jimena-garbarino

Jimena is an experienced result and value-oriented programmer with a strong engineering background. She excels with Ruby on Rails, Java, and Scrum development. She has worked in web development for 10+ years in many industries and has a master's degree in software engineering from Universidad de Buenos Aires.

Spring Cloud Developer

Jimena Garbarino

Deploy a cloud-native Java Spring Boot microservice stack secured with Auth0 on Google GKE using Terraform and Kubernetes.

Deploy Secure Spring Boot Microservices on Google GKE Using Terraform and Kubernetes

Deploy a cloud-native Java Spring Boot microservice stack secured with Auth0 on Azure AKS using Terraform and Kubernetes.

Deploy Secure Spring Boot Microservices on Azure AKS Using Terraform and Kubernetes

A walk-through of building a microservices architecture with JHipster, Keycloak, Auth0, and Google Kubernetes Engine (GKE) deployment.

Identity in Spring Boot with Kubernetes, Keycloak, and Auth0

deepu-sasidharan

Deepu is a polyglot developer, Java Champion, and OSS aficionado. He mainly works with Java, JS, Rust, and Golang. He co-leads JHipster and created the JDL Studio and KDash. He's a Staff Developer Advocate at Okta. He is also an international speaker and a published author.

Staff Developer Advocate

Deepu K Sasidharan

Deploy a cloud-native Java Spring Boot microservice stack secured with Auth0 on Amazon EKS using Terraform and Kubernetes.

Deploy Secure Spring Boot Microservices on Amazon EKS Using Terraform and Kubernetes

Learn how to setup secure secrets on Kubernetes using Sealed Secrets, External Secrets Operator, and Secrets Store CSI driver.

Shhhh... Kubernetes Secrets Are Not Really Secret!

rinor-maloku

Rinor ([@rinormaloku](https://twitter.com/rinormaloku)) is an engineer at [Solo.io](http://solo.io/) working on application-aware networking solutions. He co-authored the book [Istio in Action](https://www.manning.com/books/istio-in-action?utm_source=rinor&utm_medium=affiliate&utm_campaign=book_posta2_istio_9_30_18&a_aid=rinor&a_bid=9f6a70f3) with Christian Posta ([@christianposta](https://twitter.com/christianposta)), and blogs about best practices on [his page](https://rinormaloku.com/).

Previously, he worked at Red Hat, where he built middleware software that enabled teams to ensure the high availability of their services.

Software Engineer

Rinor Maloku

Learn how Istio secures service-to-service traffic for your Kubernetes clusters and how to integrate with Auth0 for securing end-user traffic.

Authenticating and Authorizing end-users with Istio and Auth0

akhil-chawla

I am an enthusiastic software professional with 6+ years of experience in translating business requirements into innovative technological solutions. Have extensive experience as a full-stack developer in building end-to-end scalable applications using Java, Spring Boot/ Spring Cloud, CI/CD, Azure, AWS, Docker, Kubernetes, Jenkins, and others. I am always interested in learning algorithms, data structures, architecture design, and other new technical skills. Adding to my engineering background, I have recently completed my Executive MBA from MDI Gurgaon to enhance my managerial and team-leading skills. I am currently working with Optum (a UnitedHealth Group Company), Gurgaon.

Akhil Chawla

Learn what are the different deployment strategies available in Kubernetes and how to use them.

Deployment Strategies In Kubernetes

bruno-krebs

I am passionate about developing highly scalable, resilient applications. I love everything from the database, to microservices (Kubernetes, Docker, etc), to the frontend. I find amazing to think about how all pieces work together to provide a fast and pleasurable experience to end users, mainly because they have no clue how complex that "simple" app is.

R&D Content Architect

Bruno Krebs

Learn how to leverage Ambassador to secure apps running in your Kubernetes clusters with TLS certificates for free.

Kubernetes Tutorial: Managing TLS Certificates with Ambassador

Learn about the basic Kubernetes concepts while deploying a sample application on a real cluster.

Kubernetes Tutorial - Step by Step Introduction to Basic Concepts

jenny-obrien

I'm a former business journalist who's fascinated by the intersection of tech and business strategy — in particular how the right solution can transform an idea into reality. I specialize in ROI, data privacy, and identity.

Business Content Manager

Jenny O'Brien

How the economy, kubernetes vulnerabilities, and consumer complacency could equal more regulation.



Some argue that the [_number of reported data breaches in 2018_](https://www.forbes.com/sites/kateoflahertyuk/2018/12/19/breaking-down-five-2018-breaches-and-what-they-mean-for-security-in-2019/#735992841c4f) is the result of [_GDPR_](https://auth0.com/gdpr/)’s requirements. Still, the cascade of recent breach reports suggests that 2019 might be a tough year for cybersecurity. I asked our [_CISO/VP of Operations Joan Pepin_](https://www.linkedin.com/in/joanpepin/) and [_Security & Engineering Operations Director Duncan Godfrey_](https://twitter.com/duncangodfrey) about what we might expect.

<include src="TweetQuote" quoteText=".@auth0’s @CloudCISO_Joan and Security & Ops Eng. Dir. @duncangodfrey share their Top 5 Cybersecurity Predictions for 2019."/>

![Reduced Security Spend Will Lead to Economically Motivated Cybercrime](https://images.ctfassets.net/23aumh6u8s0i/45sm4mVBhnx0sbpZGkzhUg/fd99c7aaa6f3e407989cca122cc6ddd7/reduced-security-spending)

## 1. Reduced Security Spend Will Lead to Economically Motivated Cybercrime

[_Economic indicators in the US and globally do not look good_](https://www.theguardian.com/business/2018/sep/13/recession-2020-financial-crisis-nouriel-roubini), with tech companies having borne the brunt of recent market corrections, says Auth0 CISO/VP of Operations Joan Pepin. “I predict that 2019 will be a difficult year for security funding, and companies across the spectrum will freeze or reduce Information Security spending. An increase in economic hardship and a reduced defensive posture will therefore probably lead to more economically motivated cybercrime in 2019.”

![Information Warfare Around the Globe](https://images.ctfassets.net/23aumh6u8s0i/1Cug9bge9KqWfBDXABTtkq/80a2b903b524834e70397a3a4489972e/information-warfare-around-the-world)

## 2. Information Warfare to Target U.S. Companies, Specifically Defense and Communications

“[_We may be entering a new cold war with China_](https://www.washingtonpost.com/opinions/the-us-and-china-are-on-the-brink-of-cold-war-20-this-is-how-to-avoid-it/2018/11/29/24105fb6-f409-11e8-aeea-b85fd44449f5_story.html), as the trade war continues, now inflamed by actions taken against Huawei by Canada and the US,” says Joan. “I expect this to lead to increased cyber activity by the already rather active Chinese government, which may expand its operations to include more Russian-style disinformation and [_information warfare_](https://auth0.com/blog/information-warfare-offensive/). Look for major U.S. companies, especially large defense and communications providers to be the targets of this activity in 2019.”

![Kubernetes Vulnerabilities Lead to the Year of the Big Container Escape](https://images.ctfassets.net/23aumh6u8s0i/PNPKw8C7NEczARd71Ypg4/e46d0c07b0a306f2093ad3605ee4339e/kubernetes-vulnerabilities)

## 3. Kubernetes Vulnerabilities Lead to the Year of the ‘Big Container Escape’

When [_ZDNet reported a major security vulnerability with Kubernetes containers_](https://www.zdnet.com/article/kubernetes-first-major-security-hole-discovered/) early in December 2018, they noted that “[_Kubernetes_](https://kubernetes.io/) has become the most popular cloud container orchestration system by far, so it was only a matter of time until its first major security hole was discovered.”

That nothing in software is perfect is accepted news for devs and enterprises, but it’s also becoming an accepted thing for consumers (see prediction #4).

The Kubernetes privilege escalation flaw is a big deal, but it’s only the latest in the system’s [_discovered flaws_](https://www.twistlock.com/labs-blog/deep-dive-severe-kubernetes-vulnerability-date-cve-2017-1002101/), says Auth0 Security & Engineering Operations Director Duncan Godfrey. “Continued vulnerabilities to be found in Kubernetes infrastructure and the big one in 2019 is the Year of the Container Escape.”

![Cybercrime Accepted as Cost of Doing Business by Consumers](https://images.ctfassets.net/23aumh6u8s0i/foaom10ipH3jQBufHbbSc/c38ec328a63d0cc4ad50eb0a20639441/cybercrime-accepted-as-cost-of-doing-business)

## 4. Cybercrime Accepted as ‘Cost of Doing Business’ by Consumers

Despite multiple open investigations into [_Facebook’s series of breaches and sharing of personal data with other corporations without users’ permission_](https://www.nytimes.com/2018/12/18/technology/facebook-privacy.html), Joan doesn’t predict a permanent impact for the company — because consumers are reacting more like businesses (and Facebook’s attorneys will do their jobs).

Joan offered an example from her years as an outsourced security provider for an incident response company for Fortune 100 and Fortune 500 companies.

A major investment bank was having a massive issue of being dossed and having public-facing servers being breached. While on a conference call with all their vendors, including Cisco and Checkpoint and 30 bank vice presidents, the bank’s CTO said he had one question: “Is this happening to anybody else?”

Before Joan answered, she asked if he was going to divert the team to answer the question and if the answer was “yes,” what did he plan to do differently? He said if the answer was “yes,” he would “feel better” — a prime example of an enterprise settling into the cost of doing business online (although whether or not he needed to accept that particular cost could be debated).

“Having your identity stolen is horrifying for the individual, but my observation is that it’s perceived differently when lots of people are affected. After a breach, people don’t change their habits. People still shop at Target, stay at Marriott, and share information on Facebook. I’m not a psychologist or neuroscientist, but these facts lead me to believe that the trend of consumers accepting cybercrime as a cost of being online will continue into 2019.”

Because companies are not economically motivated to change and consumers may not feel empowered (let’s face it, [_the tiny payout from a class-action lawsuit_](https://www.consumerreports.org/data-theft/class-action-lawsuits-against-marriott-data-breach/) won’t pay for the damage and heartache of having your identity stolen), Joan expects regulators to step in, which leads us to Prediction #5.

![Expect More Data Privacy Regulation in 2019](https://images.ctfassets.net/23aumh6u8s0i/3rJMQ4kQiwVdRbwXuyouCj/dac8b3d32b2c2c2e3cba383fd02dba10/more-data-privacy-regulation)

## 5. Expect More Data Privacy Regulation

Shortly after the [_Marriott Mega Breach_](https://auth0.com/blog/marriot-starwood-data-breach-5-steps-to-protect-your-data/), the [_UK, the FBI, and three U.S. states opened investigations_](https://www.forbes.com/sites/thomasbrewster/2018/12/03/revealed-marriotts-500-million-hack-came-after-a-string-of-security-breaches/#13788844546f). The Marriott stock dip identified in many news stories, parallels that of the U.S. stock market, says Joan. Fines can function as a partial deterrent, but investigation and regulation move at a much slower pace than the agile tech lifecycle — the business consequence often lags far behind the technological changes needed.

GDPR is delivering an increase in reported breaches, but not clearly within the regulation’s [_72-hour breach-reporting requirements_](https://www.cnbc.com/2018/10/02/facebooks-muddy-account-breach-response-could-be-the-new-norm.html) and recent regulation in Australia demonstrates more than a sync problem — the way that [_Australia’s new backdoor requirements_](https://www.wired.com/story/australia-encryption-law-global-impact/) are written cripple tech’s ability to function securely, says Joan. [_Recent U.S. Senate hearings_](https://thehill.com/policy/technology/420838-google-ceo-responds-to-steve-king-concerns-about-granddaughters-iphone) demonstrate that many of the legislators in charge of regulating tech require greater understanding and education.

The answer, says Joan, would be for the tech industry to have greater input into educating those in charge of the regulations, followed by rational debate, and empowered law enforcement.

Regardless of whether or not the tech industry can influence these ideal conditions, [_all signs suggest we should expect greater regulation in the U.S. in 2019_](https://www.washingtonpost.com/news/powerpost/paloma/the-cybersecurity-202/2018/12/03/the-cybersecurity-202-senators-call-for-data-breach-penalties-tougher-privacy-laws-after-marriott-hack/5c0436431b326b60d12800d2/?utm_term=.e0c757791fde).

<include src="TweetQuote" quoteText="The economy, kubernetes vulnerabilities, and consumer complacency could equal more regulation in 2019 says CloudCISO_Joan and Security & Ops Eng. Dir. @duncangodfrey."/>

<include src="asides/AboutAuth0" />


"kubernetes"