Hey there! Welcome to Platform Weekly. Your weekly jump on the platform engineering trampoline. Every week, we round up the best of what the community is building, breaking, and arguing about.
Plus… we published a market guide for observability in platform engineering! I’ve been working on this for months and interviewing many many of you so go give it a read:)
And our first week on Substack! How exciting;)
10 ways to survive the vulnerability apocalypse
AI didn’t make your software less secure.. Crazy seeming statement I know especially considering the recent news of OpenAI and Anthropic agents going rogue and hacking people. But it’s true.
AI just made vulnerability discovery cheap. Awareness of vulnerabilities is up 10x. And that is only going to get worse. I’m sorry to say this isn’t a one-off wave. I’ve heard folks argue that we’re in the chaos now, but eventually AI will “discover them all”. As if that were possible. I hate to say it… but this is the new normal.
This week’s community webinar with Ashley Ward from Minimus on surviving the AI driven vulnpocalypse breaks down exactly what we are dealing with and how we need to respond to it
It’s Little’s Law in practice. The rate at which we clear tasks is outpaced by the rate at which new tasks arrive. But what does this mean for us? It means that security becomes an operational question, not purely a security team one. The old paradigm isn’t enough. We need to build the systems that can grow and handle an ever increasing rate of vulnerabilities automatically and by default.
Ashley walked through his platform engineer’s checklist for this.
Reduce the software. The cheapest vulnerability to fix is the one you never ship. Minimal images, secure base.
Know what you’re running. If you aren’t generating SBOMs as practice then i don’t know what to tell you…
Verify identity. Sign your images, and put gatekeepers in front of whatever’s allowed to run.
Don’t run as root. You know this one. Do it anyway.
Stop lateral movement. Network policies plus a real threat assessment. Your frontend shouldn’t ever really be talking to the db should it?
Runtime detection. The crown jewels need to live where things actually run
Immutable deployments. If you’re still SSHing into containers, this one’s for you…
Continuous scan prioritization. CVSS alone tells dirty lies. You need to be thinking reachability and business context to figure out what’s actually urgent.
Rebuild automatically. Recovery must become a totally routine platform capability.
Measure resilience. You need to be thinking rebuild time and recovery rate (not measuring against scary colours in a dashboard)
But the most important thing is to reframe how you think about security. STOP asking “how do we fix this vulnerability?” and start asking “how do we make this whole class of problems cheap to deal with forever?” That’s the gap we need to close.
Check out the webinar itself. Ashley goes deep on each move.
Quick bites
Highlight of the week
From the community
Want to catch the PlatformCon talks and workshops you missed? We’re adding more every week to the community YouTube channel.
And that’s a wrap on this week! As always, this newsletter is a community project. So if you have anything awesome to share from the cloud-native world, send it my way.
Stay crunchy🥐
Luca
As an aspiring Platform Engineer, I’ve been actively looking for a newsletter to stay up to date on the industry. I appreciate this being put out there to be consumed for free!