<commit_before>date start : 01 november 2021


1.1 Meet Your Instructor
---------------------------------------
Meet Your Instructor

Welcome to Introduction to Microservices Security! Your instructor in this course is <NAME>. In this next video, you can learn a little about Nick's background

Nick has been working in the security engineering field for nearly 15 years. Over the past 6 years, he has been in technical security leadership at companies like Snapchat and SpaceX. Nick has a master's degree in Security Engineering from DePaul University in Chicago. Outside of security engineering, Nick enjoys tinkering with disruptive security technology, cross-fit, electric vehicles, and of course, spending time with his family.



1.2 Nanadegree Prerequisites
---------------------------------------
Before coming into this Nanodegree, you should be comfortable with Linux, CLI (command-line interface), Git commands, and you should have a GitHub account and a Docker Hub account.

Virtual Machine Setup and Demo
Some of the tools in this course require you to use Linux. If you are running Mac or Linux locally, you do not need to follow this demo at this moment. However, if you are running Windows, make sure you follow the steps below to use the VirtualBox and Vagrant to create a Linux virtual machine.

How to Create a Linux Virtual Machine
To bring up the Vagrant box, make sure you have cloned the starter code for lesson-1-introduction-to-microservices repo.
CD to the exercises/starter/ folder containing the Vagrantfile.
Run vagrant up to provision the VM and then vagrant ssh to log in.
Once you are done, run vagrant halt to exit the VM.



1.3 Course Prerequisites
---------------------------------------
To succeed in this course, you should be able to:

Use Git for committing and pushing code
Use Bash and python to script
Use Docker for creating images and running containers
Use DockerHub for pushing and pulling Docker images
Use Kubernetes to create a cluster, pods, and services
Work within VS Code
Run and edit Python programs. Make sure you have at least Python 3.7 installed
Use Lucidchart or Google Draw to create system architecture diagrams to visually describe your systems
You will use open-source security tools in this course. For example,

Tools like Docker-bench for hardening docker
Tools like Kube-bench to harden Kubernetes
Tools like Grype to perform software composition analysis



1.4 Introduction to Microservices Security
---------------------------------------
Why Is Microservices Security Important?
Microservices are not secure by default. New security issues arise as techniques evolving and new technology coming up.

Just an example, in 2018, Tesla’s Kubernetes cluster was compromised. The attackers kicked off crypto-mining. Luckily, Tesla’s runtime monitoring caught the activity and alerted the Tesla security team.

The moral of the story is that no one is immune to a security incident. The reality of cyber breaches is far worse than the small percentage of security incidents you read about.



1.5 Course Overview
---------------------------------------
In this course, we will cover 4 large surface areas for microservices security:
Docker
Kubernetes
Application-level security
Runtime monitoring
In this course we'll learn:
Why security is important and stakeholders you will work with in your everyday work
How to approach security risks systematically and intentionally using threat modeling with STRIDE
Practical techniques to harden Docker attack surface using Docker-bench
Practical techniques to harden Kubetnetes attack surface using Kube-bench
Break down layers of a Docker image to evaluate the security of the libraries, dependencies, and software code using open-source tools
How to deploy runtime monitoring with Sysdig Falco and Grafana
Learning Objectives:
Threat model a microservices environment
Deploy a hardened Docker image
Deploy a hardened Kubernetes cluster with run-time monitoring
Perform software security introspection
Run a security incident response



1.6 How Microservices Security Differs from Traditional Infrastructure Security
---------------------------------------
There are many differences between microservices security and monolith security.

Microservice uses containerized service, versus monolith service runs on a virtual machine or physical machine.
Deployments of microservices are short-lived and declarative, so the deployment velocity is much higher. But deployments of the monolith are often long-lived and imperative, which means the deployment velocity is lower.
Each microservice uses its identity to authenticate, which means there is zero trust, as the services must rely on the identity provided to authenticate. But traditional security is often not certificate-based so it uses hard-coded credentials.
There are many smaller attack surfaces in microservices security because each container is a security boundary. There is one large attack surface with monolith security because the virtual machine or host is often the security boundary.
There is an agile security feedback loop with microservices security as services are tested for security during build and deployment. But with monolith security, there is usually a waterfall security feedback loop at the end of the development process or worse yet, no feedback at all.


Key Terms
Here are some key terms that are important to this course:

Software Development Life Cycle (SDLC): The process by which software specs are defined, tested, built, and deployed. Security needs to be a vital component of SDLC.
Transport layer security (TLS): Protocol to encrypt data in motion.
Access Control List (ACL): The process by which access is defined into a role or permission.
Role-Based Access Control (RBAC): The process by which roles are defined into an ACL. We define what ACL each user should have.
Need to Know: Only providing the required access that is necessary for the job.
Principle of least privileged: Similar concept to Need to Know. This principle implies that a user of a system should have access that provides minimal privilege for the job.



1.7 History of Microservices Security
---------------------------------------
2013: With the introduction of Docker, microservice started to establish a stake.
2015: With the open sourcing of Kubernetes by Google, microservice were amplified.
Around 2017: Microservice scaled with broader adoption of the service mesh, scaled management planes such as Istio and Envoy that made it easier to manage service at scale.
Present: Microservices are now enjoying mainstream adoption in most younger companies. Enterprises are also getting into the mix.

Additional Resources
If you want to learn more about the history of Microservices, we recommend you check out this excellent blog post about the history of microservices.
The book Kubernetes Running Dive Future Infrastructure by <NAME> is a classic text that you should consider reading if you are serious about becoming a professional in this field.



1.8 Stakeholders
---------------------------------------
There are three types of stakeholders.

Business
Executive stakeholders are interested in the top-line outcome.
Line of business stakeholders are interested in their lines of business-specific outcomes.
Legal and compliance are interested in keeping the company out of legal problems and not violating laws that have consequences.

All business stakeholders have similar needs, which are: moving fast without slowing the production down; security approach/solution is scaled with the business and not be rebuilt frequently or be very expensive; security does not disrupt the business and is resilient.

aTechnical
IT supports the computing environment but is not responsible for core engineering or research and development (R&D).
Engineering and R&D develop and build your product or service.
Security understands IT, engineering, as well as business needs in order to provide protection.
Technical stakeholders have similar needs: the service can be delivered within the business goals; innovation and iteration; the service is secure and protected.

Attackers
Governments and state-sponsored criminals: the most well-funded; typically methodical with long-term sustained operations.
Cybercriminals: organized for monetary value. They usually have fewer capabilities than governments but they can be equally impactful.
Hacktivists: trying to support a cause or need, and they can be well organized.

The needs of the attackers matter because they are who we are protecting against. Governments and state-sponsored attacks are after your innovation and competitive advantage. Cybercriminals are after money and monetary gains. Hacktivists are after notoriety, fame, and glory for themselves and their cause.

Additional Resources
If you want to learn more about cyber attacker motivations, we recommend you check out an excellent blog on cybercrime by investigative reporter <NAME>.
The book Spam Nation: The Inside Story of Organized by investigative reporter <NAME> is a classic text that you should consider reading if you are serious about becoming a professional in this field.



<commit_msg>attend lesson 1.9 to 1.12<commit_after>date start : 01 november 2021


1.1 Meet Your Instructor
---------------------------------------
Meet Your Instructor

Welcome to Introduction to Microservices Security! Your instructor in this course is <NAME>. In this next video, you can learn a little about Nick's background

Nick has been working in the security engineering field for nearly 15 years. Over the past 6 years, he has been in technical security leadership at companies like Snapchat and SpaceX. Nick has a master's degree in Security Engineering from DePaul University in Chicago. Outside of security engineering, Nick enjoys tinkering with disruptive security technology, cross-fit, electric vehicles, and of course, spending time with his family.



1.2 Nanadegree Prerequisites
---------------------------------------
Before coming into this Nanodegree, you should be comfortable with Linux, CLI (command-line interface), Git commands, and you should have a GitHub account and a Docker Hub account.

Virtual Machine Setup and Demo
Some of the tools in this course require you to use Linux. If you are running Mac or Linux locally, you do not need to follow this demo at this moment. However, if you are running Windows, make sure you follow the steps below to use the VirtualBox and Vagrant to create a Linux virtual machine.

How to Create a Linux Virtual Machine
To bring up the Vagrant box, make sure you have cloned the starter code for lesson-1-introduction-to-microservices repo.
CD to the exercises/starter/ folder containing the Vagrantfile.
Run vagrant up to provision the VM and then vagrant ssh to log in.
Once you are done, run vagrant halt to exit the VM.



1.3 Course Prerequisites
---------------------------------------
To succeed in this course, you should be able to:

Use Git for committing and pushing code
Use Bash and python to script
Use Docker for creating images and running containers
Use DockerHub for pushing and pulling Docker images
Use Kubernetes to create a cluster, pods, and services
Work within VS Code
Run and edit Python programs. Make sure you have at least Python 3.7 installed
Use Lucidchart or Google Draw to create system architecture diagrams to visually describe your systems
You will use open-source security tools in this course. For example,

Tools like Docker-bench for hardening docker
Tools like Kube-bench to harden Kubernetes
Tools like Grype to perform software composition analysis



1.4 Introduction to Microservices Security
---------------------------------------
Why Is Microservices Security Important?
Microservices are not secure by default. New security issues arise as techniques evolving and new technology coming up.

Just an example, in 2018, Tesla’s Kubernetes cluster was compromised. The attackers kicked off crypto-mining. Luckily, Tesla’s runtime monitoring caught the activity and alerted the Tesla security team.

The moral of the story is that no one is immune to a security incident. The reality of cyber breaches is far worse than the small percentage of security incidents you read about.



1.5 Course Overview
---------------------------------------
In this course, we will cover 4 large surface areas for microservices security:
Docker
Kubernetes
Application-level security
Runtime monitoring
In this course we'll learn:
Why security is important and stakeholders you will work with in your everyday work
How to approach security risks systematically and intentionally using threat modeling with STRIDE
Practical techniques to harden Docker attack surface using Docker-bench
Practical techniques to harden Kubetnetes attack surface using Kube-bench
Break down layers of a Docker image to evaluate the security of the libraries, dependencies, and software code using open-source tools
How to deploy runtime monitoring with Sysdig Falco and Grafana
Learning Objectives:
Threat model a microservices environment
Deploy a hardened Docker image
Deploy a hardened Kubernetes cluster with run-time monitoring
Perform software security introspection
Run a security incident response



1.6 How Microservices Security Differs from Traditional Infrastructure Security
---------------------------------------
There are many differences between microservices security and monolith security.

Microservice uses containerized service, versus monolith service runs on a virtual machine or physical machine.
Deployments of microservices are short-lived and declarative, so the deployment velocity is much higher. But deployments of the monolith are often long-lived and imperative, which means the deployment velocity is lower.
Each microservice uses its identity to authenticate, which means there is zero trust, as the services must rely on the identity provided to authenticate. But traditional security is often not certificate-based so it uses hard-coded credentials.
There are many smaller attack surfaces in microservices security because each container is a security boundary. There is one large attack surface with monolith security because the virtual machine or host is often the security boundary.
There is an agile security feedback loop with microservices security as services are tested for security during build and deployment. But with monolith security, there is usually a waterfall security feedback loop at the end of the development process or worse yet, no feedback at all.


Key Terms
Here are some key terms that are important to this course:

Software Development Life Cycle (SDLC): The process by which software specs are defined, tested, built, and deployed. Security needs to be a vital component of SDLC.
Transport layer security (TLS): Protocol to encrypt data in motion.
Access Control List (ACL): The process by which access is defined into a role or permission.
Role-Based Access Control (RBAC): The process by which roles are defined into an ACL. We define what ACL each user should have.
Need to Know: Only providing the required access that is necessary for the job.
Principle of least privileged: Similar concept to Need to Know. This principle implies that a user of a system should have access that provides minimal privilege for the job.



1.7 History of Microservices Security
---------------------------------------
2013: With the introduction of Docker, microservice started to establish a stake.
2015: With the open sourcing of Kubernetes by Google, microservice were amplified.
Around 2017: Microservice scaled with broader adoption of the service mesh, scaled management planes such as Istio and Envoy that made it easier to manage service at scale.
Present: Microservices are now enjoying mainstream adoption in most younger companies. Enterprises are also getting into the mix.

Additional Resources
If you want to learn more about the history of Microservices, we recommend you check out this excellent blog post about the history of microservices.
The book Kubernetes Running Dive Future Infrastructure by <NAME> is a classic text that you should consider reading if you are serious about becoming a professional in this field.



1.8 Stakeholders
---------------------------------------
There are three types of stakeholders.

Business
Executive stakeholders are interested in the top-line outcome.
Line of business stakeholders are interested in their lines of business-specific outcomes.
Legal and compliance are interested in keeping the company out of legal problems and not violating laws that have consequences.

All business stakeholders have similar needs, which are: moving fast without slowing the production down; security approach/solution is scaled with the business and not be rebuilt frequently or be very expensive; security does not disrupt the business and is resilient.

aTechnical
IT supports the computing environment but is not responsible for core engineering or research and development (R&D).
Engineering and R&D develop and build your product or service.
Security understands IT, engineering, as well as business needs in order to provide protection.
Technical stakeholders have similar needs: the service can be delivered within the business goals; innovation and iteration; the service is secure and protected.

Attackers
Governments and state-sponsored criminals: the most well-funded; typically methodical with long-term sustained operations.
Cybercriminals: organized for monetary value. They usually have fewer capabilities than governments but they can be equally impactful.
Hacktivists: trying to support a cause or need, and they can be well organized.

The needs of the attackers matter because they are who we are protecting against. Governments and state-sponsored attacks are after your innovation and competitive advantage. Cybercriminals are after money and monetary gains. Hacktivists are after notoriety, fame, and glory for themselves and their cause.

Additional Resources
If you want to learn more about cyber attacker motivations, we recommend you check out an excellent blog on cybercrime by investigative reporter <NAME>.
The book Spam Nation: The Inside Story of Organized by investigative reporter <NAME> is a classic text that you should consider reading if you are serious about becoming a professional in this field.



1.9 Course Tools & Environment
---------------------------------------
Here are the tools we will use in this course:

Vagrant and VirtualBox
Docker and Docker Hub
A Distribution of Kubernetes
Bash and Python
VS Code
Open-source security tools

Additional Resources
For more information check out the getting started docs for these tools:
Getting started with Vagrant
Getting started with Docker
Getting started with Docker Hub
Getting started with VS Code



1.10 What You'll Buid in the Project 
---------------------------------------
In the project you will do the following:

Build and harden Docker and Kubernetes
Deploy a hardened Flask application
Respond to a security incident



1.11 Glossary
---------------------------------------
Glossary
Software Development Life Cycle (SDLC): The process by which software specs are defined, tested, built, and deployed. Security needs to be a vital component of SDLC.
Transport layer security (TLS): Protocol to encrypt data in motion.
Access Control List (ACL): The process by which access is defined into a role or permission.
Role-Based Access Control (RBAC): The process by which roles are defined into an ACL. We define what ACL each user should have.
Need to Know: Only providing the required access that is necessary for the job.
Principle of least privileged: Similar concept to Need to Know. This principle implies that a user of a system should have access that provides minimal privilege for the job.



1.12 Lesson Review
---------------------------------------
In this lesson, we gave you an introduction to this course. Specifically, we learned:

Prerequisites
Why Microservices security is important
Course Overview
How Microservices security differs from traditional infrastructure security
History of microservices security
Stakeholders
Course tools & environment
Project overview
In the next few lessons, you will learn many methodologies and tools to secure microservices. Hope you will enjoy this journey and good luck!

Additional Resources
If you want to learn more about the history of Microservices, we recommend you check out this excellent blog post about the history of microservices.
The book Kubernetes Running Dive Future Infrastructure by <NAME> is a classic text that you should consider reading if you are serious about becoming a professional in this field.   
{'fraction_non_alphanumeric': 0.060465789093013166, 'fraction_numerical': 0.005111143256666184, 'mean_word_length': 3.990375360923965, 'pattern_counts': {'":': 0, '<': 12, '<?xml version=': 0, '>': 12, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 3, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '4827802', 'n_tokens_mistral': 4595, 'n_tokens_neox': 4208, 'n_words': 3013}