jaywon

"How do I become a Cloud Security Architect?" This is one of the most common questions that I get in my DMs. I am going to break it down step-by-step First off. Understand that there are 3 parts to "Cloud Security Architect". You need to have a great command over Cloud, then security, and then you can achieve competence in the third, "Architect". There are no hacks or shortcuts. You need to put in the time and the reps. Step 1 - Achieve competence with a particular cloud service provider. Even if you want to go agnostic. Get a good deal of competence in implementing and deploying on a single cloud (AWS/Azure/GCP/anything). Step 2 - Achieve competence in Cloud Security (for that cloud provider). This means - implement security with core security areas like IAM, Encryption, Logging and Monitoring, Threat Detection, etc. Step 3 - Study reference architecture or well architected systems. Each of these cloud providers have a set of referenced "well architected" architectures. For example - I am especially impressed with @Azure's reference architecture documents that detail architecture implementations on Azure for different industry verticals, etc. Step 4 - Use those reference architectures and break them down through a Security Architecture Review Process. I like to follow and train on this. But you can use whatever works for you. Step 5 - Practice, practice, practice.

Hire people with: • High energy • High integrity • High work ethic • High intelligence These 4 areas make up 80% of a great hire.

Last summer, I was on a walk with my newborn son when an older man approached me. He said: “I remember standing here with my newborn. An old man came up to me and said ‘It goes by fast, cherish it.’ Well, my daughter is 45 now. It goes by fast, cherish it.” It hit me hard. The next morning, I had my son in bed and felt a profound sensation: For the first time in my life, I had enough. As ambitious people, we spend most of our lives playing a game: Everything we do is in anticipation of a future. When it comes, we just reset to the next one: • "I can’t wait until I’m 18 so I can [X]." • "I can’t wait until I’m 25 so I can [Y]." • "I can’t wait until I’m 45 so I can [Z]." It’s natural, but it’s a dangerous game—one that we will lose...eventually. We waste a lot of energy on past and future when present is all that’s guaranteed. We push for more—but really, we need to find our enough. Never let the quest for more distract you from the beauty of enough. A simple closing reminder: Treat time as your ultimate currency—it’s all you have and you can never get it back. Spend it wisely, with those you love, in ways you’ll never regret.

Policy-as-Code is something that is very close to my heart. I think it's an extremely effective, but severely under-utilized security control. Let's talk about it 🤔 First of all, what is Policy-as-Code (PaC)? As the name suggests, PaC is application of code/automation to creating, managing and enforcing IT policies. ❓ What are these IT policies? They could be anything. From enforcing that images from certain container repos should only be running in a kubernetes cluster, to validating if a user is allowed to performing a certain action on an app, PaC can be used for a versatile and wide variety of policy management use-cases Why use Policy-as-code? - Imagine being able to deploy a single policy that enforces a JWT claim validation across hundreds of microservices in a single pass? - Imagine being able to deploy a single policy that enforces fine-grained access control over Kafka event streams in a single go? - And better yet, all this be testable in CI with unit/e2e tests? It's not too good to be true. It's the promise of PaC and I can say without doubt that its probably going to be the most important security control in an increasingly distributed stack 🛠 I'm convinced, which are the PaC Tools/Frameworks I should use? @OpenPolicyAgent is certainly the most versatile PaC framework that consists of a Domain specific language (Rego), Server and Plugins. It can literally be used anywhere where policy management needs to happen @kyverno and other kubernetes admission controllers are a great example of Policy-as-Code. While they are specific to the kubernetes world, they are significant in that domain @HashiCorp sentinel is an example of policy-as-code for the ever-expanding world of Terraform

15 years ago, my dream was to be a Private Equity Investor. 7 years ago, I discovered operations. 4 years ago, I got passionate about growth marketing. Now I am advising CEOs on growth marketing, operations and investing. Passions change. That's ok. Your skills accumulate.

Curious about Hiapo? Check out Papa Kūlia hōʻike this Friday at 4pm and give them a hūlō hūlō 🎉. Haumāna will demo projects that feature the ʻike and skills theyʻve learned over the past 15 weeks. Zoom link: us06web.zoom.us/meeting/regi…

What were you doing 10 years ago?

Okay, okay. A thread on why this is a screaming red flag as a Cloud Economist...

I’m grateful that #GoogleCloudNext allowed me to have the keynote stage for such an important topic and I hope that the tips + tricks I give you will help you identify where you’re at on the burnout scale and give you the tools you need to climb out of it. youtu.be/FeDks5BJCQQ