►
Description
Welcome to the Secure Cloud Cast!
Here you can find our monthly show focused on all things security, cloud native, and open source projects. Today we are discussing:
- Updates to StackRox and RHACS
- Security information from the latest OpenShift release
- KubeCon event details
- Cloud Native Security Con event details
- StackRox open source updates
- And hardening your upstream dependencies with Emmy Eide!
Emmy is the senior manager for the supply chain group that falls under our product security organization. Her team is focused on securing the systems involved with modifying and storing our offering code. She lives in the Pacific Northwest with her two children, husband, two cats, and bulldog. She loves exploring the great outdoors through sailing, kayaking, hiking, and snowboarding in her free time. She started her cybersecurity journey in the Army and has been with Red Hat for a year and a half, growing an organization from the ground up.
You can reach out to Emmy via her LinkedIn - https://www.linkedin.com/in/emmycomstock/
A
B
B
C
Yeah,
so
my
name
is
Kim
Carlos.
If
you
didn't
watch
last
time,
I
have
a
background
in
security,
especially
over
the
last
seven
years.
I've
worked
in
several
different
areas,
from
vulnerability
management,
to
threat,
intelligence
to
risk
management,
lots
of
different
things,
and
so
most
recently
I've
joined
here
at
Red
Hat
to
focus
on
the
open
shift
Solutions
and
how
they
relate
to
security
use
cases.
B
Yeah,
it's
been
a
ton
of
fun
as
always,
so
this
is
the
second
show
you
can
check
out
the
recordings
on
YouTube.
We
are
the
third
Tuesday
of
every
month,
2
p.m,
Eastern
that
we
go
live
and
so
yeah
we'll
see
you
next
month.
Hopefully
right
before
kubecon
I
think
is
what
we
have
slotted
for
next
month
without
further
Ado,
though,
should
we
kick
it
off
with
the
general
news,
yeah.
B
B
There's,
like
I,
think
you
know
four
or
five
hundred
people,
some
X
Solutions
Architects
from
stack
rocks
that
are
in
there
as
well
to
help
you
with
all
your
questions
and
get
started
and
then
a
couple
other
things
just
some
default
policies
and
the
ability
to
set
ebpf
as
the
default
module
for
The
Collector,
as
the
updates
and
3.72
should
be
coming
out
soon.
Look
forward
to
that
announcement,
hopefully
next
month,
so
from
ACS
standpoint,
that's
all
I
have
Kim
I
know
you
had
some
announcements
for
us.
What's
next
yeah.
B
Perfect
and
then
from
the
open
source
side,
because
I
like
to
plug
stack,
rocks
all
the
time
we
have
hacktober
coming
up,
so
stack
rocks
is
always
looking
for
Upstream
contributions
and
hacktober.
Basically,
all
month,
there's
a
bunch
of
issues
getting
opened.
You
can
comment
on
them,
we're
looking
for
people
to
be
involved
and
we're
going
to
send
a
bunch
of
Stack
Rock
skier
your
way,
if
you
can
also,
we
have
stock
Rocks
Community
meetings,
the
second
Tuesday
at
12
p.m.
Eastern,
and
you
can
find
all
this
information
at
stackrocks.io.
B
C
B
And
for
those
who
are
new
coupons
in
Detroit
this
year,
24th
to
the
28th
they're,
always
the
co-located
days
right
so
Monday
Tuesday,
it
tends
to
be
the
day
Zero
days.
There's
things
like
the
ebpf
day,
Cloud
native
security
con
there's
the
supply
chain
security
con
now
so
I'll
be
talking
at
that
one.
B
If
anybody's
around
interested
come
and
find
me
and
ping
me
and
I
always
be
really
nice
to
see
people
for
the
first
time
in
two
years,
my
first
kubecon
so
I'm,
very
excited
and,
and
then
openshift
Commons
as
well,
is
on
the
Tuesday
right
before
kubecon
kicks
off.
That's
that
that's
it
for
General
updates.
There's
a
lot
of
updates
very
fast
yeah.
C
B
A
So
if
you
think
about,
we
think
about
the
supply
chain
kind
of
like
liking
it
to
water
treatment
facilities
like
the
if
the
open
source
is
the
Upstream
water
that
you're
pulling
from,
and
then
you
have
all
of
the
pipes
that
move
the
water
through
it
the
water's
the
code.
My
job
is
to
make
sure
that
the
pipes
that
surround
that
code
are
secure
or
trustworthy.
A
Rather
so
I
live
in
the
Pacific
Northwest
a
little
bit
south
of
Seattle
and
I
have
two
children,
husbands,
two
cats
and
a
dog,
and
we
spend
most
of
our
free
time.
Exploring
the
Great
Outdoors.
Here
we
go
sailing
has
been
a
new
hobby
we've
taken
on,
which
has
been
just
extraordinary
because
there's
so
many
so
much
like
Marine
Mammal
wildlife
in
Pacific
Northwest
started
cyber
security
when
I
was
in
the
Army
as
an
intelligence
officer
in
the
Army
and
I've,
been
with
red
hat.
B
A
B
A
Very
broad,
but
it's
good-
it's
exciting
I
really
enjoyed
talking
about
it,
so
I
think
one
of
a
I
think
about
it
as
us
approaching
it
from
kind
of
two
directions.
One
of
them
is
how
I
think
a
lot
of
people
think
about
supply
chain.
Software
Supply
chains
is
hardening
so
hardening
the
infrastructure
and
the
systems
that
you're
creating,
manipulating
storing
your
code
on
we
do
we
do
a
lot
with
that.
There's
some
industry
standards
that
are
show
best
practices.
A
The
premise
of
baking
Security
in
which
is
really
where
ssdf
kind
of
comes
into
into
play
and
that's
making
sure
that
the
developers
are
kind
of
approaching
it
from
the
other
direction.
So
are
the
developers
do
they
know
that
they're
using
systems
that
meet
certain
criteria
in
the
cane
attest
to
it
with
with
when
they
release
their
product?
So
do
we
provide
out
of
stations?
Are
we
like
signing
all
the
all
the
kind
of
laundry
list
of
things
that
need
to
be
done
to
give
our
customers
a
assurances.
B
I
just
I
know
Kim's
itch
into
asking
us
the
next
question,
but
I
found
it
really
interesting
that
you
use
trustworthy
and
hardened
and
because
there
are
so
many
standards
out
there
and
there
are
new
ones
in
supply
chain.
They're,
not
bulletproof,
though
right
and
they're
still
constant,
there's
always
work
to
be
having
hard
and
Upstream
right.
A
A
C
A
C
C
Cool
now
back
to
my
burning
question,
so
we
understand,
like
you
just
mentioned,
that
there's
a
lot
of
technology
that
are,
you
know,
advancing
right
and
we
want
to
be
able
to
take
advantage
advantage
of
those,
but
they
come
with
those
risks.
You
know,
and
you
have
to
decide
what
are
those
exceptions
but
I'd
love
for
you
to
explain
to
us
a
little
bit
more
about
how
red
hat
can
really
help
Harden
or
how
we
go
about
hardening
Pipelines.
A
A
It
takes
a
lot
of
effort
and
a
lot
of
time
to
do
good
security
risk
assessments
on
any
piece
of
tool
or
infrastructure,
especially
if
you
build
it
in-house
a
lot
of
times.
If
you
do
use
third
party,
you
can
rely
on
them
to
provide
you
with
a
risk
assessment,
but
it's
also
going
to
depend
on
how
you're
implementing
that
tool.
A
So
someone
using
a
red
hat
product
is,
we
could
hand
them
like
hey
here's
our
risk
assessment
for
it,
but
it
really
depends
on
how
you're
implementing
it
and
like
what
you
might
be
circumventing
like
if
we
have
something
set
up
by
default
and
you're
circumventing
it
to
make
it
easier.
That's
going
to
maybe
change
your
risk
level.
So
that's
something
we
align,
those
with
kind
of
those
industry,
best
practices
and
those
Frameworks.
A
That
I
was
talking
to
you
about,
and
then
another
thing
is
making
sure
that
we
have
those
tailored
Solutions
to
each
system,
so
I
could
sit
there
and
it
as
a
security,
professional
I
say
like
the
security
pedestal
right
like
we
said
on
security
pedestals
sometimes-
and
we
say
everyone
go
ahead
and
Implement-
you
know
security
control,
X
and
then
every
single
system
owner
has
to
figure
out
how
to
implement
it
and
it
might
not
be
appropriate.
It
might
not
be.
A
They
might
need
some
extra
work
to
be
done
on
my
side
in
order
for
it
to
actually
take
place,
they
might
need
it
to
get
involved
and
so
for
them
to
have
a
security
risk
assessment,
and
this
is
their
remediation
plan
for
getting
all
of
their
security
controls
gaps
closed.
They
it's
going
to
be
very
specific
to
the
system.
What
it
can
do,
what
it's
offering,
what
what's
its
role?
A
Is
it
read
access,
or
is
it
right
access
right,
so,
like
all
of
those
little
in
nuances,
are,
are
really
important
for
Security,
Professionals
and
and
in
red
hot.
This
is
what
we
do
is
we
make
sure
that
we're
considering
all
of
that,
so
that
we're
not
slowing
progress
and
that
we
are
really
involved
in
the
productization
process
rather
than
just
kind
of
sitting
back
with
our
little
clipboards
and
saying
like
sorry,
you
didn't
meet
my
requirement.
That
makes
no
sense
to
you.
B
Yeah
I,
don't
I,
don't
have
any
of
that
at
all,
because
I
talk
about
the
same
story,
but
just
specific
to
ACS
and
kubernetes
clusters
and
that's
a
challenge
in
and
of
itself
right.
You
want
to
implement
one
policy
at
a
cluster
level
and
then
all
of
a
sudden,
you
get
a
bunch
of
development
teams
like
wait.
Why
is
my
image?
Why
can't
I
deploy
this
container
right
yeah?
So
then
you
have
to
obviously
like
work
with
people
Upstream.
B
A
Yeah
and
I
I
think
that's
it
right,
like
working
with
people
and
so
like
I
I.
Think
that
there's
often
this
kind
of
conflict
between
engineering
teams
and
security
teams,
because
they
CSC
security
as
a
roadblock.
But
it's
once
you've
formed
that
partnership.
Like
you
know
the
world
Eurostar
like
you,
you
are
working
together
for
the
same
company
to
sell
like
we're
all
here.
For
the
same
reason,
right
like.
B
B
B
So
there's
a
little
bit
of
you
know
working
together
to
smooth
that
Pipeline
and
triage
accordingly,
so
that
you
can
avoid
those
big
mishaps
right,
I,
don't
know
if
I
phrase
that
the
best
way
possible,
but
speaking
of
that,
because
in
that
all
of
red
Hat's
products
and
trying
to
to
get
them
all
to
let's
say
swim,
Downstream
from
all
open
source
orgs.
How
do
you
understand
and
reduce
risk?
And
how
do
you
have
that
conversation
between
all
the
developers
across
all
the
products.
A
So
when
these
things,
like
log
her
shell
pop
up,
we
have
already
a
process
in
place.
We
can
do
that
rapidly.
That
makes
those
changes
across
the
board
so
like.
If
at
Red
Hat,
we
have
a
lot
of
different
offerings,
we
produce
them
in
multiple
ways,
so
we
like
might
produce,
they
can
be
consumed
in
multiple
ways,
so
that
requires
kind
of
different
parts
of
the
pipelines
to
move
in
different
ways,
and
so
all
of
those
have
to
be
integrated.
They
all
have
to
be
secured.
A
Similarly,
we
have
to
like
make
sure
that
we're
using
Standard
Security
across
the
board,
so
that
partnership
helps
I,
think
I
went
off
Sidetrack,
but
that
partnership
helps
quite
a
bit
with
that
in
our
process.
So
we're
like
that's
I,
think
there's.
Is
there
a
slide
that
you
could
show
like
there's
a
cyclical
slide?
Did
you
happen
to
see
that
oh.
A
A
A
Teaching
more
about
security,
empowering
engineering
teams
to
make
risk-based
decisions
reduces
risk
kind
of
in
itself,
because
they're
constantly
thinking
about
it
so
like
are
their
priorities
risk-based.
So
if
they
say
hey
we're
not
going
to
be
able
to
do.
You
know,
control
X
until
this
date
say
great.
Let's
talk
about
what
that
means
for
risk.
What
are
you
exposing?
A
What
do
you
like
keeping
rate
and
making
sure
that
we're
that
those
little
data
decisions
can
be
made
with
the
right
thought
in
mind,
rather
than
it's
just
another
security
task
like
there's
a
there's,
a
reason
behind
it?
So,
anytime
you
put
a
security
requirement
out
to
our
organization.
We
provide
what
the
security
risk
is
and
the
justification
for
needing
it.
A
We
have
a
little
bit
of
an
advantage
in
the
supply
chain
area
because
they're
constantly
more
Supply
like
for
acts
happening,
so
it
does
provide
quite
a
bit
of
fodder
for,
like
being
able
to
say
like
hey,
we
don't.
We
don't
want
to
end
up
in
that
situation
and
we
don't.
If
we
can
get
in
front
of
this,
then
we
should
be
able
to
prevent
this
type
of
attack
from
occurring.
A
But
it
really
is
about,
like
bringing
I,
think
bringing
the
security
team
to
the
productization
process,
but
also
bringing
the
the
engineering
team
to
security
so
that,
like
we're
on
the
same
wavelength,
that
there's
no
surprises
that
we're
not
sending
out
emails
that
are,
is
a
new
security
standard
that
someone
has
to
meet
that,
like.
Hopefully,
they
paid
attention
or
they're
going
to
get
disconnected
from
the
network
right
like
that,
that
you're
working
together
as
a
team,
all
really
working
towards
the
same
goal
and.
B
A
I
think
the
process,
the
partnership
process
has
really
helped
with
that
has
helped
to
get
everyone
kind
of
on
the
same
page
and
I've
noticed
that,
even
in
the
last
like
year
and
a
half
the
conversations
internally
that
we
have
as
far
as
like
what
we
want
to
do
have
changed
dramatically
and
all
for
the
better
of
like
really
really
doing.
What's
right
for
red
hat
and
our
customers.
B
Do
you
notice
any
of
the
that
momentum
bleed
into
Upstream
communities
because
I'm
seeing
a
lot
of
different
issues
in
the
cncf
and
and
other
open
source
orgs?
So
I
was
just
kind
of
curious
because,
obviously
you
know
we
do
have
a
bunch
of
Upstream
projects
is
a
standard
set
kind
of
all
across
the
board
all
the
way
up,
as
as
far
as
we
can
go.
A
B
A
Be
nice
I
don't
have
to
yeah
I,
don't
have
direct
involvement
in
some
of
that,
but
I
will
say
that,
as
we
develop
like
internal
security
tools,
if
we're
able
to
open
source
it
and
push
it,
we
do
so.
If
we're
able
to
you
know
Implement
automated
governance,
then
that
would
be
something
that
we
push
upstream
and
so
we're
able
to
kind
of
feed
the
community
in
that
way.
A
That's
at
least
the
scope
of
where
I'm
at
a
lot
of
product,
security
and
red
high
is
involved
in
a
lot
of
the
open,
ssf
work
streams,
and
so
that's
another
way
that
we're
kind
of
contributing
back
to
open
source
so
like
I'm
in
the
I,
go
to
the
salsa
specification
meetings.
I'm
pretty
involved
in
that
making
sure
that
what
we're
going
to
be
asking
in
salsa
is
not
something
that's
completely
unachievable
by
a
smaller
company
right,
but
that
it's
still
meeting
what
the
standard
would
be
for
what
customers
need.
A
C
A
Supply
chain
levels
for
software
artifacts
is
a
nist
or
it's
an
open,
ssf
framework
that
Maps
directly
to
a
lot
of
the
controls
and
Mist.
In
fact,
red
hat
did
a
mapping
for
the
Pro
open
ssf
and
for
the
community
to
be
able
to
consume
so
that
they
can
make
sense
of
it
because
we
have
are
so
many
security
Frameworks
and
they
can
be
really
hard
to
make
sense
of,
and
we're
lucky
enough
to
have
a
big
product
security
organization
to
work
through
making
sense
of
this.
A
But
not
all
of
our
customers
have
have
that
ability,
and
so
we
wanted
to
make
sure
that
it's
as
easy
to
implement
as
possible,
especially
if,
if
there
are
people,
aren't
sure
where
to
start
like
a
lot
of
organizations,
have
one
security
person
right
so
so
salsa.
If
you
think
about
it,
kind
of
like
maturity,
levels
so
level,
one
it's
level,
one
through
level.
Four,
it
actually
can't
claim
level
four
yet
because
that
hasn't
been
produced.
A
So,
just
as
like
a
side
note,
we
are
working
towards
the
controls
like
red
Hat's,
working
towards
the
controls
of
level
three
and
four,
and
it's
best
not
to
think
about
it.
Like
you
are
level
one.
You
are
level
two.
It
is
more
like
for
Source
Integrity
I
am
level
three
for
Providence
I'm
level,
four,
so
like
in
different
Lines
within
each.
You
can
say,
like
I
meet
this
level
in
this
line,
rather
than
some
compliance,
Frameworks
or
compliance,
certifications
that
are
out
there.
A
They
it's
like
kind
of
either
All
or
Nothing.
Like
You
have
to
fit
all
of
these
criteria
this
one's
specific,
but
it
also
provides
there's
a
requirement
for
attestation
for
it.
So
as
you're
producing
your
offering,
you
have
to
have
a
signed
at
a
station
that
that
shows
logically
how
you've
met
all
of
these
controls
and
that's
helpful
to
the
customer,
because
I've
seen
some
supply
chain
questionnaires,
which
are
created
usually
by
the
customer
and
those
are
great
but
they're
completely
manual.
A
There's
a
lot
of
overhead
associated
with
not
only
filling
them
out,
but
also
receiving
them
and
processing
the
results.
The
nice
thing
about
salsa
is
that
it's
an
automated
process
to
get
that
out
of
station
out
there,
so
I'm
I
think
it's
great
that
there's
so
much
focus
on
salsa
or
on
the
supply
chain,
and
that
there's
even
like
a
framework
kind
of
solely
dedicated
to
it,
because
it
is
an
important
aspect
of
like
how
your
your,
like
the
whole
solar
winds
attack
like
that.
A
That
is
a
really
good
example
of
why
this
kind
of
stuff
is
important,
because
it
wasn't
necessarily
the
company
that
was
hacked.
That
was
impacted.
It
was
their
customers,
which
is
by
supply
chain.
Security
is
kind
of
terrifying.
It's
a
really
good
entrance
point
for
an
attacker
who
wants
to
hit
a
broad
base
right.
B
And
so
it's
like
you
said
it's
not
just
compliance
at
one
specific
part,
but
you
have
to
make
sure
that
throughout
that
whole
chain
that
there's
at
a
station
that
you
know
what's
going
on
that,
you
know
who
has
access
to
it
right
and
also
from
a
security
standpoint,
as
an
auditor
I
would
love
that.
Always
automated
and
it's
just
like
here
pull
me
all
the
changes
over
the
last
month
and
tell
me
exactly
what's
happened.
Then
it
should
all
be
there
right.
A
C
A
B
Mm-Hmm
yeah
and
speaking
of
open
culture,
because
this
is
this-
might
spark
some
debate
in
the
chat
back
port
or
rebasing
came
up
and
I
know
that
in
the
open
source,
Community
there's,
you
know
certain
container
images
that
are
kind
of
Base
images
that
move
quicker
than
others
a
lot
of
it's
because
the
security
fix
comes
out
and
it's
boom
just
push.
The
next
version
tell
everybody
to
use
that
one
kind
of
curious.
What
your
opinion
is
on
the.
A
A
So
back
porting
is
is
when
you
apply
a
security
fix
to
an
existing
version.
A
lot
of
customers,
don't
see
that
security
fix
it.
Just
kind
of
happens
really
end
users,
it's
not
something
that
we
would
experience
as
end
users,
typically
like
on
our
local
computer
phone
or
whatever
it
might
be,
the
one
we
experience
the
most
is
rebasing,
which
is
when
to
get
the
security
fix.
A
We've
applied
more
and
more
security
patches
to
them
so
like
it
would
be
a
lot
harder
to
keep
up
to
date
than
most
recent
Community
version
and
you're.
Actually,
there's
like
a
really
happy
point
of
still
getting
still
like
compatible
with
everything.
Features
are
good
and
it's
like
all
of
the
security
patches
are
there.
So
it's
not
as
vulnerable.
A
We've
actually
have
a
couple
of
instances
that
we
point
to
of
when
the
version
the
open
source
version
was
available
and
it
was
vulnerable
and
anyone
using
our
was
not
even
because
it
was
an
old
version
that
we
we
had
already
patched
previously
to
getting
exploited
so
I
appreciate
it,
because
pushing
enforcing
updates
is
like
one
of
I.t's
nightmares
right
like
a
computer
right
like
what
is
it
Tuesdays
or
Microsoft,
Tuesdays
or
whatever.
It
was
like,
in
fact
in
the
90s
yeah,
so
yeah
so
for
Enterprises
in
the
supply
chain.
B
Yeah
and
we
rent
this
this
conversation
too,
when
stack
Rocks,
open
sourced
when
Red
Hats
cluster
security
turns
stack,
rocks
into
the
open
source
Upstream
version.
There
was
the
conversation
of
you
know
how
much
code
do
you
accept
if
you
accept
it
and
it
gets
into
the
product?
Well,
it
has
to
be
supported.
You
have
to
make
sure
that
you're
quashing
vulnerabilities,
so
it
becomes
this.
How
much
do
you
accept?
Who
do
you
respond
to
first
right
and
I?
Think
that's
sort
of
Red.
A
B
Will
motto
is
we
make
sure
that
one
code
meets
our
standards,
two
that
we're
constantly
checking
for
vulnerabilities
and
and
backboarding
fixes
into
the
supported
versions?
And
then
that's
what
we
can.
We
can
tell
people
right,
we
can
say
Hey,
you
can
use
the
open
source
version,
but
you
might
not
get
the
response
time
you're.
Looking
for
when
something
major
happens,
right,
right
and
and
I
mean
I.
Have
this
chat
in
the
slack
channels
every
day
and
say
you
know
it's
it
you
know,
will
run
the
exact
same.
A
Of
the
one
of
the
only
like
things
that
is
like
something
that
I've
been
recently
thinking
about
is
that
security
scanners
there
can
be
a
delay
with
the
vulnerable
versions,
and
so,
if
you
run
a
security
scanner
to
check
it,
it's
worth
reaching
back
to
Red
Hat
to
say:
hey.
Has
this
been
hey
I
think
we
have
an
advisory
page?
You
can
look
out
to
see
if
it's
been
back
ported
in
that
way.
It's.
B
I
know
that
there's
like
little
quirks
because
Advanced
security
is
a
fork
of
Claire
and
Claire
runs
in
Quay
certain
things
like
you
know.
We
report
on
fixable
and
non-fixable
issues,
some
scanners
only
report
on
the
fixable
ones,
because
why
would
you
focus?
Why
would
you
tell
a
developer
about
all
the
things
that
they
can't
fix
right
so
there's
different
features
and
functionality,
but
yeah
again,
if
the
vulner
relays
aren't
mentioned,
especially
with
the
red
hat
feeds,
that's
definitely
worth
reporting
right.
B
C
I,
while
you're
here,
you
know,
we've
been
talking
about
Frameworks
and
how
many
there
are-
and
you
know,
exceptional
like
what's
gonna,
what's
an
acceptable
risk
and
things
like
that.
But
in
my
experience
a
lot
of
times
with
these
Frameworks
there's
a
lot
of
overlap
right
and
one.
You
may
consider
this
best
versus
this
best
and
it's
like
in
in
terms
of
red
hat
and
and
our
security
like
how?
How
do
we
decide
you
know,
or
in
general,
like?
A
I
think
the
first
one
is
applicability,
so
some
of
them
were
kind
of
their
the
hand
might
be
forced
with.
Are
we
like
for
a
good
example?
Is
the
executive
order
that
came
out
in
May
of
last
year,
the
Cyber
Security
executive
order
that
applied
to
anything
that
was
considered
critical
software,
which
Red
Hat
has
critical
software
to
the
government?
So
they
basically
say
you
have
to
follow
this
framework,
and
so
that
is
one
way
that
we
decide
which
framework
is.
A
A
It
off
this,
doesn't
it's
not
applicable,
not
applicable
lots
of
research,
lots
of
really
smart
folks,
I,
never
worked
with
smarter
people
in
my
life.
Just
got
who's
got
a
really
good
group
of
people,
so
I
love
it
okay,
but
just
very
thoughtful
people.
It's
it's
really.
It's
really
about,
like
remembering
we're
all
human
at
the
end
of
the
day,
and
that
this
is
all
a
company
run
by
humans
and
created
for
other
humans
like
so.
We.
C
A
This
is
a
big
thing
with
like
scanners
and
people
wanting
to
implement
scanners
and
code
scanners
like
it
Crea
it
can
create
a
lot
of
noise
and
are
you?
Are
we
leaving
that
up
to
the
engineers
of
the
development
teams
to
cut
out
that
noise,
or
is
us
as
a
security
organization
cutting
out
all
the
noise?
Are
we
doing
some
like
consolidated
approach
to
it?
So.
B
B
Yeah
a
lot
more
Hands-On
just
because
one
developers
hate
all
those
notifications,
they're
already
swamped
with
GitHub
and
code,
commit
notifications.
So
it's
another
vulnerability
and
then
I
mean
just
speak
from
kubernetes
perspective.
A
lot
of
security
teams,
like
you,
said
with
code
scanning.
They
might
necessarily
know
how
it
gets
implemented
in
the
cluster
or
the
configuration
of
the
containers.
So
oh
yeah,
you
do
need
both
teams
to
come
to
the
table.
It's
just
requires
buy-in
right.
A
So
it's
really
especially
with
security
when
there's
not
a
fire
keeping
keeping
on
top
of
like
all
of
the
the
momentum
behind
it
to
say,
like
great,
is
security,
a
priority.
Is
it
actually
a
priority?
Have
you
invested
resources,
resources
into
it
or?
Have
you
just
told
me
it's
a
priority
because
that's
a
there's,
a
huge
that
can
be
a
big
variance
there.
B
C
A
Like
fascinates
me
all
the
different
ways
that
you
can
all
the
the
red
teaming
side
of
it
like,
how
can
you
get
into
a
network?
How
can
you
like
take
advantage
like
what,
what's
the
likelihood
that
this
would
even
happen?
I
mean
like?
Can
someone
pivot
when
they
get
into
Network
and
when
they
do
pivot?
What
can
they
do
with
different
responsibilities?
A
I
just
find
it
so
interesting
that
it's
not
like
a
lot
for
me
to
get
like
involved
in
it,
but
I,
mostly
I,
think
personally
focus
on
what
processes
can
be
improved
so
that,
during
those
cases
of
emergencies,
things
can
flow
smoother
and
that
they're
less
disruptive
to
product
teams
and
to
our
company
overall,
like
yeah,
we
can
have
an
emergency
without
having
to
shut
the
company
down.
It's
not
right,
like
it's
just
part
of
it
like
we
just
know
that
we
know
that
emergencies
will
happen.
We
know
that
fires
will
happen.
A
C
You
know
it's
easier,
I
think
to
have
those
silos,
but
more
important
than
ever
than
not
just
the
collaborate,
but
also
for
everybody
to
take
on
kind
of
this
joint
accountability
for
security.
You
know
no
matter
what
it
is
you
do
it's.
It
plays
a
role
and
I
think
that
red
hat
does
that
at
least
that's
what
I've,
seen
and
I'm
just
curious
to
hear
take
on
it.
A
A
Just
because
you
can't
turn
around
and
see
if
someone's
in
a
meeting
you,
because
you
can't
see
if
they're
like
busy
in
that
moment,
you
might
not
want
to
just
like
Ping
them
out
of
band
and
and
so
their
silos,
just
kind
of
naturally
happen.
I
think
in
a
remote
I'm,
not
sure
we're
like
quite
Advanced
enough
as
being
remote
like
workers
to
hot,
like
kind
of
get
rid
of
those
just
yet,
but
so
it
takes
a
lot
of
work
to
to
keep
them
down.
But.
B
A
The
amount
really
I
think
goes
to
also
the
amount
of
vulnerability
that
anyone
on
a
team
might
have
be
able
to
show
kind
of
to
say,
like
hey,
I,
don't
understand
what
this
is,
I
need,
help
with
it
and
that
that
requires
a
lot
of
vulnerability,
especially
written
down.
So
for
someone-
and
this
is
more
of
like
a
leadership
perspective
but
like
for
someone
being
able
to
write
down
that
they
don't
know
something
and
that
they
need
help
that
that
requires
a
lot
for
people
like
to
trust
that
they're
going
to
have
positive
feedback.
A
They
are
going
to
get
that
help
that
they
need,
but
it
also
drives
us
all
in
the
right
direction,
but
I
think
Red.
Hat
again
is
like
just
very
good
about
that,
and
maybe
it
goes
to
the
whole
Community
approach
and
like
that,
that's
kind
of
how
it
was
founded,
but
I,
especially
for
20
000
people,
I've
seen
a
lot
of
what
a
good
coordinating
with
that
very.
B
B
A
Another
one
is
our
security
blogs
that
we
do
so
product
Security
in
red
hat,
puts
out
blogs
and
on
a
variety
of
different
topics,
my
team's
putting
out
blogs
as
well
they're
all
there
to
be
informative
and
open
and
transparent
with
our
customers
and
they're
there
for
the
internet
to
see
and
critique,
which
is
really
fun.
But
hopefully
it's
it's
informed
of
just
kind
of
like
understanding
the
approach
we're
taking
at
Red
Hat
as
well.
B
This
is
awesome
until
next
Thursday.
What
next
month,
I
gotta,
find
the
exact
date,
but
the
third
Tuesday
so
of
next
month,
we'll
be
back
secure,
cloudcast
and
if
you
follow
along
in
the
calendar,
it'll
show
up
as
well
and
if
you're
on
YouTube
just
hit
the
little
notification,
Bell
and
you'll
get
a
ping
from
us,
I'm
leaving
it
up
to
to
Kim.
You
can
sign
us
off
all
right.
Any
last
words.