Is
the
customer
actually
really
looking
at
security
security
policy
because
they
sort
of
realized
that
you
know
earlier
I
talk
about
managing
risk
right,
because
how
then
cyber
from
a
security
perspective
is
actually
enabled
right,
because
a
lot
of
times
when
you
work
with
customers
right,
I'm,
sure,
frankly
and
Shane
you
know
can
totally
agree
with
me-
is
that
cyber
security
team,
you
know
all
our
customers
say-
is
that
they
are
blocker
right.
Well,
they
all
must
say.
Yes,
yes,
yes
right.
E
This
is
what
cyber
teams
say
so
and
therefore
we
must
follow
exactly
right.
They
have
that
huge.
You
know
checklist
again
right
that
we
must
comply
right
and
for
this
customer's
perspective,
they
are
relooking
it,
and
it's
not
just
the
platform
team,
not
just
the
infra
team.
It's
actually
the
cyber
security
team
that
says
that
they
really
they
need
to
relook
at
the
policies,
because
then,
how
do
they
help
the
organizations
a
job?
E
You
know
newer
technology
like
containers,
because
they
know
that
you
know
the
current
existing
processors
and
tools
are
not
relevant
anymore
right.
Some
of
them
still
are
yes
granted,
but
how
do
they
really
look?
At
this
whole
new
paradigm,
which
you
know
a
lot
of
times,
they're
not
familiar
with
you
know,
especially
like
things
like
container
security
Now,
how
does
a
security
engineer
or
cyber
security
person
look
at
container
security
right,
I'm?
E
Actually
totally
amazed
by
this
customer,
because
the
cyber
security
guy
is
actually
installing
openshift
by
himself
right
he's
like
installing
openshift
looking
at
Pop
man
looking
at
containers
looking
at
SCC
and
looking
at?
How
does
the
technology
actually
work
to
protect
and
to
have
the
guard
reels
right
for
the
platform?
E
And
that's
just
amazing
right,
because
we
often
say
that
internet
security
people
are
a
bunch
of
people,
people
right
a
bunch
of
people,
folks
right
who
doesn't
understand
about
the
technology
right,
but
in
this
case
the
customer
and
in
this
part
in
this
team,
they're
very
open
right
actually
looking
at
the
technology
underneath
the
hood
to
look
at.
Oh,
actually,
this
is
one
you
know.
Network
policy
is
doing.
This
is
what
cryo
is
doing.
This
is
what
I
see
Linux
is
doing
right,
and
this
is
something
that
I
can
be.
E
A
And
I
I
like
what
you're
saying
that
they're,
not
you
know,
he's
installing
openshift
he's
seeing
his
his
role
in
it,
not
he's
not
an
isolated
part
and
says
well,
they
put
in
some
open
shift
and
I
have
to
do
this.
He's
he's
your
customers
taking
ownership
of
not
his
own
ownership
being
part
of
the
whole
thing,
realizing
it's
a
bigger
thing
than
his
team.
It's
not
his
job
to
to
drop
Gates,
it's
his
job
to
be
part
of
it
exactly.
E
Right,
it's
not
going
to
be
enough
to
talk
right.
It's
not
going
to
be
what
people
exercise
he's
going
to
be
involved
in
all
the
decision
making
right
whether
we
should
use
Network
policies,
you
know,
should
we
do
root
containers?
Should
we
do
admission
controller
right
to
better
protect
that
platform
right?
And
it's
just
a
wonderful
experience
right
to
work
with
this
organization,
because
they
are
definitely
re-looking
at
this
from
a
new,
totally
a
new
different
angle
that
most
of
our
customers
are
today
yeah.
D
I
would
like
to
add
on
just
a
very
quick
one
is
today
I
agree
with
Lee
Min.
In
certain
extent,
the
reality
I
think
hurting
from
the
customer.
Is
it's
still
not
going
in
that
way?
Right,
because
that,
maybe
due
to
the
functional
features,
I
mean
the
roles
have
responsibility.
They're
still
working
in
Silo
still
I
mean,
doesn't
have
a
cohesive
way
to
deliver
security
first
kind
of
strategy,
so
they
try
to
identify
something
that
can
we
have
a
dashboard
like
a
green
light
signal.
D
You
just
tell
me,
which
are
the
greens
well
sorry,
which
are
the
red
ones
and
then
provide
the
length
for
me
better.
You
can
help
me
to
automate
the
patches
if
there's
any
and
then
to
fix
the
problem.
Try
not
to
ask
me
what
is
open
source
security
and
what
is
the
security?
I
mean
one
operating
management
and
risk
analysis
kind
of
thing,
so
I
think
there's
something
that
we
we
are
still
keep
on.
Trying
allocating
or
educating
I
mean
the
in
the
field
to
try
the
customer
understand.
E
E
I
think
probably
just
one
more:
let's
play
it
right
and
the
way
they
look
at
it.
I'll
just
give
an
example
right
doing
the
right
way
right
and
you
know
I
think
we
talk
a
lot
a
lot
about
and
I
know
Frankie
Dutch,
based
on
that
earlier
right.
Now,
how
do
we
use
tools
and
Technology
right
inside
the
manual
way
right
things
like
IEC?
E
You
know
network
is
code
security
as
code
configuration
as
code
policy
as
code
right
to
you
know
to
adopt
the
right
technology
for
the
for
the
right
purpose
right,
because
at
the
end
of
the
day,
you
know
how
do
you
then
secure
that
platform
right,
the
runtime
and
you
know
all
about
your
application,
but
also
integrating
to
the
CI
CD
pipeline
right,
because,
ultimately,
you
want
transparency
right,
the
more
transparent
you
are
instead
of
a
black
box,
so
that
developers
get
instant
feedback
to
what
has
on
what?
What?
What's
the
issue
right?
E
Maybe
you
know
you
didn't
meet
the
minimum
gate
or
you
know
you're,
not
using
the
right
say
you
buy
images
or
probably
you
are
extensively
using
a
root
container
things
like
that
right,
active
feedback
right
to
the
developer
so
that
they
can,
you
know
proactively,
make
that
change.
You
know
we
talk
about.
You
know
shift
line.
Audibility
is
critical
right
because
a
lot
of
organizations
today
you
know
the
way
how
they
look
at
the
logs
right.
They
need
to
be
audited.
E
They
need
to
be
transparent
to
make
sure
that
you
know
whatever
changes
that
you
know,
they've
done,
whether
it's
record,
you
know
whether
it's
policies,
you
know
their
stressability,
there's,
also
accountability
right,
but
most
important
and
I
think
also
to
a
lot
of
organizations
today,
especially
from
the
government
sector,
right
the
challenge
challenges
that
they
face.
It's
not
about
CI.
It's
a
about
CD
right
because
of
different
networks.
Right
different
air
gap
scenarios
right,
you
know
in
the
ideal
world
you
would
have
CI.
E
You
know
to
development
CD
to
a
development
right
and
CD
to
reproduction
once
the
release
has
been
approved
right,
but
it's
still
a
lot
of
organizations
today.
You
know
that
challenges,
you
know
air
gap,
you
know
disconnected
environments,
you
know
two
different
networks,
you
don't
have
that
connectivity
right
and
that
is
to
probably
a
lot
of
you
know
problems.
You
know
for
our.
You
know,
assistant
customers
today
say
how
to
then
they
achieve
the
true
CI
CD
right
even
to
the
production
environments.
I'm,
not
sure
whether
Frankie
or
Shane
has
any
thoughts
on
this.
C
I
think
this
is
a
you
know,
actually
a
really
good
kind
of
kind
of
time
to
look
more
closely
at
some
of
those
those
kind
of
as
code
workflows.
You
know
how
do
you,
how
do
you
manage
security
policies,
code
and
infrastructure
as
code
and
make
that
consistent
across
those
environments
and
I?
Think
that's
where,
where
organizations
are
really
looking
to
to
adopt
those
workflows
is
how
it
brings
consistency,
but
also
transparency.
C
A
It's
interesting
because
what
we
basically
have
going
on
here
now
is
yeah
we're
seeing
how
it's
evolved.
How
we've
got
this
old
way
of
working?
We
know
now
that
we
need
to
bring
it
into
an
actual.
You
know
kind
of
cohesive
way
of
working
and
and
make
it
as
if
we
do
it
as
code,
then
that's
very
much
what
they
do
every
day.
So
it's
kind
of
for
someone
like
myself
who's.
A
B
Yeah,
it's
reassuring
to
see
like
liming
mentioned,
that
a
lot
of
our
customers
are
now.
You
know
getting
their
hands
dirty.
They
understand
everything
is,
as
a
code
you
know,
is
the
way
to
go.
I
I
find
it.
You
know
really
interesting
that
you
know
they
are
going
down
that
path.
I
know,
Shane
has
a
demo
for
us
and
it
you
know
it.
It
brings
it
back
when
you
think
see
things
visually.
So
I'd
really
like
you
know
to
pass
this
on
to
Shane,
to
get
us
through
this
demo.
A
C
A
C
And
I
think
we
we
saw
this
cold
out
a
few
times
in
in
the
different
sessions.
Today
it
was
how
do
we
approach
policy
as
code,
so
what
I
want
to
show
is
a
workflow
of
how
I
can
store
those
security
policies
in
say,
git
repository
and
then
create
this,
this
kind
of
automated
workflow
to
apply
those
across
different
platforms
and
services.
So
the
way
I'm
going
to
do
that
specifically
I'm,
going
to
store
all
of
my
security
policy
as
Json
objects
inside
a
git
Repository.
C
Every
time,
I
make
a
change
I'm
going
to
kick
off
some
some
kind
of
GitHub
actions
to
verify
that
Automation
and
then
make
a
restful
API
call
to
my
automation
platform.
That's
going
to
then
orchestrate
all
of
those
changes
to
security
policy
inside
my
security
platform,
red
Advanced,
cluster
security
for
kubernetes.
C
So
this
is
Advanced
cluster
security
for
kubernetes
or
ACS,
and
it
comes
with
a
number
of
these
security
policies,
so
these
apply
across
the
build,
deploy
and
runtime
life
cycle
for
container
workloads.
So
that
means
I
can
apply.
Policies
that
that
apply
to
say,
CI,
CD
pipelines
or
I
can
apply.
Policies
to
new
deployments
to
a
cloud
native
platform
or
I
can
apply
these
into
the
the
runtime
life
cycle.
C
Now,
specifically,
the
one
I
want
to
look
at
today
is
this
curling
image
policy,
but
this
policy
is
going
to
alert
me
when
a
container
has
the
curl
binary
present.
So
I
think
this
is
really
important,
because
curl
is
a
a
really
useful
tool
to
have
as
a
kind
of
a
container
attacker.
It
means
you
can
pull
down
new
capabilities,
you
can
probe
Services,
you
can
try
and
move
laterally
through
in
the
network.
It's
it's
really
helpful
to
have
curl
available
so.
B
C
C
C
C
And
when
I
make
that
change,
it's
going
to
kick
off
now
my
my
GitHub
actions
to
start
making
those
changes.
So
what
we're
going
to
do
first
is
we're
going
to
run
an
ansible
lint
across
that
automation
that
I've
created
just
to
see
whether
there's
any
changes
or
maybe
catch
any
mistakes
in
that
automation,
workflow.
C
Once
that
completes
it's
going
to
make
a
restful
API
call
to
my
automation
platform.
So
in
this
case,
I've
got
my
ansible
automation
platform.
That's
going
to
actually
orchestrate
all
of
those
policy
as
code
changes
and
once
that
restful
API
call
kicks
off
I'm,
going
to
start
to
see
a
new
set
of
playbooks
start
to
start
to
kick
off.
So
first
we're
going
to
pull
down
the
latest
copy
of
my
security
policies,
so
you
can
see
that
Source
control
update
is
running
now.
C
C
So
the
idea
here
is
that
now
I
can
start
to
create
new
policies
using
this
policies.
Code
approach,
I
can
bring
developers
into
that
workflow
and
we
can
start
to
look
at.
You
know
picking
apart
some
of
those
policies
and
looking
at
how
we
want
to
improve
that
security
posture,
and
we
can
do
this
in
a
way.
That's
that's
transparent
for
development
teams.
It's
really
simple
to
audit,
and
it
helps
me
create
that
consistency
across
hybrid
Cloud
environments
and.
A
C
So
I
think
that's
that's
kind
of
one
approach.
I've
I've
found
works
for
these
kind
of
policies,
code,
approaches
and
you
could
potentially
take
that
to
other
other
kind
of
of
security
platforms.
If
you
wanted
to
look
at,
you
know
applying
those
changes
across
kind
of
cloud
resources
or
other
security
platforms,
you
know
you
can
start
to
take
that
same
policy
as
code
approach
now,
yeah.
A
And
it's
nice
to
see
the
different
pieces
of
you
know:
I
mean
they're
red
hat
products,
but
the
different
softwares
working
together
you
hopped
into
ansible.
You
know
you're
back
into
ACS.
That
makes
a
difference
right.
If
we
can
have
that
seamless
integration
with
the
tooling
it's
it's
as
you
talk
about.
The
friction
is
not
there
right.
It
makes
life
easier
for
people
to
have
that
that
consistency
across
things.
C
Yeah
exactly
and
and
creates
that
transparency
I
don't
need
to
now
create
access
controls
into
different
security
platforms.
Just
so
developers
can
see
the
policy
that's
enforced,
we
can
just
you
know,
provide
them
a
repository
and
say
well.
Here's
the
current,
the
current
policy
that's
being
enforced
across
all
of
these
different
workloads
and
and
seek
feedback
into
that
as
well.
I
think
is
really
important.
Yeah.
A
And
this
is
across
clouds
right
I
mean
you
mentioned
that,
but
this
could
be
anywhere
right,
we're
getting
the
same
view,
That's
The,
Power
of
openshift,
but
these
tools,
the
security
process,
isn't
specific,
a
way
of
working
per
cloud
or
per
environment.
It's
not
one
way
for
on-premises
in
a
different
way
for
AWS
we
can.
We
can
start
to
run
all
this
in
on
transparently
right
in
a
cleaner
way,
so
that
people
can
developers
and
teams
can
work
across.
All
of
this.
A
This
is
excellent,
so
we've
come
to
the
top
of
the
hour,
we're
a
little
over,
but
I
do
want
to
give
each
of
you
a
chance
to
kind
of
wrap
it
up.
It's
been
really
helpful
for
someone
like
myself
as
I.
You
know
kind
of
get
introduced
to
this
process
and
to
really
hear
that
story
have
how
you
know
the
industry
is
what
the
world's
like
and
then
how
we
have
talked
to
our
customers
about
it
and
and
just
how
we
talk
to
Security
Professionals
about
it
and
that
kind
of
thing.
A
D
Yeah
I
think
a
quick
one
is
just
being
a
normal
journey.
Is
we
should
ping
the
big
picture,
but
we
should
start
small
and
then
the
first
come
is
always
not
the
technology
first,
we
first
need
to
have
the
people
buy
in
then
we
look
at
the
existing
process
and
then
reveal
it
to
see
whether
we
can
have
a
better
one.
With
the
upgraded
I
mean
with
demon
party
are
greater,
then
we
can
start
with
the
technology.
D
Just
like,
for
example,
like
the
shift
lens
like
the
process
call
and
then
Automation
in
security
right
and
last
but
not
least,
maybe
the
most
important
is
talking
about
the
governance
right.
We
need
to
some
because
process
is
always
we're
talking
about
the
definition
like
codifying
the
governance
and
compliance
rules.
So
that's
the
reason
we
we
also
need
to
automate
it
yeah.
A
E
I
mean
the
the
way
I
look
at.
It
is
really
when
you
look
at
customers
right
and
along
what
Frankie
has
already
mentioned
right,
and
how
do
we
start
small
right?
How
do
we
then
re-look
at
this
problem
statement
right?
Because
if
the
customer
is
not
willing
to
do
so,
I
think
then
it's
going
to
be
very
challenging
right
and
then
how
we
as
an
organization
right
as
Ray,
Hector's
right,
come
in
and
look
and
talk
to
the
customers.
You
know
and
help
them
to
realize
that
you
know
continuous
security.
E
Is
it's
going
to
be
a
little
bit
different,
but
come
in
with
an
open
mindset
right,
I'm
trying
to
learn?
You
know
what
are
the
better
ways
to
secure
it
to
secure
it
right
and
policy
is
cool
and
everything
has
codification
and
that's
actually
important
right
along
the
team
of
automation
along
the
team
of
ansible.
Where
you
know
everything
has
code
right
everything
as
a
service
right.
That
totally
then
makes
sense
for
customers,
but
I
I
can
be
sure
that
you
know
it's
still
a
long
journey
right
and
but
I
do
see.
E
C
Yeah
look
I
really
really
like
where,
where
cloudiness
Cloud
native
security
is
going
and
starting
to
look
more
at
kind
of
making,
this
feel
like
just
a
part
of
the
of
the
the
platform
and
and
something
that's
that's
kind
of
almost
transparent
to
developers
and
I.
Think
if
we
can
focus
more
on
those
on
those
kind
of
low
friction,
high
impact
security
processes,
that's
going
to
have
a
lot
of
benefits
for
organization.
It's
going
to
make
it
easier
to
to
move
code
into
production
in
a
more
secure
way,
and
it's
going
to
avoid
I.
C
Think
some
of
those
those
bad
habits
we've
seen
creeping
in
like
moving
security
or
back
loading
Security
on
the
end
of
a
project
and
having
a
massive
checklist,
and
you
know
creating
those
project.
Delays
that
that
I
think
you
called
out
before
and
and
being
able
to
you
know,
call
out
those
those
critical
cves
focusing
more
on
those
and
and
less
on
trying
to
be
zero,
cve
right
at
the
end
of
a
project
which
I
don't
think
ever
works.
D
A
I
think
you
said
an
important
thing
right,
Cloud
native
security.
These
are
Cloud
native
systems,
they
need
Cloud
native
security.
We
can't
be
applying
old-fashioned
models
to
it.
Just
and
just
like
with
you
know,
we
need.
We
need
that
for
everything
in
the
cloud
native
world
and
it's
so
cool
to
see
how
this
is
kind
of
moving
ahead
and
How
Deeply
integrated.
We
are
at
Red
Hat
with
the
processes
and
the
education
of
our
customers,
as
well
as
the
engineering
and
the
code
behind
it
and
I.
A
B
I
really
enjoyed
this.
This
particular
show
we
we
started
it
with.
You
know,
looking
at
all
the
vulnerabilities
that
we
start
to
see
in
all
different
regions,
everyone
gave
their
perspectives
and
then
we
kind
of
moved
towards
how
our
customers
are
thinking
about
it.
You
know,
how
are
we
enabling
them,
and
you
know
this
is
what
I
learned
from
all
of
this
like
it.
B
It
takes
a
village,
you
know
to
bring
this
on
board
and
it
was
really
reassuring
to
see
some
of
our
customers
really
getting
Hands-On
and
from
a
security
point
of
view,
not
thinking
of
it
as
a
checklist,
but
you
know
really
something
that
is
simplified
and
Shane
really
showed
that
in
action
right.
How
easy
it
is.
You
know
it's
everything
as
a
code
and
where
it
is
headed,
so
all
in
all
really
helpful-
and
you
know,
thanks
to
all
of
you,
to
come
on
the
show
and
educate
us
thanks
for
that
yeah.
B
A
Great
so,
and
if
you,
if
you
want
more,
it
I,
have
to
remind
everyone,
the
the
red
hat
Summit
is
coming
up
in
America
in
May,
it's
in
a
couple
weeks,
if
you're
not
lucky
enough
like
myself
to
be
there,
I'm
not
going
to
be
there
I'm
I'm,
The,
Unlucky,
One
I'll,
be
here.
You
can
actually
register
for
some
sessions
to
be
made
available.
A
If
you
head
over
to
the
summit
page
and
check
it
out,
so
you
can
get
more
of
these
great
insights
from
more
red
hat
experts,
which
is
really
cool.
Of
course
we
have
many
in
our
own
region
as
well,
so
definitely
in
our
own
time
zone.
Additionally,
we're
going
to
keep
going
with
the
copy
hour,
so
we've
got
a
bunch
of
other
streaming
shows.
We've
got
the
get
Ops
hour.
We've
got
to
ask
an
openshift
admin
check
out
the
streaming
calendar.
A
Much
of
it
is
in
a
non-apac
friendly
time,
but
it's
all
recorded
and
it's
all
there
for
you
to
review
and
you
can
get
in
touch
with
folks
and
everything
so
that
pretty
much
brings
it
to
an
end.
I'm
really
really
pleased
to
have
had
Frankie,
Lee,
Ming
and
Shane
on
the
show
and
taking
us
through
everything.
A
Cool
I
just
wanted
to
make
sure
because
I
I
mean
I
could
sit
here
for
another
hour
and
chat
but,
as
you
said,
Shane
it's
getting
dark
where
we
are
your
little
one's,
probably
just
you
know,
knocking
at
that
door.
So
let's
go
ahead
and
and
finish
it
off.
So
thank
you.
Everyone
again
for
attending
and
we'll
catch
you
next
time
on
the
Kobe
hour,
all
right
so.