[image_with_animation image_url=”68704″ animation=”Fade In” hover_animation=”none” alignment=”” border_radius=”none” box_shadow=”none” image_loading=”default” max_width=”100%” max_width_mobile=”default”]We recently participated in Silicon’s Cloud & Security Leaders Event, where we delivered one of the opening presentations alongside industry leaders like Wiz and AWS. Our session focused on both the opportunities and challenges AI brings to cybersecurity, including potential security risks. We explored Google’s cybersecurity journey, Making Science’s implementation success stories, and essential considerations for organizations looking to elevate their cybersecurity infrastructure. Álvaro Verdeja, our COO of Cybersecurity, Cloud, AI, and Software, and Francisco Dalmau, Channel Account Manager at Google Cloud for Iberia and Italy, shared these insights.

The Google SecOps Journey – Operation Aurora

While Google’s consumer products are universally known, its cybersecurity portfolio remains less familiar to many. Francisco Dalmau highlighted how “everything started with Operation Aurora in 2009,” a significant cyberattack that targeted U.S. organizations. The attackers sought to access source code—the crown jewels of tech companies—by exploiting vulnerable hosts to move laterally through corporate networks and access unsecured source code repositories.

Operation Aurora taught Google that traditional perimeter-based security was inadequate for modern threats. This realization led to a complete security model redesign encompassing infrastructure architecture, software development, and operational practices. The result was Google’s zero-trust model, founded on the principle of “trust nothing, verify everything.” Thus, Google’s security model was born.

This led to Google now having a complete portfolio of security tools that compete with the most cutting-edge products in the market, Google SecOps, VirusTotal, and Google threat intelligence are some of these. All of them rely on the power of Google Cloud to possess unique capabilities in the market.

Making Science’s Implementation Excellence

As Google Premier partners and cybersecurity specialists, Making Science has spent over two years leveraging Google SecOps for comprehensive threat management. 

The solution combines two powerful components:

• SIEM: Enables comprehensive threat detection through multi-source data ingestion and alert creation
• SOAR: Automates manual processes through playbooks, allowing small security teams to manage enterprise-scale operations efficiently

Álvaro Verdeja noted, “We’ve tested these solutions internally to ensure optimal client protection.”Some of the incidents we manage automatically are information leaks, connections from unusual locations, report creation, or blocking and resetting of compromised users and credentials.

AI’s Role in Cybersecurity

While the buzzword right now is Artificial Intelligence, Google also has its own, Gemini, which comes incorporated into its security products and was defined by Francisco Dalmau in the following way:

While the buzzword right now is Artificial Intelligence, Google’s Gemini AI, integrated into its security products, represents the next evolution in cybersecurity. Francisco Dalmau offered an illuminating metaphor: “Gemini is an assistant that when you’re looking at a window, and the one next to it is the same, tells you that the same thing might happen again and by the way, we should also check the doors in case any are open.” This is a very apt metaphor for me since, as always mentioned, one of the biggest problems currently is the lack of talent and investment. With Gemini, we have that help, that assistance that guides us, but also works for us, creating queries without knowing the language or playbooks to automate tasks.

This AI-driven approach enables automation of Level 1 security operations, allowing teams to focus on complex challenges while reducing manual tasks like false positive management in traditional SOC environments.

Key Recommendations

The session concluded with three essential insights for business security:

1. View cybersecurity as an investment, not an expense – major organizations have failed due to security breaches
2. Rely on professional expertise – avoid compromising security with inadequate implementation
3. Embrace zero trust and least privilege principles – verify everything and minimize access permissions

Ready to Transform Your Security Infrastructure?

Connect with Making Science’s cybersecurity experts to explore how we can enhance your organization’s security posture with Google Cloud’s advanced solutions.

The digital world is under siege. Cyberattacks are becoming more sophisticated and frequent, yet a critical line of defense is worryingly thin: the cybersecurity workforce. The stark reality is that there simply aren’t enough skilled professionals to combat the growing threat, leaving organizations vulnerable.

This alarming talent shortage took center stage in our recent “Cloud Maturity Journey” podcast episode, “Building a Digital Fortress: Security Best Practices and Strategies”. Our expert guests, Miguel Lopez, Cloud & Cybersecurity Director at Making Science, and Washington Gomez, CISO of GETD, provided invaluable insights into this pressing challenge.

The People Problem:

“The main challenge organizations face today lies with people,” Washington emphasized. “And when I say people, I mean talent.” This sentiment highlights the fierce competition for skilled cybersecurity professionals, making it difficult for companies to attract and retain top candidates.

A Complex Threat Landscape:

The rapidly evolving technological landscape, particularly advancements in Artificial Intelligence, has significantly complicated the cybersecurity environment. Cybercriminals are exploiting these tools to develop increasingly sophisticated attacks, making it difficult for organizations to stay ahead.

While technology offers potential solutions, it also exacerbates the talent shortage. Tools like AI and automation can optimize certain cybersecurity tasks, but they require skilled professionals to operate and maintain them. Additionally, the shift towards cloud infrastructure has introduced new vulnerabilities demanding specialized expertise.

Building a Resilient Defense:

To address this challenge, organizations must adopt a comprehensive approach, including:

• Investing in employee training: A strong security culture begins with informed employees. As Miguel, another podcast guest, emphasized, “Employee training is essential. They need to understand they are targets and be proactive.”
• Fostering cross-team collaboration: Collaboration between security teams and other departments, such as development and operations, is crucial. This integrated approach can help embed security into the software development lifecycle and enhance overall resilience.
• Leveraging automation: Automation can improve efficiency and reduce human error. However, it’s essential to maintain a balance between automation and human oversight.
• Staying updated on emerging threats: Cybersecurity professionals must stay informed about the latest threats and trends. This involves staying updated through industry publications, conferences, and networking.

Looking Ahead:

The cybersecurity industry presents significant challenges and offers exciting opportunities for skilled individuals. The demand for qualified professionals is high, and career prospects are promising. By investing in continuous learning and development, individuals can position themselves for success in this dynamic field.

Ultimately, addressing the cybersecurity talent shortage requires a collaborative effort from governments, industry, and academia. As Washington pointed out, “Cybersecurity isn’t just about technology; it’s a process involving people, processes, and technology.” By working together to develop educational programs, promote cybersecurity as a career, and foster innovation, we can build a more secure digital future.

To gain deeper insights and practical advice, we encourage you to listen to the full episode.This podcast offers a comprehensive overview of the cybersecurity challenges and opportunities, providing organizations with the tools to protect their assets and reputation.

Listen to the full episode of Cloud Maturity Journey to learn more about building a solid cloud foundation for your business.

In today’s digital age, privacy has become a cornerstone of consumer trust and brand integrity. As an agency, we understand that safeguarding user privacy is not just a regulatory obligation but a strategic advantage. This blog post explores why privacy matters and how leveraging first-party data can elevate your marketing strategies while fostering a trustworthy relationship with your audience.

The Importance of Privacy

Consumer Trust and Loyalty: Privacy is a significant concern for consumers. According to various studies, a majority of consumers are more likely to trust and stay loyal to brands that protect their personal information. When users feel confident that their data is secure, they are more willing to engage with your brand, share their preferences, and provide valuable insights to drive more personalized and effective marketing campaigns.

Regulatory Compliance: Privacy laws such as the GDPR in Europe and CCPA in California mandate stringent data protection measures. Non-compliance can result in hefty fines and damage to your brand’s reputation. By prioritizing privacy, you not only avoid legal repercussions but also demonstrate your commitment to ethical business practices, which can be a competitive differentiator.

Brand Reputation: In the era of social media, news about data breaches or misuse of personal information spreads quickly. Such incidents can severely damage a brand’s reputation. By ensuring robust privacy measures, you can prevent potential breaches and maintain a positive public image.

Leveraging First-Party Data

First-party data refers to the information you collect directly from your audience through your channels, such as your website, mobile app, social media, and email campaigns. Here are the advantages of leveraging first-party data:

Accuracy and Relevance: First-party data is collected directly from your audience, making it highly accurate and relevant. Unlike third-party data, which can be outdated or incorrect, first-party data provides real-time insights into your audience’s behaviors, preferences, and needs. This accuracy allows for more precise targeting and personalization, leading to higher engagement and conversion rates.

Control and Ownership: When you collect first-party data, you have complete control over how it is gathered, stored, and used. This control ensures that you can maintain high data quality standards and comply with privacy regulations. It also eliminates dependency on third-party data providers, reducing the risk of data breaches and privacy violations.

Cost Efficiency: Relying on third-party data can be expensive. By focusing on first-party data, you can reduce data acquisition costs and invest more in strategies that enhance data collection from your audience. This cost efficiency can significantly improve your marketing ROI.

Enhanced Customer Experience: First-party data allows you to create a seamless and personalized customer experience. By understanding your audience’s journey across different touchpoints, you can tailor your messaging, offers, and content to meet their specific needs. This personalization enhances the customer experience and increases satisfaction and loyalty.

In conclusion, privacy matters more than ever in today’s digital landscape. By prioritizing privacy and leveraging first-party data, you can build a foundation of trust with your audience, ensure regulatory compliance, and enhance your marketing effectiveness. As an agency, we are committed to helping you navigate the complexities of data privacy and harness the power of first-party data to achieve your business goals. Let’s work together to create a privacy-first strategy that drives sustainable growth and lasting customer relationships.

[button open_new_tab=”true” color=”accent-color” hover_text_color_override=”#fff” size=”large” url=”www.makingscience.com/contact” text=”Contact Us” color_override=”#f0076f”]

In our previous blog note, we discussed a methodical approach to converting call center audio recordings into text on an industrial scale. This capability is a game changer for companies in many different industries since it allows them to obtain relevant customer data (customer satisfaction, churn reason, etc.) that only a few years ago was inaccessible and used to take a lot of human effort and resources to unlock.

One of the key points to be compliant with current regulations is the importance of removing sensitive information about the users from the datasets used with analytical proposes. This sensitive information is what we call PII (Personal Identifiable Information). If this data is not properly handled or removed from the datasets used to extract users’ insights, it may result in costly lawsuits against businesses. This article will discuss different techniques to remove PII data from audio conversations previously converted to text “dialogs.”

Different techniques to remove PII information

Plenty of tools are available on the market to remove PII information. All these tools perform the same function but with different techniques under the hood, varied results, and varied costs. The core functionality is to take a text input that “contains” sensitive information and return an anonymized text. These tools also allow the user to define which PII attributes should be considered in the scope for anonymization (first names, surnames, phone numbers, emails, IP, etc.). Figure 1 shows a graphical representation of how a PII removal tool should work.

Figure 1: an example of how a PII removal tool works.

Until recently the best practice was to utilize a rules-based system to look for PII attributes, tag/treat those attributes as early as possible in the data ingestion processes that moved data into the Enterprise for processing. All of this is to protect customers’ confidentiality and reduce other types of business risks. 

Before modern machine learning systems, rule-based systems were the standard way to anonymize data. These systems use a set of rules to define if a word belongs to a certain entity type (in this case, these entities can be names, email addresses, phone numbers, etc.) and mask the input text based on these rules. However, this kind of solution implementation has limitations and maintenance costs as new attributes come into the business:

1. Rigidness: the rule-based systems will catch only the entities’ values that the rules defined by the user comprehend. In other words, they are rigid. Because of that, if a new entity value doesn’t fulfill one of the predefined rules it won’t be caught by the system. For example, if the user tries to catch names by using a rule (a fixed list of names), if an example with a name that isn’t included in the rule’s list, then the system won’t mask that new value as a name.
2. Contextual limitations: some names can have another meaning (being a noun or an adjective) depending on the context. For example, Rose is cleaning the vase. Depending on the context, a Rose can be a name or a noun (the flower). These kinds of cases take a lot of work to catch for rule-based systems.

As Large Language Models are becoming more widely available and affordable to use, modern AI-based PII systems tackle these problems by taking into account the labels that may accompany the PII attribute and even the context where the PII attribute(s) are embedded. Because of that, their accuracy in finding and mapping these PII entities is much more accurate than the old-fashioned systems.

In this article, we will evaluate two different approaches to finding PII fields: classic entity recognition systems and LLM-based systems. The entity recognition systems look at a word context to define whether that world is a PII field or not. In this case, the tool used was Google DLP (Data Loss Prevention). This tool has an entity recognition model that recognizes up to 150 different types of fields with sensitive information. On the other hand, the LLM-based systems use an LLM and a prompt designed for the PII recognition task and mask the PII values detected in the piece of text given as input. One of the key advantages of this approach is that it allows the user to define custom PII fields to be masked (outside, for example, the 150 default ones available in Google DLP) by simply modifying the prompt used for this task. Customization is the key advantage of this approach.

The benchmark

For this benchmark, we used the pii-masking-200k dataset. This is a public dataset that contains 200,000 pieces of text with PII data labeled. This dataset contains up to 54 different PII categories and the pieces of text are in four different languages (English, French, German, and Italian). It provides a comprehensive source of truth for model comparison since it contains many different PII categories in many languages.

For this particular benchmark, we focused on five PII categories: first name, last name, email address, phone number, and address. This constraint reduced the sample size to 3826 elements. For each estimator and each PII category, we quantified the number of times when that category was correctly and incorrectly found. We considered that a piece of text is incorrectly labeled when the model doesn’t assign the expected label and when the model assigns an incorrect label (i.e.: an estimator masks Mouriño Street as [LAST_NAME] Street).

As we mentioned before, we used Google DLP, Data Loss Prevention, to represent the classical entity recognition models. For the LLM-based approach, we tested many different models using the same prompt. These models are GPT 3.5, GPT 4, GPT 4o (OpenAI), Anthropic Claude v2 (AWS), Gemini 1.5 Flash, and text-unicorn@001 (Google Cloud). Since some improvement can be obtained by customizing the prompt for each model, the idea behind this experiment is to separate the poor-performing LLMs from the high-performers. The obtained results are displayed in Table 1. The detailed results by each category can be found in Table 2 to Table 8 (see the appendix).

Table 1 – benchmark results summary. The cost data was updated on 2024-06-26. OpenAI and AWS models’ costs are expressed per 1K tokens whereas for Google models are per 1K characters

The main takeaways from this benchmark are:

1. The estimator with the best performance is the GPT-4-based system, and the one with the worst performance is Google DLP.
2. If we take into account the price, the system with the best price-performance trade-off is the Gemini 1.5 Flash-based system. This is because it costs 10 times less than the GPT-4-based one and it has a performance only 6% lower if we consider the overall accuracy.
3. For Google DLP, it’s particularly surprising that it is unable to catch any address value. By doing a deep dive into the examples, we found out that it tends to confuse surnames as addresses (i.e.: Johnson Street is anonymized as [SURNAME] Street).
4. All the systems have a great performance for email address (the model with the worst performance, GPT-3.5, has a 94.13% accuracy for this label) recognition.

Choosing the Right PII Removal Method

In this article, we compared several estimators to find PII attributes in text and to remove them. This is a crucial step in any call center analytics system (and, in general, in any system that works with text data with sensitive information) since it allows the removal of users’ personal information.

We observed an important variability in the performance of the two solution approaches and across the different LLMs.

If we look only at the overall accuracy, the best performer estimator is the GPT-4-based system (OpenAI), and the worst performer is Google DLP (Google Cloud). However, if we include the cost in the equation, the best option by far is the Gemini 1.5 Flash-based system (Google Cloud Platform). This anonymization system has an overall accuracy comparable to the GPT-4-based system but for a fraction of the cost (10 times less).

PII identification, tagging, and treatment performance should not be forgotten about. Cloud and service accounts require that quotas be adjusted according to performance demands for the given use cases and volumetrics being targeted.

For each particular use case, it is important to take into account the specific requirements for it. Because of that, it is important to assess the required accuracy to be compliant with the product requirements, the cost that this accuracy implies, and accepted latency (if the system will be a stream system, then the latency will be an important factor in choosing the best-suited estimator for the use case).

The latest relevant aspect to point out is that there is no perfect model. This idea is crucial for PII remotion use cases because, in some situations, very demanding standards regarding data anonymization must be fulfilled. Because of that, to be fully sure that the system does its trick in the way it should, from Making Science we always recommend keeping the human in the loop. The presence of human validation of the output generated by the LLM-based system will ensure that the solution fulfills the minimum requirements regarding PII entities’ remotion.

Accuracy by label by model appendix

Table 2 – GPT-4 accuracy by PII field

Table 3 – GPT-4o accuracy by PII field

Table 4 – GPT-3.5 accuracy by PII field

Table 5 – Anthropics’s Claude v2 accuracy by PII field

Table 6 – text-unicorn@001 accuracy by PII field

Table 7 – Gemini Flash 1.5 accuracy by PII field

Table 8 – test-unicorn@001 accuracy by PII field

Table 9 – Google DLP accuracy by PII field

Conclusion

This exploration into PII removal from call center transcripts reveals a critical takeaway for businesses: achieving both accuracy and cost-efficiency is possible. While the advanced capabilities of GPT-4 delivered accuracy, the cost factor cannot be ignored. This is where Gemini 1.5 Flash shines, providing top-notch performance at a significantly lower cost, making it a compelling solution for organizations of all sizes.

At Making Science, we understand the importance of balancing powerful AI solutions with robust security measures. We are committed to helping businesses unlock the full potential of their call center data while upholding the highest ethical and security standards. Our team of experts can help you develop and implement a tailored PII removal strategy that leverages the latest technologies, including Gemini 1.5 Flash, while ensuring complete and reliable data anonymization. Contact us to learn how we can tailor a solution to your specific needs.

It is very common to hear the word phishing in our day-to-day life, sometimes we are even able to use it without really knowing what the meaning of this word is. The purpose of this Blog Post is to provide a deeper understanding of the most prevalent and dangerous cyber-attack technique: phishing.

Exploring the world of phishing

Phishing is a type of cyberattack designed to target individuals through emails, text messages, phone calls or other forms of communication. Its primary goal is to trick the recipient into performing actions desired by the attacker, such as revealing financial information or login credentials to corporate systems or other sensitive information.

As a form of social engineering, phishing involves psychological manipulation and deception, where threat actors pose as trusted entities to induce users to perform specific actions, such as clicking on malicious links, downloading and installing malicious files, or disclosing private information such as bank account numbers or credit card details.

What distinguishes phishing and makes it especially dangerous is that its success depends on human action. Even if advanced security measures are implemented, a simple user error can compromise an entire company.

The Impact on the Organization

Phishing attacks can have a variety of consequences, the most common of which are:

• Data loss
• Compromise of accounts and login credentials
• Ransomware and/or malware infections
• Financial losses and fraud from banking transactions

Advanced phishing strategies

As all technologies evolve, so do phishing campaigns. Attackers learn from their mistakes and improve their strategies, making them more difficult to identify. Recently, a new strategy has been discovered that we want to address in this article. It involves phishing that spoofs Meta for Business, using a Salesforce website as a bridge to direct the user to a seemingly secure target.

It starts with an email pretending to be from Meta for Business, informing the user of a violation of the community rules that involve account deletion (1). This type of campaign is targeted, as it addresses the user by name. Although the sender of the email is noreply@salesforce.com, which is suspicious, it is a trusted domain that avoids detection by conventional filters and generates fewer doubts in the user. The email includes a button to send an appeal.

If the user clicks the button, he is directed to a Salesforce-hosted website (2), requesting an identity verification via hCaptcha (3). Once the verification is completed, the user is left vulnerable to the attack (4). 

In this case, the page was hosted by Salesforce, but any other platform can act as a bridge. This pattern is persistent and, despite technical efforts, many sites manage to go undetected. By contacting the Salesforce team, it has been possible to remove the intermediate page and block the mailing from Salesforce.

How to identify the threat?

As we have seen, phishing is a type of attack that is characterized by its versatility, so there is no exact method to identify it. However, there are signs that will give us a clearer picture of whether the email we have in front of us is legitimate or not:

1. Pay attention to the sender: Verify that the sender is consistent with the content of the email. In the case mentioned above, the email pretended to be from Meta for Business but came from a Salesforce address, a clear indicator that it was not legitimate.
2. Review images and links: By hovering the mouse over images, buttons, or links, you can view the address to which they redirect. It is crucial to verify that the domain matches the owner of the client or partner. Platforms such as VirusTotal can help to check the legitimacy of domains.
3. Check typography and special characters: Legitimate emails follow specific typography standards. Atypical elements may indicate a phishing attempt.
4. Verify through regular channels: If the sender claims to be part of your organization, use regular communication channels to confirm their identity. The CEO fraud case is also a very common attack.

Protecting ourselves in the digital world.

In summary, phishing is a persistent threat that is continually adapting. Awareness, education, and the use of security technologies are essential to be protected. Being informed and vigilant helps build a safer and more resilient digital environment against this growing threat. In a world where cybersecurity is crucial, prevention and attention to detail are critical to avoid falling into phishing traps.

In the realm of cybersecurity, Advanced Persistent Threats (APTs) emerge as a hidden menace challenging digital security. These large-scale, sophisticated attacks, known for their stealth and longevity, can significantly impact organizations, including the loss of confidential data, reputational damage, and operational disruptions.

The primary goal of such attacks is to stealthily steal confidential data in a continuous and persistent manner. The perpetrators behind APTs are highly experienced teams that, backed by substantial funding, are dedicated to exploring and exploiting vulnerabilities over long periods of time, focusing their attacks on high-value organizations.

The Covert Stages of APTs

These dangerous cyber-attacks advance in secrecy through various stages, completely undercover.

• Identification and Reconnaissance

In this stage, attackers meticulously gather information, exploring every detail. Their goal is to fully understand the infrastructure, protocols, and devices of their target.

• Infiltration and Foothold

Equipped with the gathered information, attackers gain access to the internal network using customized malware. Sometimes, they create secret entries and backdoors to re-enter the network undetected, solidifying their position within the network.

• Escalation and Lateral Movement

Once inside, they deepen their incursion, acquiring passwords and privileges. This ability allows them to move unrestricted through the system in search of the information they desire.

• Exfiltration

Like true cybercriminals, they discreetly store the stolen data in a safe place within the network, patiently waiting until their collection is complete. Finally, they extract the data without leaving a trace, even blocking network personnel while they complete their operation.

The Unmistakable Signs of an APT

To quickly identify these cunning criminals, it’s essential to be alert to obvious signs that you may be a victim of their attacks:

• Increased logins and user account activity at unusual hours.
• Increase in database activity such as movements, creation, or transfer of massive amounts of data.
• Receipt of fraudulent emails to carry out phishing attacks.
• Existence of backdoors that allow access and control a computer without the user realizing.
• Compressed data for export in suspicious places.

Protection Against Invisible Threats

However, in the digital realm, APTs are not invincible. Companies must take ongoing measures and actions to protect themselves:

1. Awareness: It is key to inform all employees of the existence of such threats, their repercussions and share signals that may indicate an unnoticed intrusion.
2. Up-to-Date Maintenance: Keeping software and devices updated to prevent attackers from exploiting vulnerabilities.
3. 24/7 Monitoring and Surveillance: Implementing the use of monitoring systems that analyze internal network traffic for threats and alert of suspicious movements or unauthorized accesses. For this, AI/ML present great opportunities by being able to quickly and accurately detect suspicious activities, and generate alerts so that security teams can respond preventively.
4. Firewalls: Isolating the organization’s network from the outside, effectively controlling what enters and leaves the network.
5. Password Policies: Using strong passwords and changing them regularly to strengthen security.
6. Advanced Security Solutions: Organizations can implement advanced security solutions, such as cyber intelligence, behavior analysis, and incident response, to help detect and respond to APT attacks.

Defend Your Cyber Frontline with Making Science 

In a digital world affected by APTs, staying alert and prepared becomes our main line of defense against this hidden threat. The battle continues, and only those who face this darkness with utmost caution can resist this adept tactic of cybercrime.

Making Science is a trusted partner for organizations seeking to protect their data and reputation from APT attacks. With the help of Making Science, organizations can rest assured that they are taking the necessary steps to protect themselves from this increasingly serious threat.

The future of cybersecurity requires a proactive and persistent defense. Partner with Making Science today and strengthen your frontline against the unseen threats of the digital world.

Microservices architecture has revolutionized the way we develop and deploy applications. Think of a monolithic application like a massive building where every change requires a massive reconstruction. However, this architectural innovation is not without its challenges, especially when it comes to testing and continuous delivery.

In this article, we will explore how to address these challenges and ensure software quality in a microservices environment through effective testing and a Continuous Integration/Continuous Delivery (CI/CD) process.

Microservices and CI/CD: A Partnership for Efficiency

Microservices architecture is a software design approach that decomposes an application into small independent services known as microservices. Each microservice focuses on a specific function and operates autonomously, allowing greater flexibility and scalability compared to traditional monolithic architectures, particularly in the development and deployment of each microservice. Each microservice has its own code repository, enabling independent integration, delivery, and deployment.

On the other hand, the CI/CD approach involves Continuous Integration with automated tests and integration of new code into the main repository. Continuous Delivery refers to the ability to provide functional software versions quickly and reliably. Continuous Deployment takes automation a step further by implementing new versions into production without manual intervention.

The Pillars of CI/CD: The Path to Success

These fundamental principles are crucial for the successful implementation of CI/CD, aiming to accelerate software development, improve its quality, and enable predictable and secure deployments. Below, we list various advantages and best practices of this approach

• Frequent checks on the main branch: It’s vital to regularly integrate code into the main branch and avoid excessive use of secondary branches. Merging small changes frequently is recommended to prevent issues.
• Automated compilation: I processes should automate code compilation and image generation, including web server files, database scripts, and application software.
• Self-checking of builds: Continuous testing is essential. If a test fails, the build should be considered failed. Pre-build static test suites should be used to ensure code quality and security.
• Frequent iterations: Small and frequent iterations are recommended over massive changes to facilitate issue correction and conflict resolution.
• Versatile testing environments: Testing should be carried out in a “cloned” environment that mimics the real production environment. Rigorous test scripts should be used to detect errors. When handling sensitive user data, it’s crucial to include data anonymization tools to obtain replicas as similar as possible to the real production environment.
• Maximum visibility and single source code repository: All developers should have access to the latest executables and changes in the repository. Repository information should be visible to all, facilitating progress monitoring and issue detection. Furthermore, a centralized repository containing all the elements necessary for compilation, including source code, database structure, libraries, and test scripts, is required.
• Predictable deployments at any time: Deployments should be routine. CI/CD processes should be rigorous, allowing the team to deploy updates at any time and facilitating change reversions.

It’s important to take advantage of tools provided by platforms like GitHub, Bitbucket, and others to overcome the limitations of traditional code repositories and expedite implementation.

Testing challenges in microservices architecture

Granularity: Detailed testing for optimal results

One of the main challenges in microservices architecture is granularity. Instead of having a single monolithic application, we now have multiple independent microservices that communicate with each other. This means that not only do we need to test each microservice separately, but also ensure that they work effectively when integrated. This is where unit tests, integration tests, and end-to-end tests play a crucial role.

Dependencies between microservices: The invisible network

Microservices often depend on others to function correctly. Updates in one microservice can affect others, complicating testing and continuous delivery. It is essential to implement contract tests and dependency simulations to ensure that changes in one microservice do not break the functionality of others.

Testing strategies in microservices architecture

Unit Testing: Ensuring the robustness of each microservice

Unit tests are essential to ensure that each microservice works correctly at the code level. Exhaustive tests must be performed on each microservice to detect and correct errors at an early stage of development.

Integration Testing: Ensuring harmony among microservices

Integration tests focus on verifying that microservices communicate effectively with each other. They may include contract tests to ensure that interfaces are compatible and data flow tests to ensure that data is transmitted correctly between microservices.

End-to-end Testing: The end-user perspective

End-to-end tests simulate the complete flow of a request through various microservices. These tests are crucial to ensure that the application functions as expected from the end user’s perspective.

By adopting effective testing strategies and automating the CI/CD process, you can ensure that your microservices operate reliably and efficiently. The investment in testing and CI/CD in this type of architecture is worthwhile for achieving high-quality software and successful continuous delivery.

A new balance in software development

In summary, microservices architecture and testing practices, combined with CI/CD, collaborate to deliver scalable and reliable applications in a highly dynamic environment. Striking a balance between development speed and software quality is essential for long-term success in the era of microservices.

This balance is not just a requirement but an opportunity to redefine our perspective on software development. By incorporating these methodologies into our work processes, we are not only preparing for the future but actively shaping it. Let’s harness the power of microservices, CI/CD, and strategic testing to drive innovation and efficiency in our projects.

Making Science is a digital transformation company that helps businesses harness the power of technology to improve their processes and outcomes. The company has extensive experience in developing software with microservices architecture and implementing CI/CD solutions.

The future of software development has arrived and demands a new equilibrium. Contact us to accompany you on this exciting journey!

The data of your company, your clients, and the infrastructure of your business/organization are some of the main assets of any company. Often, these assets are not sufficiently protected.

When we talk about protection, we refer to the implementation of security measures, technology, and tools that protect your systems from external threats. These security measures also ensure that human error does not leave the organization’s assets exposed.

Security must be present from the conceptualization of digital services and their migration to the cloud. Companies must adhere to all regulations and ensure the reliability of their environments. This way, they can avoid unpleasant situations that could result in fines, economic losses, and reputational damage.

Do companies invest in security? Not as much as they should. That is why we want to stress the importance of investing resources and budget in solutions, technology, and tools that can help you prevent disasters.

And just as important as investing in this security technology is working with the best partners to be able to implement and deploy strategies that allow us to face any attack. 

Google Cloud Platform has the capacity and tools to improve the security of your company. Some of the products that we can implement together include

1.  Security Command Center
2.  Zero Trust: Beyond Core Enterprise 
3. Chronicle
4. Virus Total
5. Recaptcha

Security Command Center

SCC is a Google Cloud security and risk management platform. With it, you gain centralized visibility and control, can detect misconfigurations and vulnerabilities, can report violations and help with compliance, and detect threats that put your Google Cloud resources at risk.

Its main functions are: 

• Resource discovery and inventory: Discover and query your resources in near real-time from App Engine, BigQuery, Cloud SQL, Cloud Storage, Compute Engine, Cloud Identity, and Access Management, Google Kubernetes Engine, and many more. Review the history of discovery processes to locate new, changed, or deleted resources.
• Threat prevention: Stay informed about the security status of your Google Cloud resources. Detect the most common vulnerabilities that can put your web applications at risk, such as cross-site scripting or outdated libraries, running on App Engine, GKE, and Compute Engine. To quickly fix misconfigurations, just click directly on the affected resource and follow the steps provided.
• Threat detection: Uses logs running on Google Cloud at scale to identify threats. Detects some of the most common container attacks, including suspect binaries, suspect libraries, and reverse shells.

Zero Trust: Beyond Core Enterprise 

A Zero Trust solution that enables secure access to applications and resources, and offers built-in threat and data protection. We recommend it because

• It’s a scalable and reliable solution: It is based on the backbone of Google’s global infrastructure and network to offer an optimal and secure experience with integrated protection against denial of service attacks (DDoS), low latency connections, and flexible scaling.
• It offers comprehensive and continuous protection: A layered approach to security between users, access, data, and applications that help protect every click against malware, data loss, and fraud.
• Of its open and scalable ecosystem: Includes information and profiling signals from leading security vendors to offer a higher level of protection.

Chronicle

Google’s cloud-native SIEM, Chronicle, is designed to handle massive amounts of data and mine signals to find threats instantly.

Chronicle works by processing your data into a private container and combining it with data from Google. Everything is then aggregated, normalized, and linked into a consistent timeline, to later expose all that data through investigation, search, and discovery, as well as to other security products through APIs.

The advantages of Chronicle are

1. It is infinitely elastic, providing an elastic container to store enterprise security telemetry
2. It’s Cloud Native, so it’s able to ingest, normalize and index massive amounts of telemetry data. It can also correlate it with known threats.
3. Its high storage capacity, where access to years of telemetry can mean the difference between clear answers and simply hoping for the best.

Virus Total

VirusTotal, now part of Google Cloud, provides threat context and reputation data to help analyze suspicious files, URLs, IP addresses, and domains to detect cybersecurity threats. VirusTotal reports show many crowdsourced details about why a domain, attachment, or IP address might be considered dangerous. For more information, see the VirusTotal website.

reCAPTCHA

reCAPTCHA protects your website from fraud and abuse without creating friction. 

It uses an advanced risk analysis engine and adaptive challenges to prevent malicious software from engaging in abusive activities on your website. Meanwhile, legitimate users will be able to log in, make purchases, view pages, or create accounts and fake users will be blocked.

reCAPTCHA can prevent various threats, such as

1. Scraping: Theft of content to divert advertising revenue or competitive use.
2. Fraudulent transactions: Purchase of goods or gift cards with stolen credit cards.
3. Account Takeover (ATO): Credential stuffing to validate stolen accounts.
4. Accounts being misused: Creation of new accounts for promotion value or future misuse.
5. Fake Posts: Posting malicious links or spreading misinformation.
6. Money laundering: Bot that generates revenue from ad clicks on fraudulent websites.

As you can see, there are many ways to better protect your digital assets. But which one should you choose? 

Are you ready to start the journey of making your users’ web experience more secure? Our cybersecurity experts can audit your site to help you pick the best solution for your particular needs. What are you waiting for?!

Get in touch

When migrating your infrastructure to the cloud one of your main concerns might be: is the cloud really secure? And how can I maintain control of all that happens in my cloud infrastructure? 

Google Cloud Platform’s Security Command Center is one solution to help answer those questions. It centralizes the visualization of all your organization’s assets and its possible vulnerabilities or misconfigurations.

To start using the Security Command Center, you must first activate it within your organization using an account that has privileged admin roles. Luckily you can get started using the stand tier free of charge.

Standard Tier

Here are some of the useful features the standard tier offers:

• Security Health Analytics scans Google Cloud assets looking for vulnerabilities and misconfigurations like:
  • MFA being inactive for a certain account (we know how risky this is in a privileged account)
  • It detects members outside the organization with access to resources that are included in a group with permissions.
  • Dangerous open ports in the perimetral firewall.
  • Exposed public log buckets.
• With predefined rules against the most common attacks and the possibility to create custom rules like IP filtering, Cloud Armor acts as a WAF, adding another layer of security to all your deployments. We love and use this feature in all our website deployments. The Security Command Center helps us visualize all the incidents it detects and to adapt our rules accordingly.
• You can detect security anomalies in your VMs like potentially leaked credentials and crypto mining.
• All this information can be exported to BigQuery or your favorite third-party SIEM to be processed

For a more detailed rundown of all the features, you can check the official documentation.

Premium Tier

There are additional features in the Security Command Center premium tier, such as:

• Container Threat Detection​: this service continuously monitors the state of deployed container images. It will alert you if there was an added binary to the image that was not in the original one. It will also alert you about the execution of malicious scripts or reverse shells.
• Using threat intelligence and machine learning, Malware, brute force SSH and outgoing DoS anomalies are added to the Event Threat Detection. It also adds the detection of changes to MFA, SSO, or leaked passwords to the user’s account protection.
• One of the most important features of this tier is the possibility to create compliance dashboards and reports following the most used standards in the industry like CIS, NIST, PCI, or ISO27001. You can view and export these compliance reports to help ensure all your resources are meeting all their compliance requirements.
• If you enable VM Manager, you can detect vulnerabilities in the operating systems installed on virtual machines.
• Create SMS alerts, and emails, or have them sent to your favorite chat application with Pub/Sub notifications.

We use the Security Command Center extensively for its defensive security features like Cloud Armor and its health monitoring of the organization’s users and assets. As we discover more of its features, we are integrating them to make the most of its full potential.

Here we have just detailed some of the capabilities of the Security Command Center, but there are many more that can suit your specific needs.

Are you looking to make your site more secure? Making Science has got you covered! We can perform site audits and provide recommendations about where and how to get started.

Get in touch