Episode 19: Security at Lyft with Cartography | Some Engineering Podcast скачать в хорошем качестве

Episode 19: Security at Lyft with Cartography | Some Engineering Podcast

https://resoto.com/podcast/19 Alex Chantavy is a Senior Software Engineer at Lyft and one of the maintainers of Cartography. Cartography is a Python-based tool that collects infrastructure assets and their relationships into a graph view. Cartography is open-source and was developed in-house at Lyft to solve offensive security scenarios. Today, Cartography is also used at Lyft to solve other InfoSec use cases, like container vulnerability management. Cartography is built on top of the Neo4j graph data platform. The power of the graph is that it facilitates the exploration of many-to-many relationships. In this episode, Alex and I discuss the origins of Cartography, how the engineering team at Lyft uses Cartography data for remediation of security issues, and how the graph powers an automated issue management system. Alex's LinkedIn:   / alexchantavy   Cartography docs: https://lyft.github.io/cartography/ Project GitHub: https://github.com/lyft/cartography 0:0:00 Intro 0:00:52 What is Cartography? 0:01:50 Cartography and container vulnerability management 0:05:16 Using a graph and dependency trees to fix vulnerabilities 0:10:23 Why Lyft developed and open-sourced Cartography? 0:12:57 The ideas behind Cartography's design 0:15:40 The different ways to deploy Cartography 0:17:49 How Cartography draws relationships between entities from different data sources? 0:23:48 How to consume data from Cartography? 0:26:26 Why is graph representation more valuable for infra than a table? 0:35:00 Real-time vs. analytical approach to infrastructure 0:36:54 Example of how to extract insights from Cartography 0:40:20 Comparing point-in-time snapshots to track issues 0:44:31 Who uses Cartography? 0:47:22 Live demo of different usage scenarios 0:54:02 Conversion of the graph into a table to draw insights 0:57:32 What would be different if Alex had to rebuild Cartography now? 1:01:39 Collaboration to write graph queries in Cartography