Shannon -jj Behrens

The Kroxylicious projects is excited (when are we not??) to announce v0.18.0. This release focused on supporting authentication both from the broker and in proxy! Release announcement: https://lnkd.in/gQ89SkUt release artifacts: GitHub: https://lnkd.in/gAaTgFKm Maven Central: https://lnkd.in/ghpcRGRV

23

Praetorian just raining high impact open-source security tools the last couple weeks. Check out their GitHub for some pretty cool capabilities.

9

1 Comment

A week ago my colleague Christian Dupuis wrote a fantastic article on how to do Hardened Images (and container security) right and full transparency is at the very center of it. The magic ingredients for that recipe? - Minimal container images 🤏 - Full SBOMs (yes) 📄 - 100% full and verifiable build provenance 🤝 - VEX  💪 - Signing 🔑 All those are the key pillars for what our team at Docker, Inc is building with DHI (Docker Hardened Images). Check out the link in comments if you want to read that great piece!

14

1 Comment

A colleague shared this blog post with me and I wanted to pass it along with an observation of my own. This team's assessment of vulnerability management tracks with everything I've seen firsthand and what I hear from fellow practitioners. What I had to add is that automation alone is not the cure-all you might think it is. At my employer, we have considerable automation in place to proactively update container images and open-source dependencies. This does seamlessly prevent a lot of exposure. However, it doesn't *feel* like magic. This is because there are a lot of tricky cases that automation can't handle. Manual investigation and remediation are still the norm. When automation resolves your easy issues, the hard ones remain. It becomes easy to overlook and take for granted the contribution that automation makes. Absolutely, automated vulnerability remediation will dramatically reduce your attack service, and you should apply it. But it will not remove the pain of thorny triage and remediation efforts. You're still going to need AppSec experts in investigate issues, and they're still going to be busier than you'd like. https://lnkd.in/eD-w6N3k

2

POV: It’s 2026 and your manual infrastructure is a ticking time bomb. 💣 If you’re still running terraform apply from your local terminal, we need to talk. Production-grade IaC isn't just about "making it work"—it’s about making it unbreakable. The 2026 Playbook for Terraform Elites: 🔒 State Isolation is King: Local state is a myth. Use S3/GCS with DynamoDB locking. Separate your Dev/Prod states or prepare for a $100k "oopsie." 📦 Modular or Bust: Stop copy-pasting code. Build versioned modules. Pin everything. If a provider update can break your stack, your stack is already broken. 🛡️ Zero-Trust Secrets: Hardcoding passwords in .tfvars? Straight to jail. 🚩 Fetch them dynamically from HashiCorp Vault or AWS Secrets Manager. 🤖 Policy-as-Code (PaC): Don't just plan. Use Open Policy Agent (OPA) to auto-kill any PR that tries to open Port 22 to the world. Stop clicking buttons. Start scaling logic. 🚀 What’s your #1 Terraform "lesson learned" the hard way? Drop it below. 👇 #DevOps #Terraform #CloudNative #SRE #InfrastructureAsCode

8

💥 Vulnerability management is broken. 📊 Thousands of findings. 🧾 Dozens (or hundreds) of tickets. 🤯 Developers are overwhelmed. 🔄 Security teams stuck in triage loops. Most teams still focus on individual findings, not on actionable remediations. And they often prioritize based on CVSS—not business impact or risk appetite. It’s time to rethink the approach. 🚀 Over the next few days, I’ll be sharing how we can: 👉 Group vulnerabilities into meaningful remediation units 👉 Reduce noise while increasing actionability 👉 Build a prioritization system aligned with real risk and the organization’s tolerance level 🧠 The goal? Shift from reporting problems → to delivering solutions developers can apply. Follow along—this might change how your team tackles vulnerabilities.

22

3 Comments

Really great example of secure by design - "Declarative data format, not executable code. Agents can only use pre-approved components from your catalog—no UI injection attacks." https://a2ui.org/

29

Just published a new blog post on how engineering teams can “shift down” compliance into platform abstractions. I share thoughts on compliance leverage, OSCAL components vs capabilities, and how platforms can carry the heavy lifting for controls like TLS and mTLS—freeing developers from duplicating effort. Read it here: https://lnkd.in/eh5cABU5 #OSCAL #ComplianceEngineering #PlatformEngineering #ComplianceAutomation

9