Blogs and News
Introducing the Flux Operator - GitOps on Autopilot Mode
Stefan Prodan, core maintainer of the CNCF Flux project, introduces the Flux Operator.
ControlPlane Outreach: Exposing At-Risk Students to Careers in Tech
ControlPlane partnered with Spark! to empower at-risk students through workshops that introduced them to tech careers, continuous learning, and future possibilities.
Future Open Source LLM Killchains! A Talk by Vicente Herrera
In The Security Ai Summmit 2024, Principal Consultant Vicente Herrera explores how advanced adversaries could exploit vulnerabilities in the open-source AI ecosystem, particularly in large language models (LLMs), by targeting MLOps infrastructure, with a focus on mitigation strategies to prevent such attacks.
FINOS AI Readiness Open Sourced
ControlPlane’s pivotal role in the FINOS AI Governance Framework highlights our commitment to advancing AI readiness in financial services.
Smarter Than Your Average SBOM! A Talk by Matt Jarvis & Andrew Martin
In Kubernetes Community Day UK 2023 Snyk, Director Matt Jarvis and ControlPlane CEO Andrew Martin teamed up and deeply delved into the Software Bill of Materials (SBOMs) world
FINOS AI Governance Framework
At the Secure AI Summit earlier this year, ControlPlane’s Torin van den Bulk delivered an eye-opening talk on the ‘Invisible infiltration of AI supply chains by adversarial actors’. This talk examines the importance of securing the data, models, and pipelines involved at each step of an AI supply chain.
ControlPlane at the Bleeding Edge: Ending the Pain of Periods
The ControlPlane Agile team is proudly taking steps toward breaking down awkwardness, stigma, and workplace barriers to menstrual health.
I'll Let Myself In: Kubernetes Privilege Escalation Tactics
ControlPlane’s talk at Kubecon Europe 2024 gave attendees an overview of Cloud-Native Penetration Test and privilege escalation tactics to make cloud native systems more secure
The Impact of the Polyfill Supply Chain Attack
Recently a supply chain attack was discovered for the domain cdn dot polyfill dot io which was a popular service for the distribution of an open source library polyfill.js. According to sansec.io, this attack effected over 100,000 sites which involved cdn dot polyfill dot io injecting malware on mobile devices. So what happened in the polyfill.io attack? Polyfill is a service that provides a piece of Javascript code that allows modern functionality on older browsers that do not natively support it.
Mastering the Cloud Native Wave: Security Resilience in Modern Systems
ControlPlane’s talk at InfoSec Europe 2024 gave attendees an overview of observations and techniques to make cloud native systems more resilient"
Abusing VSCode: From Malicious Extensions to Stolen Credentials (Part 2)
High Level Architecture VSCode API Electron safeStorage Chromium OSCrypt Analysis Limited Documentation No Sandboxing Hardcoded Chromium Password 73% of developers use VSCode to work on hobby projects and enterprise software alike. At the same time, a disproportional amount of independent security research has been performed on VSCode to enable the community to make informed, risk-based decisions when it comes to VSCode adoption and hardening. Both Check Point and Aqua show how easily malicious extensions steal personal identifiable information (PII) and other sensitive data by impersonating popular extensions in the VSCode Marketplace.
Abusing VSCode: From Malicious Extensions to Stolen Credentials (Part 1)
Abusing VSCode Features Attack Paths for Remote VSCode Compromise Creating a Malicious Extension Publishing onto VSCode Marketplace Installing the Malicious Extension Attack Path for Stealing Credentials Conclusion Over the past several years, there has been a mantra of “shift left” to push security to the beginning of the development lifecycle. Although this is a great approach to enable developers to focus on functionality whilst providing security guidance, it does so at the cost of creating a powerful multi-functional toolbox which is integrated with source code repositories, CI/CD pipelines, cloud providers and other services.
Open Source Dynamics in the Era of Licence Innovation
This talk looks at the future of open source in the light of the turmoil from new “faux-pen source” business licenses. It explores the intricate dynamics of community-driven software construction, focusing on sustainability challenges with the evolving nature of licenses and business models, and contemplates solutions to the tension between open source principles and hyperscale cloud service providers.
How to create a Table Top Exercise for Cyber Incident Responders
After a fair amount of hard work and collaboration with the OpenSSF and numerous proposed and scrapped scenarios, we launched the OSSF WG Vulnerability Disclosures TTX Documentation. OpenSSF wanted to create, host and run an Incident Response scenario (IR) Table Top Exercise (TTX), in the format of a panellist discussion, held at SOSS Community Day North America, in Seattle. Let’s start with a look behind the scenes at what goes into developing and conducting an effective Incident Response TTX, what worked for us and what didn’t, and how we think these lessons can contribute to anyone else looking to carry out a similar exercise.
Brewing the Kubernetes Storm Center: Open Source Threat Intelligence for the Cloud Native Ecosystem
James Callaghan, principal consultant at ControlPlane, and Constanze Roedig discuss open source cloud native threat intelligence at KubeCon + CloudNativeCon Europe 2024
Flux CD Architecture Overview
Stefan Prodan, core maintainer of the CNCF Flux project, provides a comprehensive overview of Flux CD architectures for multi-cluster continuous delivery
Isovalent and ControlPlane's Joint Whitepaper
Engineers, product managers and consultants from both companies explore how Cilium can tackle the challenges of cloud native compliance
The Lowdown on Locked Namespaces
Marco De Benedictis, senior consultant at ControlPlane, discusses how Kubernetes namespaces have grown from an optional feature to a security boundary at KubeCon + CloudNativeCon Europe 2024
Zero Trust Training Courses with the Linux Foundation
ControlPlane has authored two Zero Trust training courses for the Linux Foundation
ControlPlane at Kubecon EU Paris ‘24 - Recap
A recap of ControlPlane’s activities at Kubecon EU in Paris
The Envoy Gateway End User Threat Model, in collaboration with the Linux Foundation
ControlPlane has collaborated with the Linux Foundation to threat model Envoy Gateway and generate an End User guide
Flux CD: D1 Reference Architecture
ControlPlane’s commitment to supporting the Flux Project continues, providing a model and a guide for multi-cluster, multi-tenant environments
ControlPlane at KubeCon EU '24 Paris
ControlPlane’s talks and events schedule for KubeCon EU in Paris
Container Security Basics at Securi-Tay 2024
ControlPlane’s principal consultant, Iain Smart, talks about Container and Kubernetes Security at Abertay Hackers’ Securi-Tay 2024
NIST Special Publication 800-204D calls for GitOps approaches
Exploring how NIST’s latest publication underscores the necessity of integrating GitOps strategies in software supply chain security within DevSecOps CI/CD pipelines
Bringing light to risks lurking in the black boxes of AI models
ControlPlane’s principal consultant, Vicente Herrera, talks about AI Security at OpenUK’s “State of Open Con 2024”
ControlPlane backs the CNCF Flux Project by Employing Maintainers
ControlPlane’s support for the CNCF Flux project ensures the sustainability and security of critical systems through open source maintenance and innovative enterprise solutions
ControlPlane and Scott Logic Collaborate on Scottish Government Identity and Payments Systems
Collaborative efforts between ControlPlane and Scott Logic on the Scottish Government identity and payment systems: security architectures, platform integrations, and project assurance
Tangible Value with ControlPlane Enterprise for Flux CD
ControlPlane Enterprise elevates Flux CD with enhanced security, support, and compliance, catering to diverse needs in Kubernetes deployments
AI Software Development Lifecycle on Kubernetes
AI software’s evolution on Kubernetes: current methodologies, potential future developments, and inherent risks
ControlPlane at OpenSSF and Open Source Summit Japan, 2023
ControlPlane’s journey to Japan and an overview of some of the talks presented
Navigating Cloud Security and Automation with Eficode
Talking to Eficode about Cloud Native Security Challenges
Play the 2023 CNCF CTF Scenarios with the Revamped Simulator
The public release of the 2023 CNCF CTF Scenarios is here! In this blog post, we’ll walk you through the revamped simulator and how to get started with the challenges.
Cloud Native and Kubernetes Security Predictions 2024
A look into the tumultuous waters of cloud and Kubernetes security in 2024
Andrew Martin on "Nerding Out With Viktor" — Security, Penetration Testing, and Threat Modelling
The inaugral “Nerding Out With Viktor” podcast with ControlPlane CEO, Andrew Martin
Unveiling the Future of CI/CD Security: A Deep Dive into Advanced Practices
The “Advanced CI/CD Security” workshop we ran at DevOpsCon 2023 in Munich provided a deep dive into the latest practices shaping the future of cloud security
Conference Recap: ControlPlane at KubeCon NA '23 Chicago
Reflecting upon our experience at KubeCon North America 2023
ControlPlane at KubeCon NA '23 Chicago
Where to find ControlPlane talks and events at KubeCon North America 2023 in Chicago
Take Zero Trust to the Next Level with Confidential Virtual Machines
SPIFFE and confidential computing are two security projects that minimize the level of implicit trust a user needs to place into a computing system. We will show how to combine these approaches to minimize the trust we need to place in public cloud services
The National Cybersecurity Strategy Implementation Plan
The first annual iteration of the National Cybersecurity Strategy Implementation Plan has been released, detailing how the US government plans to achieve the goals previously outlined in 2021’s National Cybersecurity Strategy
Dark Matter Cloud Anonymous: Andrew Martin and Amanda Brock discuss open source and OpenUK’s report
The event took questions from an audience of industry veterans and discussed open source security, developer understanding of Kubernetes, FinOps for cloud, and more
Charting Zero Trust and High Assurance: ControlPlane’s Takeaways from the NIST Multi-Cloud and OSCAL Conferences
ControlPlane’s Experience at the 4th Annual OSCAL and Multi-Cloud Conferences Sponsored by NIST
Conference Recap: ControlPlane at KubeCon EU '23
ControlPlane talk & event write-ups from KubeCon EU in Amsterdam
Threat Modelling Zero Trust at KubeCon EU 2023 Amsterdam
ControlPlane show you how to threat model Zero Trust architectures at KubeCon Europe 2023 in Amsterdam
Kubecon EU '23: Open Source Releases
ControlPlane open sources security and threat model knowledge
Netassert v2: Network Security Testing
How to write, test, and secure your network configurations
Collie: A toolkit for securing cloud controller provisioned infrastructure
Demonstrating compliance and securing infrastructure provisioned by Kubernetes Cloud Infrastructure Controllers
ControlPlane at KubeCon EU 2023 Amsterdam
Where to find ControlPlane talks and events at KubeCon Europe 2023 in Amsterdam
Intro to the CloudNative SecurityCon CTF
Capture-the-Flag platform demo with The New Stack 🔐🏴☠️
The Most Excellent Learnings of CloudNative SecurityCon 2023
The Cloud Native security community is vibrant and strong 🌩🎉
The Inaugral CloudNative SecurityCon, North America, and Security Zero Day
Cloud Native security bursts onto the conference circuit 🌩🎉
SPIFFE: The Keystone Species of Cloud Native Security
Short-lived cryptographic identities are the basis upon which secure communication and access control are built 🖧🙊
Cloud Native and Kubernetes Security Predictions 2023
A speculative look into the perils and opportunities that 2023 holds 🕵️🔎
ControlPlane Accelerates International Expansion
ControlPlane expands into North America and APAC with two key executive hires 📈
KubeCon NA 2022 - Techstrong TV interview
Andrew Martin joins Mitch Ashley of Techstrong TV for a chat about ControlPlane, Hacking Kubernetes, and avoiding configuration gotchas 📺
An evening of network security
An evening of network security by Tailscale and ControlPlane 🔐
ControlPlane at KubeCon NA 2022 Detroit
Where to find ControlPlane talks and events at KubeCon North America 2022, Detroit ☸
The Future of Open Source Technology in Financial Services
ControlPlane’s New York City event with FINOS 🏙
What's New - Kubernetes 1.25 Security Features
Overview of new security features in Kubernetes v1.25 ☸🔐
VEXing challenges - ControlPlane at the Open Source Summit Europe 2022, Dublin
ControlPlane and OpenUK information at the Open Source Summit Europe 2022 in Dublin 🔐
OpenUK Reports on the State of Open: The UK in 2022
ControlPlane contributes to the definitive open source report for the UK
Walking the talks - ControlPlane at KubeCon Europe 2022
ControlPlane talks at Kubecon EU, 2022 ☸
Shift Left: Where Cloud Native Computing Security Is Going (The New Stack)
DevSecOps leaders on the direction of CloudNative Security
Securing the Kubernetes Supply Chain: Software Factory Reference Architecture
Sophisticated mechanisms and best practices to enhance defenses against supply chain threats in Kubernetes
Hardening Git for GitOps
ControlPlane whitepaper on securing GitOps workflows at source ✍
CNCF Cloud Native Security Whitepaper
ControlPlane collaborates with authors in sig-security 📜
Hands-on Kubernetes Security
Learning Kubernetes the Secure Way 💻
Kubernetes Predictions 2019
5 predictions and 5 wishes for Kubernetes in the year ahead 🕵️🔎
ControlPlane Sponsors PhD of in-toto Author Santiago Torres
ControlPlane, the open source and cloud native security company, sponsors the PhD work of in-toto author Santiago Torres, furthering the advancement of software supply chain security.
11 Ways (Not) to Get Hacked
An overview of essential security features for Kubernetes, and a glance to the future 👨🚀