This playbook is scripted to connect to EC2 instance via tags, then install the system package(s). The example below shows how to install Git, however, this can be any package. Order of things: You will obviously need to change the playbook values below in the script to match your AWS information. The values that need to be changed are highlighted in purple. Enjoy! Order of things:1. Get the ec2_instance_info,2. connect via ssh into the instance, and3. install git (could be any package).
Continue reading...What if you are compromised by a Zero Day?
First, to mitigate zero-days, you must have systems and people in place that can quickly locate zero-day exploits and patch them as soon as found. However, zero-day exploits are the most challenging digital attack to prevent and fix; once they’re discovered, it takes highly skilled IT professionals to promptly understand the problem and its impacts on the organizational infrastructure. Once the discovery has been made, you’ll need to mobilize a team to get it done promptly. Mobilizing a team should have an Incident Response Plan. An incident response plan is a set of instructions to help IT staff detect, respond to, and...
Continue reading...BitSight
BitSight: https://www.bitsight.com/ There are many vulnerability scanning tools in the marketplace, each with specialty solutions. These tools are for scanning other sections of the IT Domains, but it’s all a mesh of tools that solve a particular job. BitSight takes it a bit further, which does a scan and compare. BitSight is a cybersecurity rating company that analyzes your organization’s security. It scans your entire infrastructure, alerts you on vulnerabilities, and rates your security risk. The neat thing about this SaaS software, it gives you a security score like a credit score. Think of it as a gap analysis; the...
Continue reading...Application Layered Security
In an IT organization, you have Layered Security which is layers of controls within your system. Think of it as an onion with multiple layers. At each layer, the controls prevent attackers from getting to the core. Building an application, you will also need these same types of layers of control. As a Web Application developer, I build layers of controls into applications, for example; the development application layers for security I would include are: The end-user layer: Write front-end code JS to sanitize strings and data, and validation where needed Adding Authentication using Multi Factor-Auth (MFA) Back-end controller authenitcaiton...
Continue reading...Platform Wars on Security
The argument between which platform is more secure is an ambiguous interpretation, and always someone’s selective measurement. No platform is more or less safe than its competitors, and it simply comes down to individual security hygiene and their level of security knowledge. If you’re one of those people who sees an 80% coupon in your email box and then click on the link(s), chances are you’re getting malware installed on your machine, in essence, an infected machine. This has nothing to do with Mac or Windows; it was simply someone being naive not to review the source URL and know...
Continue reading...What a New IT Executive Should know about SOX
The Sarbanes-Oxley Act (SOX) is a federal act passed in 2002 with bipartisan congressional support to improve auditing and public disclosure in response to several accounting scandals in the early-2000s. Within section 404 of SOX, there are key features that require the CEO and CFO to prove their internal controls’ effectiveness and have external accounting/auditing firms audit and attest. What do you have to know?External auditors and the organization have to develop a set of critical requirements. These requirements will allow the auditor to “work with others” by parallel auditioning financial statements and IT controls over financial reporting. The requirements...
Continue reading...My Developer Notes
Sometimes, when working on applications, you’re going back and forth, reading through documentation and writing code. Here I capture how I like to document/video capture my development work. I think it’s a good idea to capture it in a video format because you can see all the little parts that don’t get captured if it was written out. This is my Process and Developer notes: Google APIs with Laravel (Gmail Service) Part 1 This is my Process and Developer notes: Google APIs with Laravel (Gmail Service) Part 2
Continue reading...Google’s Gmail API Mapping HTTP Request to PHP Class/Methods
I wanted to document how I could map the HTTP request reference to the actual class/methods. The Gmail Developers API gives you the HTTP request; however, the documentation in Google’s API PHP docs doesn’t do enough to tell you which request maps to what file class/methods. It takes a bit of reading and fumbling through the docs to get a good understanding. Helpful resources: Gmail API Summary: https://developers.google.com/gmail/api/reference/rest PHP Reference: PHP Classes: https://developers.google.com/resources/api-libraries/documentation/gmail/v1/php/latest/index.html Google APIs Client Library for PHP – https://github.com/googleapis/google-api-php-client Other Languages – https://developers.google.com/api-client-library
Continue reading...Kid’s Treehouse
Phase One Completed! I found the plans on the Home Depot website. It appears they’ve updated the page; I used the HomeDepot design plans from 2020 or later. The treehouse/playhouse, whichever you call it, uses treated lumber from Home Depot, which I used for the base. I had opted out of wrapping it around an oak tree we have in our yard because I honestly want it removed. I had followed the plans for the base but changed the top half of the treehouse. The structure base is the key, once that is completed and solid, you can build anything you want...
Continue reading...