Ohhh, I have to hear more. I have a finished basement that I haven't done anything with since I bought my house and I've been thinking of doing this exact same thing.

1. Continuous monitoring of networks.
2. Tie specific malicious behavior to an IP address to see where it originated.

Both of these really fall under the vulnerability assessment category.

One of the biggest pieces to remember with CDR is how data is being traversed and who has access to what.

Network Detection and Response (NDR) provides two primary capabilities:

This could be larger cloud-based environments like Azure, Google Cloud Platform (GCP), and Amazon Web Services (AWS), or smaller clouds like Vultr and Digital Ocean (DO).

The primary goal of a CDR is to have a deep understanding of the environment.

(cont)

That means the apps/tools you're running locally to reach the k8s Service won't be able to reach it either.

That means if you're trying to access the resource locally (for example, connecting to the DB running in k8s), you have to do it from your local terminal.

If you try it from a cloud shell or something that isn't local, you won't be able to hit it via localhost.

(cont)

Here are a few tips when thinking about what platforms to use, how to use them, and what to think about when managing them.

And the goal is to add AWS EKS and AWS ECS.

KoaPerf is a scanner that tells you based on performance, cost, and resource needs where you should deploy a containerized workload.

The current recommendations it gives you are between:
✅ Azure Kubernetes Service (AKS)
✅ Azure Container Apps (ACA)
✅ Azure Container Instance (ACI)

Instead of scanning a Kubernetes Manifest to tell you the best place to deploy, it'll read a description that you add in or an architecture doc you upload.

However, before using ArgoCD, it has to be deployed to the cluster.

CICD pipelines are still the best way to get workloads and infrastructure initially deployed in an automated fashion.

I break down my thoughts about it in the link below.

buff.ly/3GWl2wy

and a few other aspects that are super crucial to implementing EKS (and Kubernetes in general) within any environment.

In this blog post, I break it all down.

buff.ly/WYBXgqU

Therefore, security really just ensures that there are people on the team who know the system/platform/application exceptionally well.

If they do, they can secure it.

More importantly - security, and I mean proper cyber security, can only occur when you know a system/platform/application VERY well.

You must know the ins and outs in every capacity.

(cont)