Password managers are a solution to somewhat sanely and securely manage this complexity, and not something that the average user wants to think about. Passwords and login credentials are dead.

:) And as mentioned, already exists in many forms. No offense, but this is such a hacker solution. This is a supplier that was named 'Leader' by Forrester and got a $30M funding round last year. So who knows what their SaaS offering was leaking from these containers? I mentioned this to both internal IT architects and the supplier and nobody really seemed to care.

This was when I realized that our supplier didn't roll their own containers, but just used off the shelf stuff they didn't even audit. 'Luckily', our on-prem box didn't have an internet connection, because of the sensitivity of our data. In one of them, I noticed an error because something in the container was trying to phone home with telemetry, to a server that wasn't owned by our supplier.

So I used docker to get command line in the containers and see if I can find some logs there to then get into a log store. There was no option for this (then how did they monitor their SaaS?). While running the application, I was missing a lot of context, since logging was minimal, so I asked the company how to connect a log store to get an overview of all the sub-systems. We pretty much got a copy of the stack of containers and docker-compose file that they used to run their SaaS offering. The product was SaaS by default, but they offered an on-prem version. It was purchased through a tender, where on-prem was a requirement. I Worked with a government organization where I was part of the team on-boarding a new on-prem system. Well, even with private cloud and on-prem these are pretty relevant questions. Ask them to show you the audits they've performed on THEIR supply chain this year. Ask them which open-source libraries their SaaS uses.

Last pass security