Security on t0ul

How I got my CISSP

Wed, 25 Jan 2023 00:00:00 +0000

Intro

The Certified Information Systems Security Professional or CISSP is known for its rigorous exam and challenging requirement of needing at least 5 years of experience working in security-related roles.

I’m happy to say I was able to pass on the first attempt and would like to share my experience and study path with others interested in the CISSP.

I. Career Background

DevSecOps engineer for 4 1/2 years building security features for a platform in AWS cloud with Python, Go, and Kubernetes which obtained the ISO 27001 & ISO 27002 type I and Type II. During that time, I also received the AWS security specialty certification. Then moved to a whole security infrastructure security analyst job for about 5 months before attempting the CISSP Exam.

DevSecOps Engineer Resume

Mon, 10 Oct 2022 00:00:00 +0000

In this post, I provide my DevSecOps Engineer Resume as an example, and the tool I wield to make it competitive when applying to jobs.

Current DevSecOps Engineer Resume

I use a plain text-style resume when applying online to jobs because of the Applicant Tracking System (ATS), which is a piece of software that scans most people’s resumes whenever they apply online.

How to Use Anchore Inline Docker Image Scan

Wed, 04 Mar 2020 00:00:00 +0000

Introduction

Anchore is a tool that scans Docker images for common vulnerabilities and not so common vulnerabilities if you purchase the paid version. However, the free version is useful and should still be used on your team to avoid common vulnerabilities.

Thankfully, the Anchore team is kind enough to have created an entire shell script to both install the Anchore Database locally and run the Anchore CLI all in one line.

How to use Kubebench to Add Security to a Kops Provisioned Kubernetes Cluster

Mon, 17 Jun 2019 00:00:00 +0000

Kops is a popular opensource tool that makes it easier to provision and deploy Kubernetes clusters in Cloud Service Providers.

However, the default provisioning may not adhere to the best practices as outlined by Kube-bench for Security, and kops probably cannot achieve a one-size-fits-all security solution as each user’s use of kops may vary.

Yet, one should be aware of what default security choices kops makes on behalf of the user, which are generally well, thanks, kops team!

How to use Docker Bench Security for Container and Host Hardening

Wed, 17 Apr 2019 00:00:00 +0000

Docker is the rage now in the field of containerization and, as a consequence, is a target for attack.

Although Docker does have some security benefits out of the box upon installation enabled via the default settings, they may not be enough to prevent attacks. This article will focus on using Docker Bench for Security to aid in tweaking the settings of Docker in line with the standard best practices of using Docker.