Fighting supply-chain attacks with better locks

Welcome to Runtime! Today: Edera's CTO explains how a rethink of hypervisor concepts could help companies protect themselves against software supply-chain attacks, Microsoft throws the Israeli intelligence service off its cloud, and the latest enterprise moves.

(Was this email forwarded to you? Sign up here to get Runtime each week.)

Your moment of Xen

The Biden administration tried to get government agencies and industry titans to take the software supply-chain threat seriously during its four-year term, but the current administration has, let's just say, different priorities. That means supply-chain attacks like the NPM/GitHub incident from the past couple of weeks are going to be an ongoing problem for companies to manage over the foreseeable future, which opens an opportunity for startups like Edera to help them rethink how they deploy infrastructure.

"Security is a very reactive thing right now; what we really are trying to do is flip that script and say, if you build your infrastructure properly … then you can prevent that risk upfront," said Alex Zenla, co-founder and CTO of Edera, in a recent interview with Runtime. Now a little over a year old, Edera has raised $20 million to work on building a new type of hypervisor for companies running containers on Kubernetes.

• A super-short history of enterprise infrastructure tech: VMware and Intel popularized hypervisors and virtual machines in the early 2000s, which led to Docker's easy-to-use Linux containers, which begat the Kubernetes container-orchestration platform now in widespread use.
• But the underlying concepts behind hypervisor technology haven't changed much over all that time, according to Zenla.
• Edera's core product is a new version of the open-source Xen hypervisor rewritten in Rust, which adds additional protection against memory-related vulnerabilities.
• It allows customers "to run containers in isolated environments that cannot interfere with each other," Zenla said, which allows companies serving their own customers to separate those customer workloads in a more efficient way.

On Tuesday CISA warned companies and government agencies about the impact of the Shai-Hulud worm, which is spreading through GitHub accounts and NPM packages and exposing login credentials for cloud-provider accounts. GitHub released some guidance for companies that might have been affected and promised to change some of its policies, but Zenla argued that Edera customers would have been able to prevent a self-propagating worm like Shai-Hulud from exfiltrating sensitive data.

• Security and observability tools have gotten much better at detecting incoming attacks, but they tend to overwhelm administrators with alerts that can slow down response times.
• However, "if you have proper isolation, and you have something like Edera, if an attack comes along you can quarantine it much easier," Zenla said.
• The key is what Edera calls a "hardened runtime," which essentially allows customers to "press the big red button and effectively lock everything down and prevent containers from communicating with each other if they've been affected," she said.

Zenla thinks this technology could become even more valuable for companies worried about the security of AI-generated code, as it could allow them to wall-off such code from the rest of their production environment. Right now Edera doesn't use AI coding assistants to build any of its core products because they sit at such a critical level of the infrastructure stack, but obviously its own customers are running all kinds of vibe-coding experiments.

• "We are not AI skeptics in the traditional sense, we're not like, 'no AI-generated code,' but being smart about where you use it is important," Zenla said.
• Just as so many lawyers have confidently filed court briefs full of all kinds of ChatGPT-created nonsense, "the truth of the matter is that AI-generated code is not being reviewed to the degree that people claim it is," she said.

86 8200

Microsoft took the rare step of denying a paying customer access to some of its Azure cloud infrastructure services for violating its terms of service, and we're not talking about just any cloud account. The Israeli military's 8200 intelligence division will no longer be allowed to use Azure's services to monitor "millions of Palestinian civilian phone calls made each day in Gaza and the West Bank," according to The Guardian.

Microsoft confirmed the decision in a blog post written by President Brad Smith, who said "we therefore have informed IMOD [Israeli Ministry of Defense] of Microsoft’s decision to cease and disable specified IMOD subscriptions and their services, including their use of specific cloud storage and AI services and technologies." Last month, in response to earlier reporting by The Guardian, Microsoft said that its "standard terms of service prohibit the use of our technology for mass surveillance of civilians."

This is an extremely tricky needle to thread for any cloud provider; the Big Three make it a point to emphasize that they never "access our customers’ content in this type of investigation," as Microsoft put it Thursday, because acknowledging direct visibility of any kind of into what customers are doing on its platform would destroy years of trust that Big Cloud isn't using your workloads to inform its business decisions. Still, Microsoft figured it out in some fashion, and according to The Guardian's report "intelligence sources said Unit 8200 planned to transfer the data to the Amazon Web Services cloud platform," setting up an interesting decision for Andy Jassy and Matt Garman.

Enterprise moves

Clay Magouyrk and Mike Sicilia are the new co-CEOs of Oracle, replacing Safra Catz, who will become vice chairman of a company that is still basically controlled by co-founder and CTO Larry Ellison.

Praerit Garg is the new CEO of One Identity, joining the cloud security company after serving as president of product and innovation at Smartsheet.

Gareth Maclachlan is the new COO of Gigamon, joining the observability company after serving as chief product and technology officer at Trellix.

The Runtime roundup

Cisco urged customers to patch a zero-day vulnerability in its iOS networking operating system, which as of publish time was being actively exploited across up to 2 million devices running on the internet, according to Ars Technica.

Databricks will spend $100 million to allow its customers to directly access OpenAI's models within its data platform, which the companies think could boost revenue across the board.

Speaking of OpenAI, CoreWeave announced that the frontier model provider now expects to spend an additional $6.5 billion on its computing services, bringing its total commitment to $22.4 billion, according to The Wall Street Journal.

SAP is under investigation by European competition authorities over whether it overcharged customers for support services they didn't necessarily need.

Thanks for reading — see you Saturday!