1
00:00:00,000 --> 00:00:02,900
Well, I've been reading through a draft of your book,

2
00:00:03,460 --> 00:00:07,200
securing cloud applications. And, and you know, it's, it's a great,

3
00:00:07,280 --> 00:00:11,640
I like the way you lay out the you know, I, I mean, I mean,

4
00:00:11,640 --> 00:00:13,300
it's an obvious, well,

5
00:00:13,540 --> 00:00:16,860
it's one of those obvious things that's worth always being obvious about

6
00:00:16,860 --> 00:00:19,420
because one forgets it. And it's like, this is a security,

7
00:00:19,420 --> 00:00:22,080
like many technical things is a confusing topic.

8
00:00:22,300 --> 00:00:26,440
And the reason it's probably confusing is because you don't understand all the

9
00:00:26,440 --> 00:00:28,020
small little components it's made of.

10
00:00:28,020 --> 00:00:31,400
So when you get some mysterious error message and I,

11
00:00:31,540 --> 00:00:32,140
back when I programmed,

12
00:00:32,220 --> 00:00:35,380
I would get this and it says something about a certificate or something.

13
00:00:35,380 --> 00:00:37,000
And you're like, I have no idea what's happening.

14
00:00:37,000 --> 00:00:40,080
And then you're just like, as a developer, you're like, security is terrible.

15
00:00:40,080 --> 00:00:44,860
I don't like it. And so, you know, to, I, I would say, you know,

16
00:00:44,980 --> 00:00:49,360
that the developer experience or dev X,

17
00:00:49,420 --> 00:00:53,220
as people like to say that the developer experience of security is pretty awful

18
00:00:53,220 --> 00:00:57,800
still, it seems like. And, and my question to you is like,

19
00:00:57,800 --> 00:01:01,420
why, why, why is it so complicated? Why don't they just fix that?

20
00:01:01,420 --> 00:01:03,260
Like what, what's the deal?

21
00:01:04,620 --> 00:01:10,440
Well, I, I, I think that security is complicated because of all those little details.

22
00:01:10,440 --> 00:01:15,240
Like I personally would consider myself to have had a headstart on that.

23
00:01:15,240 --> 00:01:17,960
Cause in the nineties, when I was in university in the late nineties,

24
00:01:17,960 --> 00:01:21,580
a lot of my friends were like security geeks and,

25
00:01:21,580 --> 00:01:25,280
I would just read like a whole bunch of the books. I read like, you know,

26
00:01:25,280 --> 00:01:29,620
the Bruce, Bruce Schneider, Schneider's book, like, you know,

27
00:01:29,620 --> 00:01:32,020
the big thick one, like that explains all the algorithms.

28
00:01:32,020 --> 00:01:34,040
I was kind of cool and all of that.

29
00:01:34,100 --> 00:01:37,200
So over the years, I've always read security books regularly,

30
00:01:37,200 --> 00:01:39,400
but I cared more about application architecture.

31
00:01:39,540 --> 00:01:40,240
There was so much more,

32
00:01:40,660 --> 00:01:43,020
many more fun things as a developer to pay attention to.

33
00:01:43,420 --> 00:01:48,100
The other problem is that like security books and security content tends to assume,

34
00:01:48,180 --> 00:01:49,040
you know, a lot of math.

35
00:01:49,760 --> 00:01:52,780
And if you do, you really enjoy it.

36
00:01:52,980 --> 00:01:56,940
And it always, and if you, if you don't, and you're like, don't care about that math,

37
00:01:57,060 --> 00:01:59,180
then like it's mysterious.

38
00:01:59,720 --> 00:02:05,740
And, um, none of the settings make sense because it's a situation where you don't know that you

39
00:02:05,740 --> 00:02:06,880
don't know something.

40
00:02:07,400 --> 00:02:11,300
So if you don't know that you don't know something, you don't even know that you need it.

41
00:02:11,380 --> 00:02:15,760
So, you know, my first bout of fighting with a security system was,

42
00:02:15,760 --> 00:02:21,420
I was doing a consulting project at a bank trying to connect to the mainframe with WebSphere

43
00:02:21,420 --> 00:02:24,360
MQ and my Java program wasn't connecting.

44
00:02:24,740 --> 00:02:28,960
And I had these mysterious error messages and it took me like, uh, I don't know.

45
00:02:29,020 --> 00:02:32,980
It took me to be like a week to debug it because I had to go buy a book on how TLS worked,

46
00:02:33,400 --> 00:02:40,120
read the book, find all of the debug arguments for the JVM to finally understand what were the

47
00:02:40,120 --> 00:02:42,880
Cypher suite settings that were required to make it work.

48
00:02:43,140 --> 00:02:45,780
And at the end of it, I was like, wow, that's really cool.

49
00:02:45,860 --> 00:02:46,760
I learned all the stuff.

50
00:02:46,980 --> 00:02:51,280
I'm like, and the other part of it was like, oh no, nobody at the bank will know how to do

51
00:02:51,280 --> 00:02:51,520
this.

52
00:02:51,600 --> 00:02:53,100
Like the average developer won't.

53
00:02:53,380 --> 00:02:56,380
So I think there's been a general lack of just teaching the basics.

54
00:02:56,560 --> 00:03:01,760
There are no, there aren't very many developer friendly security books that are treating the

55
00:03:01,760 --> 00:03:02,700
developer with respect.

56
00:03:03,800 --> 00:03:04,200
Yeah.

57
00:03:04,280 --> 00:03:04,500
Yeah.

58
00:03:04,500 --> 00:03:09,800
And, and it seems like, you know, reading, reading through, uh, through, through your book,

59
00:03:09,800 --> 00:03:16,360
you know, to your point, it's sort of like a lot of that, it's like describing a tool.

60
00:03:16,360 --> 00:03:22,580
A lot of the security stuff I encounter is describing how to use a security tool in the context of

61
00:03:22,580 --> 00:03:27,280
security rather than in the context of like, I'm doing an application.

62
00:03:27,280 --> 00:03:31,660
And, and I mean, the example you gave is, is, is a good one.

63
00:03:31,660 --> 00:03:35,860
It's just like, as an application developer, you're like, I just want to connect to a mainframe

64
00:03:35,860 --> 00:03:38,440
and like get some information or tell it to do something.

65
00:03:38,640 --> 00:03:42,480
And now I'm spending a week learning something else.

66
00:03:42,480 --> 00:03:48,060
And, and this, this something else isn't really, I mean that I, to be fair, I haven't really

67
00:03:48,060 --> 00:03:53,760
like looked at security stuff in a long time, but when I do look at it, it often seems like

68
00:03:53,760 --> 00:04:00,440
it's like security things are not necessarily like thinking in terms of a developer.

69
00:04:00,440 --> 00:04:03,780
Like, I mean, I'll give you a, an ancient example, right?

70
00:04:03,780 --> 00:04:08,340
Like I was just remembering as we, before we were recording that I, uh, this book you're

71
00:04:08,340 --> 00:04:10,600
writing is a Manning is you're doing it with Manning.

72
00:04:10,600 --> 00:04:15,800
And I wrote a book with them that they decided not to publish about the, uh, Java authentication

73
00:04:15,800 --> 00:04:17,460
and authorization service.

74
00:04:17,600 --> 00:04:23,220
And I remember, I remember going through doing that and, and it was equally like just confounding

75
00:04:23,220 --> 00:04:24,540
like, like the way that it worked.

76
00:04:24,540 --> 00:04:30,720
And I remember using it and thinking like, I don't know if anyone who's, who wrote this,

77
00:04:31,220 --> 00:04:36,960
the jazz stuff, like actually wrote applications that work with it because it's a very, like,

78
00:04:37,340 --> 00:04:41,020
it's a very well, what is it?

79
00:04:41,120 --> 00:04:46,480
It's a very beautiful system, but then you're basically as, as an application developer, you're

80
00:04:46,480 --> 00:04:51,280
like, I want to log someone in and see if they can access the, the, the Jackson report.

81
00:04:51,380 --> 00:04:52,780
That's really all I want to do.

82
00:04:53,040 --> 00:04:55,260
Like, yeah, it is.

83
00:04:55,320 --> 00:05:01,440
And that, that particular API is super mysterious because there's no standard definitions of

84
00:05:01,440 --> 00:05:02,580
what terms mean in the industry.

85
00:05:02,980 --> 00:05:04,860
So like take the, something as a user.

86
00:05:04,980 --> 00:05:05,700
Oh, it's principle.

87
00:05:05,780 --> 00:05:06,300
It's a user.

88
00:05:06,420 --> 00:05:08,240
No, it's a, it's a system identifier.

89
00:05:08,240 --> 00:05:11,260
Like it's whatever who, who, you know, it's a subject, right.

90
00:05:11,420 --> 00:05:15,500
And it's a, there's a subject and an object and it's, it's, it's really, there isn't a

91
00:05:15,500 --> 00:05:16,880
consistent way to do it.

92
00:05:17,140 --> 00:05:23,680
Like, like some of my other security fights were literally like designing the security architecture

93
00:05:23,680 --> 00:05:25,040
of particular applications.

94
00:05:25,040 --> 00:05:32,580
So an application I worked on in the early days before, you know, the iPhone was like

95
00:05:32,580 --> 00:05:33,220
a mobile app.

96
00:05:33,360 --> 00:05:34,840
So you had these HP iPacks.

97
00:05:34,900 --> 00:05:36,000
I don't know if you remember those.

98
00:05:36,280 --> 00:05:36,720
Yeah.

99
00:05:37,260 --> 00:05:39,120
ECMCI card you put in the back of it.

100
00:05:39,300 --> 00:05:44,320
And then it was like a platform where you could build little apps to do things that people

101
00:05:44,320 --> 00:05:45,060
need to do in the field.

102
00:05:45,060 --> 00:05:49,440
Like you have a bunch of appliance repair technicians and you want to be able to say,

103
00:05:49,540 --> 00:05:54,840
Hey, there's a customer called in and we need to dispatch a tech to this location to fix

104
00:05:54,840 --> 00:05:55,240
an appliance.

105
00:05:55,440 --> 00:05:55,620
Right.

106
00:05:55,640 --> 00:05:59,540
And then whoever responds first gets to go do that, that repair.

107
00:05:59,680 --> 00:05:59,840
Right.

108
00:06:00,840 --> 00:06:06,740
And how do you, how do you like build a platform like that and isolate different companies,

109
00:06:07,080 --> 00:06:09,420
you know, apps from each other?

110
00:06:09,580 --> 00:06:13,180
How do you get just the right apps to the devices, the right data to the devices?

111
00:06:13,660 --> 00:06:20,720
And so it was a lot of these types of app security architecture things where the security was

112
00:06:20,720 --> 00:06:22,600
part of the business requirements of the app.

113
00:06:23,140 --> 00:06:29,380
So you couldn't, you couldn't avoid thinking about it because you had these sophisticated

114
00:06:29,380 --> 00:06:30,520
ways of doing it.

115
00:06:30,560 --> 00:06:36,400
So that was like the second bout of, of like consecutively over a period of probably 10

116
00:06:36,400 --> 00:06:41,920
years, I did that three times or three or four times for several applications, but had a complex

117
00:06:41,920 --> 00:06:46,380
application security requirement and boiled down to learning things like role-based access

118
00:06:46,380 --> 00:06:49,060
control and attribute-based access control.

119
00:06:49,060 --> 00:06:54,580
And boy, it was that hard because I'd be like searching online and like reading, reading

120
00:06:54,580 --> 00:06:59,640
like papers that PhD students were writing to try to decipher what this stuff was.

121
00:06:59,740 --> 00:07:03,980
And at the end of it, again, the same thing, like they're not really writing apps.

122
00:07:04,540 --> 00:07:08,440
They're, they're trying to prove that the security model is awesome for some reason.

123
00:07:08,620 --> 00:07:14,360
And I'm like, but I just want one user to share, to be able to share this data with that one

124
00:07:14,360 --> 00:07:20,880
without actually having to do it like 50 million times, like change 50 million settings.

125
00:07:20,880 --> 00:07:27,360
And it, it, it, it, it taught me a lot about like, like that security isn't one thing.

126
00:07:27,780 --> 00:07:29,940
There's different layers to security.

127
00:07:29,940 --> 00:07:34,320
And there are some things that I could use as building blocks as a developer.

128
00:07:34,900 --> 00:07:39,840
And what I have to know about those things is not how they work, but how to configure them.

129
00:07:40,840 --> 00:07:47,380
So like a good example of that would be like, okay, um, my customers in due diligence are

130
00:07:47,380 --> 00:07:49,380
asking, are all your communications secure?

131
00:07:49,560 --> 00:07:49,740
Sure.

132
00:07:49,860 --> 00:07:50,380
They're secure.

133
00:07:50,380 --> 00:07:51,580
Well, how are you securing them?

134
00:07:51,640 --> 00:07:54,220
Well, with TLS, well, what cipher suite are you using?

135
00:07:54,340 --> 00:07:55,540
Well, what's a cipher suite, right?

136
00:07:55,620 --> 00:08:00,360
Well, you need now need to know what the block encryption algorithm is.

137
00:08:00,400 --> 00:08:03,060
You need to know what the hash function that's being used is.

138
00:08:03,160 --> 00:08:03,360
Okay.

139
00:08:03,380 --> 00:08:04,840
What's a block encryption algorithm?

140
00:08:05,180 --> 00:08:06,440
What's a hash function, right?

141
00:08:07,020 --> 00:08:11,240
And, oh, look, this hash function has like 512, 384 and 256.

142
00:08:11,500 --> 00:08:12,380
Well, which one should I use?

143
00:08:12,720 --> 00:08:13,240
I don't know.

144
00:08:13,260 --> 00:08:14,040
I'll just use 512.

145
00:08:14,140 --> 00:08:15,540
That sounds like more secure than.

146
00:08:16,520 --> 00:08:17,240
Right, right, right.

147
00:08:17,440 --> 00:08:19,880
And you're like, you're sitting there trying to

148
00:08:19,880 --> 00:08:24,820
make these decisions and, um, and, and you're, you just don't have the background.

149
00:08:24,820 --> 00:08:30,900
And that's what I found that because I was willing to read the math books, I developed a

150
00:08:30,900 --> 00:08:33,140
decent understanding of what these things are.

151
00:08:33,140 --> 00:08:38,480
And I'm like, I'm never going to implement the security libraries, but at least I know what the configuration settings do.

152
00:08:39,240 --> 00:08:43,660
Uh, and most of my colleagues weren't able to, didn't know that and couldn't debug anything because of that.

153
00:08:44,160 --> 00:08:44,520
Yeah.

154
00:08:44,640 --> 00:08:57,600
No, I, you, you, you, you, you raise a, another, I mean, another fun, slightly snarky thing is like, at some point, it's probably a bad idea to give configuration options that you should never use.

155
00:08:58,540 --> 00:08:58,980
Right.

156
00:08:58,980 --> 00:09:07,680
Like, and, and I, I mean, that happens in all aspects of programming and systems and stuff, but, and, and whatever, there's good reasons to do it.

157
00:09:07,680 --> 00:09:22,240
But, you know, I mean, it seems like, especially when it comes to security at some point, if there's like, you know, not good, if there, if anything, if any, like, uh, part of a system includes the word weak, it should probably just not exist.

158
00:09:22,240 --> 00:09:22,680
Right.

159
00:09:22,740 --> 00:09:24,860
Like it's, it should be called out of there.

160
00:09:25,180 --> 00:09:32,820
And I think, I think that that's an unfortunate, um, you're right about that, but I think the U S export policy had something to do with that.

161
00:09:33,300 --> 00:09:33,860
Oh yeah.

162
00:09:33,860 --> 00:09:34,520
I could see that.

163
00:09:34,580 --> 00:09:34,740
Yeah.

164
00:09:34,740 --> 00:09:38,900
Cause I remember like, like, so I started at university like in 1995, right.

165
00:09:39,100 --> 00:09:41,820
And, um, uh, at the university of Waterloo.

166
00:09:41,820 --> 00:09:49,120
And one of the cool books that was there was like a printout of PGP, like, uh, the PGP pretty good privacy email system.

167
00:09:49,440 --> 00:10:01,060
And, and you'll open up the book and it was just C code, like from beginning to end, because it was illegal to export strong cryptography out of the U S but the U S first amendment protects freedom of whatever.

168
00:10:01,060 --> 00:10:03,980
I said, which one is the amendment that says you can publish anything you want?

169
00:10:04,700 --> 00:10:08,060
Uh, I, I, as an American, I should know, but I forget.

170
00:10:08,200 --> 00:10:10,840
Whatever that one that says you have the freedom to say whatever you want.

171
00:10:10,980 --> 00:10:12,980
I think that's your, your first amendment rights.

172
00:10:13,100 --> 00:10:13,260
Yeah.

173
00:10:13,360 --> 00:10:13,540
Yeah.

174
00:10:13,780 --> 00:10:14,700
Whatever it is.

175
00:10:14,940 --> 00:10:18,600
And so they're like, ah, the loophole is publish all the source code in book format.

176
00:10:18,920 --> 00:10:22,920
You can sell the book wherever you want because, well, you're not exporting software.

177
00:10:23,140 --> 00:10:23,600
It's speech.

178
00:10:23,760 --> 00:10:24,180
It's speech.

179
00:10:24,260 --> 00:10:24,760
Of course.

180
00:10:24,940 --> 00:10:25,560
It's speech.

181
00:10:25,880 --> 00:10:31,400
So all you have to do is like retype all of that and, and you would be, you'd be in good shape, right?

182
00:10:31,440 --> 00:10:33,240
You'd have a, you'd have a working thing.

183
00:10:33,460 --> 00:10:41,420
And I think that's why all these like kind of in quotes, weak security existed before, um, or weak defaults for all sorts of things.

184
00:10:41,840 --> 00:10:45,120
Yeah, yeah, yeah, no, that, that, that's a, that would make a lot of sense.

185
00:10:45,200 --> 00:10:48,660
So, so then the other thing I, I, well, first, why don't you introduce yourself?

186
00:10:50,440 --> 00:10:51,020
Oh, sure.

187
00:10:51,020 --> 00:10:51,380
Thanks.

188
00:10:51,380 --> 00:10:52,940
Um, so my name is Adip Saikali.

189
00:10:53,080 --> 00:10:56,940
I'm currently a principal solutions engineer with, uh, with VMware.

190
00:10:57,280 --> 00:11:10,680
My customers typically like to call me the code janitor, uh, because they, you know, over the past seven years, uh, that I've been with pivotal VMware, uh, I've been in, uh, situations where customers will say, here's a USB stick.

191
00:11:10,680 --> 00:11:13,700
We've got, you know, uh, three gigs of source code on here.

192
00:11:14,040 --> 00:11:15,940
It's this app makes us a billion dollars a year.

193
00:11:16,040 --> 00:11:17,060
We don't know what to do with it.

194
00:11:17,120 --> 00:11:18,100
We have a hundred developers.

195
00:11:18,320 --> 00:11:20,000
How do we make this app more cloud native?

196
00:11:20,300 --> 00:11:20,500
Right.

197
00:11:20,560 --> 00:11:30,180
And they're typically by the time I get a chance to look at it, they've already, uh, worked with two or three of the big solutions, uh, SIs, and they've made many attempts and tried many things.

198
00:11:30,760 --> 00:11:35,520
And I typically will say, great, let me read the source code first, and then I'll give you some recommendations.

199
00:11:36,060 --> 00:11:48,840
Um, and so this is why I get called the code janitor and, um, uh, typically, you know, I end up, uh, helping them delete a few hundred thousand lines of code, which makes me very happy.

200
00:11:48,840 --> 00:11:53,980
It gives me great pleasure to remove hundreds of thousands of lines of code from, uh, from applications.

201
00:11:54,360 --> 00:12:01,620
And inevitably, as part of that transformation, security pops up because, uh, they're like, we want to make things more secure.

202
00:12:01,860 --> 00:12:06,400
We have an infosec team that we need to present to what we're doing, how we're modernizing things.

203
00:12:06,900 --> 00:12:11,300
And that gets into a lot of like, oh, we're, we're confused.

204
00:12:11,520 --> 00:12:16,280
Uh, we have this app deployed to a thousand stores and we need to authenticate this API call.

205
00:12:16,460 --> 00:12:17,220
How do we do it?

206
00:12:17,480 --> 00:12:21,560
Um, well, these are your three ways of doing it, but that kind of sounds hard.

207
00:12:21,600 --> 00:12:22,440
We don't want to do that.

208
00:12:22,600 --> 00:12:23,640
Well, okay.

209
00:12:23,640 --> 00:12:24,440
What would you like to do?

210
00:12:24,480 --> 00:12:25,740
Well, we're buying an API gateway.

211
00:12:25,840 --> 00:12:27,000
It's going to solve all our problems.

212
00:12:27,000 --> 00:12:28,020
It's going to cook us breakfast.

213
00:12:28,720 --> 00:12:29,080
Okay.

214
00:12:30,080 --> 00:12:35,180
Um, and so you end up with these types of situations where security becomes a blocker for evolution

215
00:12:35,180 --> 00:12:35,740
of the system.

216
00:12:36,560 --> 00:12:40,140
And a lot of the time, the software teams just need a little bit of help to do that.

217
00:12:40,200 --> 00:12:42,140
So, so that's, that's what I do.

218
00:12:42,200 --> 00:12:43,360
I spend my time doing that.

219
00:12:43,360 --> 00:12:49,300
And, um, I, I really decided to write this book, the securing cloud applications with Manning,

220
00:12:49,420 --> 00:12:51,480
uh, because it's the book I wish I had.

221
00:12:51,980 --> 00:12:59,660
Like if I had it, I would probably have spent, uh, I'm not kidding, at least 30 or 40 days

222
00:12:59,660 --> 00:13:03,440
of time with the family that I didn't because I was divulging some security issue.

223
00:13:04,820 --> 00:13:05,220
Yeah.

224
00:13:05,320 --> 00:13:05,520
Yeah.

225
00:13:05,700 --> 00:13:06,020
Yeah.

226
00:13:06,380 --> 00:13:06,820
Yeah.

227
00:13:06,980 --> 00:13:07,200
Yeah.

228
00:13:07,340 --> 00:13:07,500
No.

229
00:13:07,540 --> 00:13:14,980
And so, yeah, the, uh, the, uh, well, so, you know, in, in that, going from that situation

230
00:13:14,980 --> 00:13:20,160
where, where you're, you're janitorizing or whatever the verb for janitor is janitoring.

231
00:13:20,160 --> 00:13:26,760
Anyways, uh, so, you know, in, in our, in our world, our industry, there's this phrase

232
00:13:26,760 --> 00:13:29,420
dev sec ops, which is fine.

233
00:13:29,700 --> 00:13:35,660
And, and, uh, I think, I think maybe, I mean, we can get to this in a little bit, but maybe

234
00:13:35,660 --> 00:13:40,300
we've settled on what that means after like a couple of years of tossing things back and

235
00:13:40,300 --> 00:13:40,540
forth.

236
00:13:40,700 --> 00:13:47,120
But as, as you were explaining or kind of going over, you know, dealing with the mainframe

237
00:13:47,120 --> 00:13:49,880
and cleaning up this code and stuff, it was making me think.

238
00:13:49,880 --> 00:13:56,580
So in, in the DevOps world, when, when DevOps was evolving, there was first this notion

239
00:13:56,580 --> 00:14:01,880
of, let's call it the full stack engineer that the developer is going to be doing operations

240
00:14:01,880 --> 00:14:02,440
stuff.

241
00:14:02,440 --> 00:14:02,900
Right.

242
00:14:02,900 --> 00:14:08,360
And, and that they are, they should know about operations things now, because that's going

243
00:14:08,360 --> 00:14:09,160
to be part of their job.

244
00:14:09,160 --> 00:14:10,660
Cause you build it, you run it or whatever.

245
00:14:11,020 --> 00:14:18,400
And I think during that time, there were a lot of new tools, not only, you know, nowadays

246
00:14:18,400 --> 00:14:22,160
DevOps is all about culture and process and things like that, which is fine.

247
00:14:22,240 --> 00:14:24,480
But back, back then it was just all tools.

248
00:14:24,580 --> 00:14:26,400
There was a bunch of tools and automation things.

249
00:14:26,400 --> 00:14:31,200
And that kind of comprised having developers or whoever be able to do DevOps stuff.

250
00:14:31,200 --> 00:14:36,620
And then eventually I think what, what DevOps more became was sort of like operations people

251
00:14:36,620 --> 00:14:39,280
should behave more like developers.

252
00:14:39,740 --> 00:14:44,220
Maybe they don't write code, but they will be doing things in a very developer oriented way.

253
00:14:44,320 --> 00:14:48,160
And then eventually you end up with like get ops, which is just like, you know, basically

254
00:14:48,160 --> 00:14:52,760
like operations being developer people, uh, all the way down to checking stuff in, except

255
00:14:52,760 --> 00:14:54,620
I don't think they have programs still, but whatever.

256
00:14:54,960 --> 00:15:00,180
And like, so I, you know, as I was reading through your book and, and, and you were talking

257
00:15:00,180 --> 00:15:06,600
just now, I was thinking like, so with dev sec ops, knowing that path of DevOps, like,

258
00:15:06,600 --> 00:15:14,020
are we, are we expecting developers to like get more knowledgeable about security, like be

259
00:15:14,020 --> 00:15:15,560
a full stack security?

260
00:15:15,700 --> 00:15:16,800
I don't even know what the phrase would be.

261
00:15:16,940 --> 00:15:24,060
Or are we sort of like expecting security people to like make being secure easier for developers?

262
00:15:25,260 --> 00:15:26,820
Uh, that's a, that's a really good question.

263
00:15:26,820 --> 00:15:33,040
And the, the answer, my answer to it is no, I don't expect developers to become, um, like,

264
00:15:33,180 --> 00:15:36,680
uh, the equivalent of a full stack developer for security.

265
00:15:36,680 --> 00:15:44,580
What I think a, uh, is, is more achievable and reasonable goal is to basically have developers

266
00:15:44,580 --> 00:15:50,560
learn the very basics that are needed to more effectively work with security professionals.

267
00:15:51,320 --> 00:15:57,260
So in a lot of my, uh, uh, adventures over the years with customers, um, I get to spend a lot

268
00:15:57,260 --> 00:16:02,240
of time with info sec teams and info sec teams are always paranoid that the developers are going

269
00:16:02,240 --> 00:16:03,700
to do something they're not supposed to do.

270
00:16:03,700 --> 00:16:14,860
And so in order to deal with that, there's a lot of, um, uh, there's a lot of reviews that people do.

271
00:16:15,500 --> 00:16:20,640
And because of the, a lot of the reviews that happen, um, uh, it becomes one of these things

272
00:16:20,640 --> 00:16:25,040
where the auditors need to find something wrong that you did, the inspectors, so to speak.

273
00:16:25,280 --> 00:16:27,200
Otherwise it looks like they're not doing their job.

274
00:16:27,760 --> 00:16:32,820
And, and then you end up with really bizarre rules that kind of were written in the past

275
00:16:32,820 --> 00:16:33,940
and don't make sense.

276
00:16:34,500 --> 00:16:40,780
And developers don't know how to push back on those because they're, they don't have the,

277
00:16:40,920 --> 00:16:42,280
they don't feel like they have the background.

278
00:16:42,980 --> 00:16:47,760
And eventually the people that are doing the check boxing with the security in a large enough

279
00:16:47,760 --> 00:16:51,700
corporation, they're just kind of doing it because that's what they've been told to do.

280
00:16:52,300 --> 00:16:55,500
And it's there, there's like, they can't change the process themselves.

281
00:16:56,180 --> 00:16:57,520
It just gets weird.

282
00:16:57,520 --> 00:17:04,760
So what I'm, what I, I think of it like this, um, a security event could end the company out

283
00:17:04,760 --> 00:17:07,080
of existence in 2021, right?

284
00:17:07,120 --> 00:17:09,600
It's a large enough security event company will go bankrupt potentially.

285
00:17:10,020 --> 00:17:16,240
So CEOs are basically saying, great, I'm going to hire a chief information security officer.

286
00:17:16,240 --> 00:17:21,840
I'm going to empower that CISO to, uh, to make whatever changes are needed to make sure we

287
00:17:21,840 --> 00:17:27,140
don't, you know, we don't get packed and all this type of stuff, but what does that mean?

288
00:17:27,200 --> 00:17:29,920
What does this focus on extra security mean for you as a developer?

289
00:17:30,160 --> 00:17:31,960
In my opinion, it means two things.

290
00:17:32,140 --> 00:17:36,680
Number one, you're expected to use all the security features in the technology that you're

291
00:17:36,680 --> 00:17:37,620
using, right?

292
00:17:37,760 --> 00:17:43,760
So if there's a checkbox to enable more security in a product that you're using, you should

293
00:17:43,760 --> 00:17:44,580
do that, right?

294
00:17:45,380 --> 00:17:48,240
And you shouldn't just like say, ah, I don't know how to configure it.

295
00:17:48,300 --> 00:17:49,820
So I'm not going to do that.

296
00:17:49,820 --> 00:17:55,240
But in order to configure it, you need to understand some basic general security concepts.

297
00:17:56,620 --> 00:18:00,680
Otherwise, if you don't understand the basic security concepts, what will happen is you

298
00:18:00,680 --> 00:18:05,060
will go into Stack Overflow on the Google and be like, how do I configure a mutual TLS

299
00:18:05,060 --> 00:18:05,880
in Spring Boot?

300
00:18:06,440 --> 00:18:06,720
Boom.

301
00:18:06,860 --> 00:18:09,560
You're going to end up with like a hundred blog posts.

302
00:18:09,700 --> 00:18:10,980
Someone will be out of date, right?

303
00:18:11,280 --> 00:18:12,760
You'll copy and paste something.

304
00:18:12,840 --> 00:18:13,520
It works.

305
00:18:13,660 --> 00:18:14,440
And you're like, I'm done.

306
00:18:14,740 --> 00:18:16,900
And then your security people audit it.

307
00:18:17,040 --> 00:18:19,520
They kind of, you know, lose a few hairs in the process.

308
00:18:19,620 --> 00:18:21,900
You go like, what is wrong with developers?

309
00:18:22,140 --> 00:18:22,860
Like, clearly.

310
00:18:23,780 --> 00:18:23,920
Yeah.

311
00:18:24,140 --> 00:18:24,240
Yeah.

312
00:18:24,340 --> 00:18:26,660
So there's that part of it.

313
00:18:27,540 --> 00:18:32,440
And so developers invest a lot of time, like, I want to learn, you know, Spring Security.

314
00:18:32,640 --> 00:18:35,840
I want to learn, you know, some security framework.

315
00:18:35,840 --> 00:18:38,460
But they don't know the basic concepts below it.

316
00:18:39,400 --> 00:18:45,320
So if they know enough of the basic concepts, they can better collaborate with security professionals.

317
00:18:45,520 --> 00:18:48,940
They can better read the corporate security guidance and follow it.

318
00:18:49,920 --> 00:18:52,300
The other side of it is around process.

319
00:18:52,420 --> 00:18:55,480
I think that's where DevSecOps happens.

320
00:18:55,820 --> 00:19:00,940
And I kind of think about that as there's the industry kind of best practices for DevSecOps,

321
00:19:01,040 --> 00:19:01,820
whatever they are.

322
00:19:02,220 --> 00:19:08,200
And within your company, you need to follow whatever your company's process is.

323
00:19:08,300 --> 00:19:12,500
As a developer, you don't need to define what that process is.

324
00:19:12,720 --> 00:19:18,580
You need to be a good citizen and lead by example and be like, yes, I did do all the

325
00:19:18,580 --> 00:19:22,140
things that the DevSecOps process requested me to do.

326
00:19:22,580 --> 00:19:25,600
And not only that, I noticed where the friction was.

327
00:19:25,600 --> 00:19:30,540
And I went and I talked to the InfoSec team that owns whatever aspects of that DevSecOps process.

328
00:19:30,860 --> 00:19:35,320
And I came to them with practical suggestions for how they can make me more productive.

329
00:19:35,880 --> 00:19:40,820
So really moving away from security is a department of no.

330
00:19:42,040 --> 00:19:42,600
Right.

331
00:19:42,740 --> 00:19:47,160
Because they're used to assuming the developers don't know what they're talking about.

332
00:19:48,160 --> 00:19:52,220
To the security being a partner that we can collaborate with.

333
00:19:52,760 --> 00:19:57,960
And there's more trust between the security teams and the development teams.

334
00:19:58,440 --> 00:20:01,100
Because the development teams can talk to them in their language.

335
00:20:02,440 --> 00:20:02,660
Yeah.

336
00:20:03,180 --> 00:20:03,440
Yeah.

337
00:20:03,440 --> 00:20:09,300
No, that's, you know, I feel like, you know, you've chosen two roles in IT and described like

338
00:20:09,300 --> 00:20:12,580
almost every single non-technology problem that occurs.

339
00:20:13,300 --> 00:20:13,820
Right.

340
00:20:13,880 --> 00:20:19,960
Where you have, you have, let's call it N plus one groups of people that have to coordinate

341
00:20:19,960 --> 00:20:23,420
to make a, as we would say, an outcome happen.

342
00:20:23,420 --> 00:20:23,880
Right.

343
00:20:23,880 --> 00:20:27,260
To, to, to just, you know, do something.

344
00:20:27,680 --> 00:20:34,900
And those, it, it, it can seem like from, from a cynical outside observer standpoint that

345
00:20:34,900 --> 00:20:39,880
those two T, those N plus one teams exist to make sure that the other teams don't actually

346
00:20:39,880 --> 00:20:40,500
do anything.

347
00:20:41,320 --> 00:20:41,800
Right.

348
00:20:41,800 --> 00:20:50,400
And, and like, and, and even worse that they like, that they have a poor opinion of the

349
00:20:50,400 --> 00:20:53,960
capabilities and even intelligence of the other teams.

350
00:20:53,960 --> 00:20:54,360
Right.

351
00:20:54,380 --> 00:21:02,000
Like, and instead of, instead of, I think more of the collaborative, maybe even nurturing thing

352
00:21:02,000 --> 00:21:06,500
is to be like, well, some people know some things and other people don't know other things.

353
00:21:06,500 --> 00:21:11,140
And the reason that, the reason that we're separate groups is that we like, and this is

354
00:21:11,140 --> 00:21:16,660
where like, you know, a lot of like DevOps culture stuff gets a little, like needs a lot

355
00:21:16,660 --> 00:21:21,320
of footnotes because, because you use a word like, you know, people specialize in things.

356
00:21:21,320 --> 00:21:21,680
Right.

357
00:21:21,700 --> 00:21:23,160
We can't, we can't all know everything.

358
00:21:23,160 --> 00:21:24,440
So you've got to divide things up.

359
00:21:24,480 --> 00:21:29,700
And so to your point, it'd be great if these N plus one teams like helped each other.

360
00:21:30,660 --> 00:21:32,980
And yeah, I mean, no, it's true.

361
00:21:32,980 --> 00:21:38,400
And it's, I love that you brought up the word specialist, partly because there was like

362
00:21:38,400 --> 00:21:42,760
in my, early in my career, there was this blog post I read before blogs were a thing.

363
00:21:42,820 --> 00:21:44,480
People just had personal websites, I guess.

364
00:21:44,920 --> 00:21:48,680
It was a blog post by Scott Ambler called the generalizing specialist.

365
00:21:48,900 --> 00:21:49,920
I don't know if you've ever read that.

366
00:21:50,120 --> 00:21:52,800
This would have been published in the nineties or maybe long ago.

367
00:21:52,920 --> 00:21:53,200
Yeah.

368
00:21:53,260 --> 00:21:54,720
Like the early, early two thousands.

369
00:21:55,000 --> 00:21:58,960
And back when there were like, you know, software magazines that you would actually buy in

370
00:21:58,960 --> 00:22:03,240
the store, like Dr. Dogs and, you know, go to the store and buy, buy, buy a computer magazine.

371
00:22:04,060 --> 00:22:07,440
And, and what that article argued was that it was brilliant.

372
00:22:07,540 --> 00:22:10,920
It basically said, if you have a team of specialists, they can't get anything done because they can't

373
00:22:10,920 --> 00:22:15,580
talk to each other because you're the database specialist, you're the Java specialist, right?

374
00:22:15,600 --> 00:22:16,720
They talk past each other.

375
00:22:16,720 --> 00:22:16,980
Right.

376
00:22:17,700 --> 00:22:22,480
And if you have a team of, of generalists, you won't get anything done because you don't

377
00:22:22,480 --> 00:22:23,180
have enough skill.

378
00:22:24,300 --> 00:22:28,540
So it was kind of saying, well, we should actually have teams where we have generalizing

379
00:22:28,540 --> 00:22:33,720
specialists and a generalizing specialist was defined, but was defined by Scott as somebody

380
00:22:33,720 --> 00:22:37,640
who was like a, a Jack of all trades, master of a few.

381
00:22:38,460 --> 00:22:42,580
And the idea was that if you had that mix of people on the team, right.

382
00:22:42,740 --> 00:22:50,240
You would actually be able to collaborate effectively while still having the specialist depth to get

383
00:22:50,240 --> 00:22:50,780
stuff done.

384
00:22:50,900 --> 00:22:53,860
I guess nowadays we would probably call that a balance team, right?

385
00:22:54,240 --> 00:22:55,660
Yeah, yeah, yeah.

386
00:22:56,000 --> 00:22:56,360
Yeah.

387
00:22:56,500 --> 00:23:01,500
You know, so that's a, I mean, yeah, obviously it applies to like security, but it applies

388
00:23:01,500 --> 00:23:07,840
to things in general that, that is, I don't know which comes first, but you know, a while

389
00:23:07,840 --> 00:23:12,300
ago you're saying one of the issues that one can have with security, especially developers

390
00:23:12,300 --> 00:23:14,960
is like, you know, the not, not knowing what you don't know.

391
00:23:14,960 --> 00:23:16,920
And those, those, you don't even know what to look for.

392
00:23:17,280 --> 00:23:24,420
And it's almost like, if you, if you have relatively deep knowledge on at least two subject matter

393
00:23:24,420 --> 00:23:30,620
areas, you sort of learn this thing of like, oh, I should ask and find things I don't know.

394
00:23:30,800 --> 00:23:31,000
Right.

395
00:23:31,000 --> 00:23:34,980
Like, even if you don't know a topic, at least, you know, enough to, as, as you, you do in

396
00:23:34,980 --> 00:23:40,260
the book, like to say like, all right, what are like the atomic units of this stuff?

397
00:23:40,260 --> 00:23:43,880
Like what's the foundation that I have to know in order to figure out how to configure

398
00:23:43,880 --> 00:23:50,200
my certificate to attach to the mainframe and like knowing that you should spend time

399
00:23:50,200 --> 00:23:55,440
to learn, do that kind of stuff seems like, again, I don't know if that comes like, that's

400
00:23:55,440 --> 00:24:00,780
how you get to have that second specialization, but it's definitely, uh, that's almost the generalist

401
00:24:00,780 --> 00:24:01,220
part of it.

402
00:24:01,220 --> 00:24:01,440
Right.

403
00:24:01,480 --> 00:24:06,500
Is to be able to break out of your own little specialization, but even, even, you know,

404
00:24:06,500 --> 00:24:10,480
what, what, uh, what I'm, uh, rambling towards saying is like, even knowing that you can do

405
00:24:10,480 --> 00:24:15,060
that is, is, is, is a, is a valuable, uh, piece of knowledge to have.

406
00:24:15,140 --> 00:24:16,800
So we keep alluding to it.

407
00:24:17,540 --> 00:24:22,320
What are those atomic units that, you know, that you go over that you want, you don't have

408
00:24:22,320 --> 00:24:26,020
to detail every single one of them, but like, what are, what are these basic things that

409
00:24:26,020 --> 00:24:29,680
you think developers should start with and they don't have to master them, but if they

410
00:24:29,680 --> 00:24:32,520
know about them, they can, they can figure things out well enough.

411
00:24:32,860 --> 00:24:33,180
Yeah.

412
00:24:33,280 --> 00:24:35,020
You know, that's, that's a, that's a great question.

413
00:24:35,020 --> 00:24:42,480
And, um, I think what it boils down to is, uh, is that like fundamentally you need to

414
00:24:42,480 --> 00:24:46,160
get comfortable with TLS and mutual TLS because it's everywhere.

415
00:24:46,160 --> 00:24:46,480
Right.

416
00:24:46,560 --> 00:24:50,680
So you need to understand like, what's a certificate, what's a certificate chain?

417
00:24:50,760 --> 00:24:51,960
How do I get a certificate?

418
00:24:52,160 --> 00:24:53,340
How do I revoke a certificate?

419
00:24:53,540 --> 00:24:53,720
Right.

420
00:24:54,040 --> 00:24:56,800
There's how, what are the limitations of digital certificates?

421
00:24:56,800 --> 00:24:57,160
Right.

422
00:24:57,180 --> 00:25:01,540
Because like I interview a lot of people as you know, when they apply to VMware and one of

423
00:25:01,540 --> 00:25:07,040
my favorite questions is have you ever got yourself an SSL certificate, what's the process?

424
00:25:07,040 --> 00:25:10,000
And all I'm looking for is I create it on my computer.

425
00:25:10,300 --> 00:25:11,680
I create a signing request.

426
00:25:11,680 --> 00:25:16,400
I send it to some CA certificate authority and they send me back a certificate, right?

427
00:25:16,820 --> 00:25:18,660
Just that you don't need to tell me the command line.

428
00:25:18,720 --> 00:25:22,400
Don't need to tell me, but just, it tells me that you actually know, like you've done it

429
00:25:22,400 --> 00:25:26,740
once before, even if you faked it on your laptop with, you know, self-signed cert, but like

430
00:25:26,740 --> 00:25:27,660
knowing what that is.

431
00:25:27,660 --> 00:25:32,460
So it's like, how do I get a developer to the point where they're comfortable setting

432
00:25:32,460 --> 00:25:35,300
up something like mutual TLS in a Spring Boot application?

433
00:25:36,040 --> 00:25:37,140
What are the things you need to know?

434
00:25:37,140 --> 00:25:42,300
So working backward from that, there's a whole bunch of cryptography that, that you need to

435
00:25:42,300 --> 00:25:44,100
understand, like what's a TLS cipher suite?

436
00:25:44,240 --> 00:25:45,700
Why are there three versions of TLS?

437
00:25:46,380 --> 00:25:48,500
And what is a TLS handshake?

438
00:25:48,560 --> 00:25:53,960
So I don't need you to know the protocol, but I have to teach you like hash functions

439
00:25:53,960 --> 00:25:57,300
and AES and a variety of these things.

440
00:25:58,080 --> 00:26:04,380
And so that kind of, once you have that mutual, once you know what mutual TLS is all about

441
00:26:04,380 --> 00:26:08,460
and you're comfortable with that, then the next problem you're going to tackle as a developer

442
00:26:08,460 --> 00:26:12,620
is something like, how do I securely handle secrets?

443
00:26:12,820 --> 00:26:12,980
Okay.

444
00:26:13,460 --> 00:26:14,760
I have a password to the database.

445
00:26:14,900 --> 00:26:15,840
I have an API key.

446
00:26:15,940 --> 00:26:16,760
Where do I store that?

447
00:26:17,620 --> 00:26:21,960
And there you run into the nasty problem of secret zero, right?

448
00:26:22,340 --> 00:26:23,100
Which is like, great.

449
00:26:23,100 --> 00:26:28,920
I moved the passwords into some sort of key service, key management service, but how do

450
00:26:28,920 --> 00:26:30,820
I get the password to access the vault?

451
00:26:31,240 --> 00:26:31,680
Right.

452
00:26:32,160 --> 00:26:33,020
Where do I store that?

453
00:26:33,560 --> 00:26:33,860
Yeah.

454
00:26:34,000 --> 00:26:37,980
I put that in a text file and I put that in the same location as my app.

455
00:26:38,180 --> 00:26:38,740
Oh, hold on.

456
00:26:38,780 --> 00:26:39,400
That's not secure.

457
00:26:39,920 --> 00:26:43,000
Well, so you get this like turtles all the way down problem.

458
00:26:43,160 --> 00:26:47,400
And really the only way to solve that turtles all the way down problem is you need to have

459
00:26:47,400 --> 00:26:50,660
a platform that injects your initial secrets.

460
00:26:51,220 --> 00:26:53,320
So we did this very well in Cloud Foundry, right?

461
00:26:53,320 --> 00:27:00,420
Like we had this component where when your container launched, the platform created a certificate

462
00:27:00,420 --> 00:27:01,540
to identify you.

463
00:27:01,540 --> 00:27:06,140
We put that certificate on a temporary in-memory volume.

464
00:27:06,520 --> 00:27:09,160
So you could just read the certificate from a file.

465
00:27:09,260 --> 00:27:11,260
And that looks like it's part of the file system.

466
00:27:11,320 --> 00:27:12,960
I was really sitting in the machine's RAM.

467
00:27:13,700 --> 00:27:17,680
And every container got a completely different certificate.

468
00:27:18,000 --> 00:27:20,740
And that certificate was rotated every 24 hours.

469
00:27:21,120 --> 00:27:24,060
So it was like the cred hub magic that was part of Cloud Foundry, right?

470
00:27:24,540 --> 00:27:28,800
And that's a good way to do it because you're injecting the secret into that.

471
00:27:28,920 --> 00:27:30,880
And you can see, you see the cloud providers do this too.

472
00:27:30,980 --> 00:27:34,800
Like when you launch a virtual machine, they'll give the virtual machine identity.

473
00:27:35,340 --> 00:27:37,620
And I'll say, here's a key pair that describes you.

474
00:27:38,580 --> 00:27:44,420
And so like learning how to handle secrets is the second big thing that I want developers

475
00:27:44,420 --> 00:27:44,700
to know.

476
00:27:45,200 --> 00:27:45,400
Right.

477
00:27:45,400 --> 00:27:51,780
And I think, I mean, I think cred hub and Cloud Foundry is a good example of, of getting

478
00:27:51,780 --> 00:27:56,060
the security people to make it easier, right?

479
00:27:56,100 --> 00:28:00,380
Like instead of the developers having to figure out what to do, it's more like, oh, we'll do

480
00:28:00,380 --> 00:28:01,000
this for you.

481
00:28:01,000 --> 00:28:03,760
Just like, here's the thing that you need, right?

482
00:28:03,760 --> 00:28:04,720
I'm going to give it to you.

483
00:28:04,720 --> 00:28:06,140
You're not responsible for that.

484
00:28:06,280 --> 00:28:07,760
And just use the thing.

485
00:28:08,080 --> 00:28:09,360
Like that's all, that's all you don't need.

486
00:28:09,480 --> 00:28:13,700
That's, you don't have to worry about that so much, which I think is, I mean, I guess

487
00:28:13,700 --> 00:28:20,760
it is an inversion of, of, uh, developers making their applications secure instead you're doing

488
00:28:20,760 --> 00:28:24,440
the invert of that, whatever, but yeah, you're, you're, you're, you're, you're not out going

489
00:28:24,440 --> 00:28:29,400
out to look for things, but you still have to know as a developer, how do I read the certificate?

490
00:28:29,400 --> 00:28:30,940
How do I check that it's for sure?

491
00:28:31,280 --> 00:28:35,440
Like now, now that it's expired, cause it rotates every 24 hours, right?

492
00:28:36,000 --> 00:28:38,380
Uh, I need to be able to like switch it.

493
00:28:38,420 --> 00:28:43,180
So I need to know how to set up my own custom SSL context in Java, for example, and you go

494
00:28:43,180 --> 00:28:46,200
to set that up and you're like, oh no, it's asking me all these questions.

495
00:28:46,280 --> 00:28:47,020
I don't know what they are.

496
00:28:47,140 --> 00:28:47,760
Stock overflow.

497
00:28:47,920 --> 00:28:50,680
What should I pass in for these parameters that I don't know?

498
00:28:50,780 --> 00:28:55,280
And then it becomes kind of like, there's still like the APIs are horrible.

499
00:28:55,460 --> 00:28:59,780
Generally speaking, most security APIs are terrible, like absolutely terrible.

500
00:29:00,900 --> 00:29:02,100
They're easy to misuse.

501
00:29:03,240 --> 00:29:09,120
And, uh, what makes it even more scary for developers is when you try to say, what are

502
00:29:09,120 --> 00:29:11,940
the best practices for using some security thing?

503
00:29:11,980 --> 00:29:18,600
Like say AES, uh, or, or, um, or JSON web token or whatever it is, something that you're,

504
00:29:18,660 --> 00:29:20,200
the library you're trying to learn is this.

505
00:29:20,260 --> 00:29:24,800
Then you're going to find, if you search for videos, a whole bunch of security people ranting

506
00:29:24,800 --> 00:29:29,620
about how terrible the standard is and developers should never use it.

507
00:29:29,620 --> 00:29:29,980
Right.

508
00:29:30,400 --> 00:29:32,680
And here's everything wrong with it.

509
00:29:32,860 --> 00:29:35,760
And your systems are going to get hacked if you use it, blah, blah, blah.

510
00:29:35,940 --> 00:29:41,000
But then those same security experts don't offer an alternative or they offer an alternative

511
00:29:41,000 --> 00:29:42,160
and it's so opaque.

512
00:29:42,160 --> 00:29:44,280
You're like, oh my God, I'm just a peon.

513
00:29:44,320 --> 00:29:45,300
I'm just a developer.

514
00:29:45,300 --> 00:29:50,880
How am I supposed to evaluate the somewhat well-known security person's opinion on something?

515
00:29:51,360 --> 00:29:57,100
So I kind of like, like a good example of that is, is like JSON web token, like the whole

516
00:29:57,100 --> 00:29:59,680
Jose standard of it's used by open ID connects.

517
00:29:59,800 --> 00:30:03,780
If you want to do a single sign on with, you know, log in with Google, log in with Facebook,

518
00:30:03,940 --> 00:30:06,140
whatever people want to do that in their apps.

519
00:30:06,480 --> 00:30:10,120
And they, they get stuck when they try to configure that because they don't understand

520
00:30:10,120 --> 00:30:11,160
those standards.

521
00:30:12,480 --> 00:30:12,920
Right.

522
00:30:13,360 --> 00:30:16,980
And because they don't understand those standards, they got stuck.

523
00:30:16,980 --> 00:30:21,720
And like, but when they try to learn them, they see a lot of like, never, ever use this

524
00:30:21,720 --> 00:30:23,380
because it's a terrible standard.

525
00:30:23,660 --> 00:30:24,560
Well, why?

526
00:30:25,060 --> 00:30:26,680
And what do you want me to use?

527
00:30:26,740 --> 00:30:27,500
I'm not Google.

528
00:30:27,640 --> 00:30:31,620
I don't have an alternative to this, but I have to use as a corporate developer what's

529
00:30:31,620 --> 00:30:32,300
available to me.

530
00:30:32,720 --> 00:30:39,760
So there's a lot of that fear mongering and not enough knowledge from the point of view

531
00:30:39,760 --> 00:30:42,620
of the developer to evaluate, is this safe to do or not?

532
00:30:43,360 --> 00:30:49,080
It sounds like a much worse version of, of the whole, I think we've gotten better at

533
00:30:49,080 --> 00:30:52,880
this than we were over the past few years, but it's, it's, it's a much worse version of

534
00:30:52,880 --> 00:30:58,300
the Kubernetes is too complex reply that you get a lot, which is, which is sort of like,

535
00:30:58,740 --> 00:31:01,220
well, well then maybe we should make it not so complex.

536
00:31:01,980 --> 00:31:07,160
Like, and, and, and, and also to your point, let's talk about how to like, make it easy

537
00:31:07,160 --> 00:31:07,700
to use.

538
00:31:07,700 --> 00:31:12,300
And like, you know, instead of just giving up and saying it's too complex, we should figure

539
00:31:12,300 --> 00:31:13,040
something out around it.

540
00:31:13,080 --> 00:31:13,260
All right.

541
00:31:13,260 --> 00:31:19,100
So, so we got the, we got the mutual, mutual TLS and then, and then we got to know about

542
00:31:19,100 --> 00:31:20,060
secrets management.

543
00:31:20,060 --> 00:31:25,320
What, what's another, what's the next sort of like foundational thing people should know

544
00:31:25,320 --> 00:31:25,580
about?

545
00:31:25,720 --> 00:31:30,100
The next, the next foundational thing is how do you log people into your applications?

546
00:31:30,900 --> 00:31:31,160
Okay.

547
00:31:31,160 --> 00:31:32,440
We hate passwords.

548
00:31:32,580 --> 00:31:33,260
I hate passwords.

549
00:31:33,360 --> 00:31:34,220
I don't like passwords.

550
00:31:34,580 --> 00:31:35,500
Passwords are terrible.

551
00:31:36,800 --> 00:31:40,580
And ideally your application should never have to store usernames and passwords.

552
00:31:40,700 --> 00:31:42,580
So you need some sort of single sign-on solution.

553
00:31:43,180 --> 00:31:46,220
So there's really two standards that I want developers to be familiar with.

554
00:31:46,320 --> 00:31:51,860
One is open ID connect because it's so widely deployed these days where, which allows you

555
00:31:51,860 --> 00:31:55,380
to do like these, you know, log in with the SSO server type functionality.

556
00:31:56,120 --> 00:32:00,040
And then the other one is a newer protocol called web authentication.

557
00:32:00,840 --> 00:32:06,020
So if you've never tried web authentication, you can go to webauthent.io and there's a

558
00:32:06,020 --> 00:32:06,900
simple experience there.

559
00:32:07,000 --> 00:32:08,820
What it does is absolutely brilliant.

560
00:32:09,160 --> 00:32:14,340
It allows your web app to use whatever biometric system exists in your laptop.

561
00:32:14,600 --> 00:32:18,940
So if you go to there with your phone and you go to register, you can actually complete a

562
00:32:18,940 --> 00:32:22,380
complete signup flow without ever having to type in a password.

563
00:32:23,960 --> 00:32:26,260
And then when you come back, it says, oh, you're on an iPhone.

564
00:32:26,380 --> 00:32:27,380
Would you like to use Face ID?

565
00:32:27,860 --> 00:32:28,680
And you go, yeah, sure.

566
00:32:28,760 --> 00:32:29,680
You log in with Face ID.

567
00:32:29,960 --> 00:32:32,820
And it does that whole thing in a, in a secure way.

568
00:32:32,900 --> 00:32:37,620
So if you have like a, like a secure YubiKey, you know, those USB phishing resistant keys,

569
00:32:37,700 --> 00:32:38,420
you can plug it in.

570
00:32:38,460 --> 00:32:38,940
That works.

571
00:32:38,940 --> 00:32:42,980
If you have your, your little thumbprint reader on your Mac, that works.

572
00:32:43,460 --> 00:32:47,420
So web authentication is a protocol that I want a lot more developers to know about because

573
00:32:47,420 --> 00:32:49,080
it does make things easier for developers.

574
00:32:50,080 --> 00:32:53,000
And it does eliminate the need for passwords.

575
00:32:53,960 --> 00:32:54,020
Yeah.

576
00:32:54,080 --> 00:32:54,840
That sounds great.

577
00:32:55,020 --> 00:32:56,980
How, how come everyone doesn't use that?

578
00:32:57,280 --> 00:32:58,160
Is it too new?

579
00:32:58,500 --> 00:32:59,140
It's new.

580
00:32:59,640 --> 00:33:02,460
And there's not enough developers that know how to know about it.

581
00:33:02,800 --> 00:33:03,140
Yeah.

582
00:33:03,400 --> 00:33:06,860
Is that the, I mean, this is the kind of a, a side concern.

583
00:33:06,860 --> 00:33:08,600
So let's say, let's say that comes around.

584
00:33:08,600 --> 00:33:08,920
Right.

585
00:33:09,040 --> 00:33:13,680
And, you know, now that I'm thinking of it, I'm trying to think if I've actually used,

586
00:33:13,820 --> 00:33:21,440
anyways, whatever, like how long does it take like security policy people to say like, all

587
00:33:21,440 --> 00:33:22,460
right, we should use this.

588
00:33:22,580 --> 00:33:23,480
It's totally okay.

589
00:33:23,840 --> 00:33:25,940
I mean, they could, they could say that all they want.

590
00:33:26,040 --> 00:33:28,600
If the developers don't know how to write code with it, it doesn't matter.

591
00:33:28,980 --> 00:33:30,920
So, so, I mean, I guess that's what I'm getting at.

592
00:33:30,920 --> 00:33:36,140
It is for something like that, whenever there's a new, better way of doing security from an

593
00:33:36,140 --> 00:33:43,540
end user perspective or a, what's the opposite of an end user, a start user, like, like, is

594
00:33:43,540 --> 00:33:48,500
it, is it often the developers who are the bottleneck on it just because they don't know or understand

595
00:33:48,500 --> 00:33:51,960
it, or is it the, the policy people or like, what, what do you think?

596
00:33:52,020 --> 00:33:55,060
It's really, it's really the architects to a certain extent, right?

597
00:33:55,060 --> 00:33:58,720
Because think about it like this, in an application, a typical application, let's say you have 10

598
00:33:58,720 --> 00:33:59,760
developers working on it.

599
00:34:00,020 --> 00:34:00,900
Let's be honest about it.

600
00:34:00,900 --> 00:34:04,320
One of those developers is going to configure, configure security, right?

601
00:34:04,420 --> 00:34:04,580
Right.

602
00:34:04,580 --> 00:34:05,800
It's not going to be all 10.

603
00:34:06,140 --> 00:34:09,980
And that developer, the developers are kind of being measured on how fast they're implementing

604
00:34:09,980 --> 00:34:10,580
the features.

605
00:34:10,860 --> 00:34:13,880
And the security feature is going to look like, make the application secure.

606
00:34:14,120 --> 00:34:14,520
Okay.

607
00:34:15,480 --> 00:34:17,200
The users want to be able to log in.

608
00:34:17,520 --> 00:34:22,000
So, there isn't somebody that's actually prioritizing and breaking that down on product

609
00:34:22,000 --> 00:34:24,060
management to say, we want web authentication.

610
00:34:24,680 --> 00:34:26,580
We want passwordless logins, right?

611
00:34:26,960 --> 00:34:29,200
And if they're aware, then it goes to the architects.

612
00:34:29,200 --> 00:34:32,120
We're going to say, well, passwordless login, let me scratch my head.

613
00:34:32,200 --> 00:34:33,880
How can you possibly do that, right?

614
00:34:34,620 --> 00:34:37,000
And then they need to start searching on things.

615
00:34:37,080 --> 00:34:42,420
So, I hope I end up playing a small part in helping people know that the web authentication

616
00:34:42,420 --> 00:34:45,460
protocol exists and getting them to try it out.

617
00:34:45,980 --> 00:34:48,880
Well, you should write your next book just on that.

618
00:34:49,280 --> 00:34:50,080
That would be fun.

619
00:34:50,180 --> 00:35:00,420
Because I think the proposition, I mean, the benefit of like, you can make a login system

620
00:35:00,420 --> 00:35:02,620
that doesn't require passwords, right?

621
00:35:02,760 --> 00:35:07,660
Like, that's a very simple to understand awesome thing, right?

622
00:35:07,720 --> 00:35:11,700
And then it's just like, all you got to do is use this technology, which people will tell

623
00:35:11,700 --> 00:35:14,640
you that it's complicated and it's hard because it's security.

624
00:35:15,300 --> 00:35:16,380
But just read my book.

625
00:35:16,460 --> 00:35:17,240
It's actually fine.

626
00:35:17,960 --> 00:35:19,300
I'll explain it to you.

627
00:35:19,300 --> 00:35:24,820
Yeah, it's kind of funny you mentioned that because I put together the outline for the

628
00:35:24,820 --> 00:35:25,720
book I wish I had.

629
00:35:25,840 --> 00:35:27,220
It was like 700 pages.

630
00:35:28,320 --> 00:35:32,180
And I'm like, oh, it won't take me that long to write 700 pages.

631
00:35:32,740 --> 00:35:34,380
Oh, no, it will take me a really long time.

632
00:35:34,680 --> 00:35:38,260
So, I kind of got stuck with the outline I went to Manning with.

633
00:35:38,680 --> 00:35:40,620
And it's because it's the book I wanted to read.

634
00:35:40,700 --> 00:35:42,600
And it really should have been like four separate books.

635
00:35:42,600 --> 00:35:45,480
But I don't want people to pay four times for something.

636
00:35:45,900 --> 00:35:50,080
So, I'm sucking it up and I'm doing the 500, 600 page book.

637
00:35:50,360 --> 00:35:50,840
Oh, wow.

638
00:35:50,960 --> 00:35:51,180
Okay.

639
00:35:51,420 --> 00:35:51,840
Well, okay.

640
00:35:52,160 --> 00:35:54,340
Which I wish I had not done.

641
00:35:54,520 --> 00:35:57,940
But I know I'm not doing it because I keep my word on stuff like this.

642
00:35:59,220 --> 00:36:01,860
And, you know, so it's I hear you.

643
00:36:01,900 --> 00:36:02,520
I hear you on that.

644
00:36:02,600 --> 00:36:06,560
Like, it's this is why what I love about Manning 2 is they have the meet program.

645
00:36:06,560 --> 00:36:08,420
So, as I write the chapters, they'll become available.

646
00:36:09,220 --> 00:36:12,020
And the way I write the chapters is first I write the sample applications.

647
00:36:12,720 --> 00:36:16,180
And what I love about Manning is they really want you to have like a real world scenario.

648
00:36:16,940 --> 00:36:19,980
So, I come up with a real world scenario that developer would face.

649
00:36:20,160 --> 00:36:24,060
I write the sample application that's going to be explaining how that works.

650
00:36:24,200 --> 00:36:31,620
And then once I have the sample app, then I need to fill in all the text around the sample app to explain how that app works.

651
00:36:32,680 --> 00:36:33,200
Yeah, yeah.

652
00:36:33,200 --> 00:36:48,720
And that, I hope, will make the book good in the sense as a developer, when you encounter something like web authentication, it'll be like, okay, the right thing to do when reading my book would be to clone the Git repo, run the sample application, click around, understand what's happening.

653
00:36:48,780 --> 00:36:49,340
We're like, wow.

654
00:36:49,440 --> 00:36:50,300
Okay, now I know what it is.

655
00:36:50,340 --> 00:36:52,780
Let me actually figure out the details of how to implement it.

656
00:36:53,540 --> 00:36:54,120
Yeah, yeah.

657
00:36:54,180 --> 00:37:00,580
I mean, I think that's the approach, I mean, having been, formally having been an application developer, right?

658
00:37:00,600 --> 00:37:05,320
Like the way that I always want to learn anything is starting with an application, right?

659
00:37:05,420 --> 00:37:13,240
Like, you know, bringing up, like bringing up again, like in the Kubernetes world, I'm lazy, so I'm sure this exists.

660
00:37:13,240 --> 00:37:19,860
But like, I always want to read, like, I've got this application, now I'm going to deploy it on Kubernetes, right?

661
00:37:19,880 --> 00:37:27,720
Rather than learning the bottoms up thing about Kubernetes is a great representation of the atomic units of infrastructure through APIs expressed in YAML.

662
00:37:28,080 --> 00:37:30,600
Like, I just want to be like, I want to deploy this app.

663
00:37:30,680 --> 00:37:31,360
What do I do now?

664
00:37:32,180 --> 00:37:34,240
Yeah, exactly, exactly.

665
00:37:34,500 --> 00:37:42,240
And that brings me to the next kind of major thing I want developers to know, which is how to securely deploy stuff on Kubernetes.

666
00:37:42,240 --> 00:37:50,240
Because Kubernetes kind of emerged as that kind of higher level abstraction than virtual machines, right?

667
00:37:50,340 --> 00:37:51,600
And it is API-based.

668
00:37:51,760 --> 00:37:58,560
Yes, it's very complex, but, you know, Tanzu and others are working on making it more accessible to developers.

669
00:37:58,800 --> 00:38:04,620
And it doesn't hurt you if you want to advance your career as a developer to understand some of the security aspects of that.

670
00:38:04,980 --> 00:38:10,980
So in the book, I'll explain, what do you need to know about how to secure your application running on Kubernetes?

671
00:38:11,480 --> 00:38:14,200
Like, it's not going to be a reference manual.

672
00:38:14,500 --> 00:38:20,300
It's not going to give you like the how-to tutorial necessarily, but it's going to say, here's what you need to know.

673
00:38:20,400 --> 00:38:21,700
Here's why you need to know it.

674
00:38:21,760 --> 00:38:23,440
Here's enough about it at a high level.

675
00:38:24,000 --> 00:38:32,320
And, hey, maybe you want to go and read some other books to go further deeper into like the nuts and bolts of that, of how that works.

676
00:38:33,320 --> 00:38:49,000
And so, you know, the things so far I want developers to know, one is know how to set up mutual TLS, get really comfortable with TLS, get really comfortable with securely handling secrets, get really comfortable with all the different ways, different ways of logging people in that don't require passwords.

677
00:38:50,120 --> 00:38:56,220
Get comfortable with how to package your application securely in a container and run it securely on something like Kubernetes.

678
00:38:57,140 --> 00:39:02,880
And then finally, the final problem is the, I would call it the impossible to solve problem, all right?

679
00:39:02,900 --> 00:39:08,640
This is the service-to-service authorization because you get things like, say you load up an Amazon webpage, right?

680
00:39:09,560 --> 00:39:12,900
And, you know, you might have a microservice that tells you the rating.

681
00:39:13,040 --> 00:39:16,640
You might have a microservice that gives you the description of the book.

682
00:39:16,700 --> 00:39:19,760
You might have one that tells you what the price is, calculates the discount.

683
00:39:20,200 --> 00:39:25,300
So in these modern cloud-native apps, you have a service that calls a service, that calls a service, that calls a service.

684
00:39:25,760 --> 00:39:32,100
It could be like a really complex chain, and it becomes not very easy to know like, hey, I'm like 10 services down.

685
00:39:32,180 --> 00:39:33,400
Who's actually making that call?

686
00:39:33,920 --> 00:39:34,560
Who's the user?

687
00:39:35,140 --> 00:39:38,780
How do I know who this person is?

688
00:39:39,040 --> 00:39:42,500
And there isn't really a good way to solve that in the industry.

689
00:39:42,900 --> 00:39:45,540
There are different approaches that have different pros and cons.

690
00:39:46,120 --> 00:39:49,460
And the security people are so freaking opinionated about it.

691
00:39:49,540 --> 00:39:50,080
It's scary.

692
00:39:50,180 --> 00:39:54,180
It makes you as a developer kind of go like, ah, I just touched the hot stove.

693
00:39:54,320 --> 00:39:56,220
Why are they spewing all this stuff at me?

694
00:39:56,260 --> 00:39:59,540
Because I put up in an architectural review meeting.

695
00:40:00,040 --> 00:40:03,340
I had the, I, you know, I said there's an API gateway here.

696
00:40:03,340 --> 00:40:05,260
And like, they're like, how are you pushing the token?

697
00:40:05,260 --> 00:40:10,840
And it's like, so I, in that section, all I can do is just explain the different patterns that are available.

698
00:40:11,760 --> 00:40:14,200
And the pros and cons of the different patterns.

699
00:40:14,360 --> 00:40:21,380
And just arm the developer with enough understanding that at least they know there isn't a better solution out there.

700
00:40:21,560 --> 00:40:21,780
Right?

701
00:40:22,560 --> 00:40:23,060
For sure.

702
00:40:23,320 --> 00:40:25,240
This is kind of the patterns that are available.

703
00:40:25,780 --> 00:40:28,560
And pick your poison from these combinations of patterns.

704
00:40:28,660 --> 00:40:29,700
Do you want to do a service mesh?

705
00:40:30,160 --> 00:40:31,400
Do you want to do API gateways?

706
00:40:31,700 --> 00:40:33,560
Do you want to do some combination of the two?

707
00:40:34,100 --> 00:40:39,940
Uh, do you want to roll out something like spiffy, which is pretty damn awesome at solving that problem, but it's, it's not there yet.

708
00:40:40,280 --> 00:40:41,040
Uh, widely deployed.

709
00:40:41,040 --> 00:40:41,340
So.

710
00:40:42,340 --> 00:40:44,420
Yeah, no, I, I like, I like, yeah.

711
00:40:44,840 --> 00:40:51,100
I mean, I've, I've only read, uh, so the, the, the draft I have, I think is just like 120 or so pages.

712
00:40:51,100 --> 00:40:53,480
So I'm going to look forward to the next, what did you say?

713
00:40:53,580 --> 00:40:54,440
800 pages.

714
00:40:54,600 --> 00:41:04,880
Just to add on to that, the multi-volume set, but yeah, I, you know, on, on a topic like this, it is, there, there's a huge advantage to being comprehensive, right?

715
00:41:05,060 --> 00:41:08,920
It's, it's, uh, it, it is nice, but, uh, so that'll be fun to read.

716
00:41:08,960 --> 00:41:18,020
But so, uh, I mean, if people were interested, is, is there kind of like a, uh, uh, uh, an open review of it or like, what's, what's the, uh, what's the setup for it?

717
00:41:18,220 --> 00:41:24,040
So the setup is you just, if you want to read it, just go to manning.com, search for securing cloud applications.

718
00:41:24,980 --> 00:41:29,040
And, um, what you'll be able to buy is you buy the early access version.

719
00:41:29,040 --> 00:41:33,460
So you can pick to buy the PDF or the PDF and the printed book when the printed book is released.

720
00:41:33,880 --> 00:41:37,620
And then, um, as every couple of weeks, you're going to be more chapters showing up.

721
00:41:37,620 --> 00:41:47,280
So you start reading it as the book is published and that allows you to, uh, there's also like a, an art, like a forum, which you can access and ask questions about the book.

722
00:41:47,360 --> 00:41:48,500
Like, Hey, I tried the sample.

723
00:41:48,600 --> 00:41:49,100
It didn't work.

724
00:41:49,100 --> 00:41:51,080
Or I'm confused about something.

725
00:41:51,120 --> 00:41:52,580
Can you elaborate more on this or that?

726
00:41:52,820 --> 00:41:55,800
Which is helpful for me to try to, to make the book better.

727
00:41:56,360 --> 00:42:04,600
And, you know, all things, uh, equal, I'm hoping really, really, uh, working hard to hit, uh, summer 2022 target for this.

728
00:42:04,620 --> 00:42:07,760
Uh, so hundreds of pages to write.

729
00:42:08,200 --> 00:42:09,420
Yeah, no, that sounds good.

730
00:42:09,480 --> 00:42:09,740
All right.

731
00:42:09,760 --> 00:42:12,080
Well, do you have, do you have a Twitter handle or anything you want to send?

732
00:42:12,380 --> 00:42:16,080
It's, uh, a S a I K a L I.

733
00:42:16,080 --> 00:42:21,160
So, uh, uh, a Psycali and I'll be posting on there whenever I have new chapters out there.

734
00:42:21,520 --> 00:42:21,880
Yeah.

735
00:42:21,880 --> 00:42:22,160
Well, great.

736
00:42:22,200 --> 00:42:22,580
Well, thanks.

737
00:42:22,620 --> 00:42:26,460
That was fun to, uh, it's always fun to talk to an author of something that I've been reading

738
00:42:26,460 --> 00:42:29,600
through and, uh, especially on a topic like security.

739
00:42:29,840 --> 00:42:32,000
Well, as always, this has been Tansu talk.

740
00:42:32,060 --> 00:42:36,700
If you want to get the archives for this show, uh, you know, other episodes, you can go to

741
00:42:36,700 --> 00:42:40,800
tomzutalk.com and, uh, I'll put some links in the show notes to, uh, what we talked about

742
00:42:40,800 --> 00:42:41,060
here.

743
00:42:41,220 --> 00:42:43,120
And with that, we'll see everyone next time.

744
00:42:43,200 --> 00:42:43,820
Bye-bye.