DEV Community: Isaeus "Asi" Guiang

New Infostealer: FAKE CAPTCHA and Human Verification (Novel Lumma Malware); Detection, Prevention, and Incident Response.

Isaeus "Asi" Guiang — Tue, 21 Jan 2025 04:36:16 +0000

A deceptive CAPTCHA test that seems harmless but is designed to trick Windows users into installing info-stealing malware.

This week, a friend of mine encountered a seemingly legitimate CAPTCHA Human Verification while browsing the internet. What appeared to be a routine verification was actually a sophisticated mechanism to distribute Lumma malware, a new and dangerous infostealer targeting sensitive data.

This article will delve into the technical details of how the Lumma malware operates, its distribution mechanisms, and the steps users can take to safeguard themselves.

Anatomy of the Attack

Step 1: The Fake CAPTCHA

The attack begins with a fake CAPTCHA prompt designed to trick users into thinking they are verifying their humanity. This social engineering tactic leverages the commonality of CAPTCHAs across the web, ensuring that the prompt does not raise suspicion.

Key Features of the Fake CAPTCHA:

Visual Design: The prompt mimics legitimate CAPTCHA services with a polished design.
Dynamic Behavior: Interaction with the prompt initiates the download of a malicious payload.
Browser-Specific Hooks: The prompt may adapt based on the user’s browser or device to maximize compatibility.

Step 2: Malware Delivery

Once the user interacts with the fake CAPTCHA, they unknowingly download a file masquerading as a harmless application. This file often comes in the form of:

Compressed Archives: ZIP or RAR files containing executables.
Installer Packages: Pretending to be software updates or necessary tools.

Technical Details of the Payload:

File Name Patterns: Commonly uses generic or enticing names like update_tool.exe or captcha_check.exe.
File Type: Executable files that appear benign but are embedded with malicious code.

Step 3: Execution and Data Exfiltration

Upon execution, the Lumma malware begins its primary operation: stealing sensitive information.

Capabilities of Lumma Malware:

Credential Harvesting:

Steals login credentials stored in browsers.
Targets email clients and FTP applications.

Cryptocurrency Theft:

Monitors clipboard activity for wallet addresses.
Replaces wallet addresses with those controlled by the attackers.

System Reconnaissance:

Gathers system information, including IP address and hardware details.

Exfiltration:

Sends the stolen data to remote command-and-control (C2) servers via encrypted channels.

Detection and Mitigation

How to Identify the Threat

Behavioral Indicators:

Unexpected CAPTCHA prompts on unrelated websites.
Unfamiliar downloads triggered after interacting with web elements.

File Analysis:

Use antivirus tools to scan downloaded files, in this case we used Malwarebytes to scan and detect the trojan agents and quarantine the infected file.
Check for anomalous behavior during file execution, according to my friend he experienced an unexpected disruption in network connectivity making him unable to connect to the internet until he restarted his device.

INCIDENT RESPONSE: What to Do When You've Downloaded the Lumma Malware?

If you suspect that you've inadvertently downloaded the Lumma malware, it's crucial to act quickly and methodically to minimize the impact of the attack.

Here's my suggested step-by-step guide on how to proceed:

1. Backup All Important Files to the Cloud
If the malware contains ransomware or other destructive payloads, it may target and encrypt files on your local machine.

Upload important files, such as documents, photos, and other critical data, to a cloud storage service. This will allow you to restore your files later if they are compromised.

2. Change All Passwords on Social Media and Bank Accounts
Since Lumma malware is designed to harvest login credentials, it's critical to change the passwords for your social media, banking, and email accounts, especially if these passwords were saved in your browser.

Use a different (like your smart phone with a sms MFA method), trusted device to change all of your passwords, ensuring that your current device (which may be compromised) cannot intercept these changes. Enable two-factor authentication (2FA) on all accounts where possible to add an extra layer of security.

3. Stay Calm and Composed
Panicking can cloud your judgment and lead to more mistakes. Handling the situation calmly will allow you to follow the necessary steps to contain the infection.

Focus on isolating the compromised device to prevent further spread of the malware. If you are not backing up your important local files, you should disconnect the infected device from the internet and any other devices it may be connected to such as external hard disk drives or flash drives (USB Drives).

Reformat your device (if necessary)

If the malware remains persistent and cannot be removed, it may be necessary to wipe your system and perform a fresh installation of your operating system.

In my suggestion to my friend, I advised him to let me reformat his laptop for added safety and peace of mind.

In the first step, in any events of security breaches always back up essential files (but avoid backing up any files that may be infected), then perform a factory reset or reinstall the operating system to ensure the malware is completely eradicated.

*How to reformat your device? *

Open Settings
Select System
Select Recovery
Select Reset this PC
Choose Remove everything to erase all data
Select Change settings to clean the drive
Turn on the Clean data and Download Windows options
Click Confirm
Click Reset to confirm the reset
Follow the on-screen instructions

Remember to back-up all of your important files before doing this.

Preventive Measures

User Awareness:

Be cautious when encountering CAPTCHAs outside well-known platforms.
Avoid downloading files unless absolutely certain of their source.

Technical Safeguards:

Enable browser extensions to block malicious scripts.
Deploy endpoint protection solutions capable of detecting infostealers.

Network Security:

Monitor network traffic for unusual patterns.
Implement DNS filtering to block known malicious domains.

Regular Updates:

Keep browsers, plugins, and operating systems up to date.

Prevention is better than cure!

It is easier to prevent an attack while it's still outside of our system/environment

The Lumma malware demonstrates how threat actors leverage seemingly benign elements, like CAPTCHA prompts, to execute sophisticated attacks.

By understanding the tactics employed by such threats, users and organizations can strengthen their defenses against them.

Prevention is always better than cure. Staying vigilant and proactive security measures and preparation can significantly reduce the likelihood of falling victim to such attacks. Regularly updating software, practicing safe browsing habits, and using comprehensive security solutions are key to protect your personal data and devices from novel threats.

Stay vigilant and you may share this information to help protect others from falling victim to similar schemes.

Understanding Zero-Trust Architecture (ZTA)

Isaeus "Asi" Guiang — Sat, 07 Dec 2024 14:35:46 +0000

In an era where cyber threats are becoming more sophisticated and pervasive, traditional security models that rely on perimeter defenses are proving insufficient. Enter Zero-Trust Architecture (ZTA) – a transformative approach to cybersecurity that challenges the traditional "trust but verify" model with a new mantra: "never trust, always verify."

What is Zero-Trust Architecture?

Zero-Trust Architecture is a security framework that assumes all users, devices, and network components are untrusted until their legitimacy is explicitly verified. This paradigm is built on the principle of "least privilege," ensuring access is granted only to resources necessary for a specific task. By adopting ZTA, organizations can significantly reduce their attack surface and improve their resilience against breaches.

Core Principles of Zero-Trust Architecture

Verify Explicitly:
Every access request must be authenticated and authorized based on all available data points, such as user identity, device status, and geolocation. Multi-Factor Authentication (MFA) is a cornerstone of this principle.
Least Privilege Access:
Users and devices are granted only the permissions required for their tasks. This minimizes the potential damage of compromised credentials or insider threats.
Assume Breach:
Operate as if the network has already been compromised. By implementing segmentation and continuous monitoring, organizations can contain threats and limit lateral movement.

Key Components of Zero-Trust Architecture

Identity and Access Management (IAM):
Robust IAM systems ensure that only authenticated users and devices can access sensitive resources. Integrating single sign-on (SSO) and MFA enhances security while maintaining usability.
Endpoint Security:
Devices accessing the network must meet specific security standards. This includes ensuring up-to-date software, encryption, and compliance with security policies.
Network Segmentation:
Micro-segmentation creates isolated zones within the network, limiting attackers’ ability to move freely if they gain access.
Continuous Monitoring and Analytics:
By leveraging AI and machine learning, organizations can detect anomalies in real time and respond to potential threats swiftly.
Data Security:
Encryption, tokenization, and strict access controls protect sensitive information both in transit and at rest.

JSON Configuration Example for Zero-Trust Policies

Here is an example JSON configuration for implementing Zero-Trust access policies:

{
  "policies": [
    {
      "id": "policy-001",
      "description": "Verify user identity with MFA",
      "rules": [
        {
          "action": "require_mfa",
          "conditions": {
            "user_role": "employee",
            "location": "remote"
          }
        }
      ]
    },
    {
      "id": "policy-002",
      "description": "Restrict access to sensitive data",
      "rules": [
        {
          "action": "deny_access",
          "conditions": {
            "device_compliance": "non_compliant"
          }
        }
      ]
    }
  ]
}

YAML Configuration Example for Network Segmentation

Below is an example YAML configuration for micro-segmentation in a Zero-Trust framework:

segments:
  - name: "Finance"
    resources:
      - database: "finance-db"
      - application: "payroll"
    access:
      - user_role: "finance_manager"
        actions: ["read", "write"]
      - user_role: "employee"
        actions: ["read"]

  - name: "Engineering"
    resources:
      - database: "engineering-db"
      - application: "source_control"
    access:
      - user_role: "engineer"
        actions: ["read", "write"]
      - user_role: "intern"
        actions: ["read"]

Implementing Zero-Trust Architecture

Adopting ZTA requires a phased and strategic approach. Here’s a roadmap:

Assess Your Current Environment:
Conduct a thorough audit of your network, devices, and access controls to identify vulnerabilities.
Define Policies:
Establish clear access policies based on user roles, device types, and sensitivity of resources.
Deploy Tools and Technologies:
Invest in solutions that align with ZTA principles, such as IAM platforms, endpoint detection and response (EDR) systems, and network segmentation tools.
Monitor and Adapt:
Continuously monitor network traffic, user behavior, and device compliance to adapt to evolving threats.
Educate and Train:
Ensure that employees and stakeholders understand ZTA principles and their role in maintaining security.

Benefits of Zero-Trust Architecture

Enhanced Security: By eliminating implicit trust, ZTA reduces the risk of unauthorized access and data breaches.
Regulatory Compliance: Many data protection regulations, such as GDPR and CCPA, align with ZTA principles.
Improved Visibility: Continuous monitoring provides real-time insights into network activity and potential threats.
Resilience to Modern Threats: ZTA effectively counters advanced persistent threats (APTs), ransomware, and insider attacks.

Challenges and Considerations

While ZTA offers significant advantages, implementing it is not without challenges:

Complexity: Transitioning to ZTA involves reconfiguring legacy systems and processes.
Cost: The initial investment in new tools and training can be substantial.
Cultural Resistance: Organizations must address resistance to change among employees and stakeholders.

As organizations continue to embrace digital transformation, the adoption of Zero-Trust Architecture is expected to accelerate. Cloud computing, remote work, and the Internet of Things (IoT) highlight the need for a robust and adaptive security framework like ZTA. Emerging technologies such as Secure Access Service Edge (SASE) and AI-driven threat intelligence will further enhance ZTA’s capabilities.

Embrace!

Zero-Trust Architecture represents a critical evolution in cybersecurity. By shifting away from implicit trust and implementing granular access controls, organizations can proactively address the dynamic and sophisticated threat landscape. While the journey to ZTA may be challenging, the long-term benefits in terms of security, compliance, and operational efficiency make it a worthwhile investment.

Automating Infrastructure Deployment for CI/CD Pipelines Using Terraform

Isaeus "Asi" Guiang — Tue, 03 Dec 2024 14:52:45 +0000

Modern software development heavily relies on continuous integration and continuous delivery (CI/CD) pipelines to streamline deployments. Infrastructure as Code (IaC) tools like Terraform play a critical role in automating the provisioning and management of infrastructure resources for these pipelines. In this blog, we will explore how Terraform simplifies infrastructure deployment for CI/CD pipelines, guide you through setting up Terraform, and demonstrate a simple implementation example.

Why Automate Infrastructure Deployment in CI/CD?

Automating infrastructure provisioning as part of CI/CD pipelines ensures:

Consistency: Resources are created and managed in a repeatable manner.
Efficiency: Reduces manual effort and speeds up pipeline execution.
Scalability: Easily scales infrastructure as application demands grow.
Version Control: Enables tracking and rollback of infrastructure changes.
Cost Optimization: Automates resource cleanup post-deployment or testing.

Setting Up Terraform

To use Terraform in your CI/CD workflows, you must first set up the tool on your local machine or pipeline environment. Follow these steps:

Step 1: Install Terraform

Download Terraform:

Visit the official Terraform website and download the appropriate binary for your operating system.
Install Terraform:
- Linux/macOS: Extract the binary and move it to a directory in your PATH. For example:
```
 unzip terraform_<version>_linux_amd64.zip
 sudo mv terraform /usr/local/bin/
```

Windows: Extract the binary and add the directory to your system's PATH.

Verify Installation: Run the following command to confirm Terraform is installed:

   terraform --version

Step 2: Configure a Cloud Provider

Terraform needs credentials to interact with cloud providers. For example, if using AWS:

Install AWS CLI:

Follow the AWS CLI installation guide.
Set Up AWS Credentials:

Run the following command and provide your AWS access key and secret key:

   aws configure

Verify Access: Confirm that the credentials are working by running:

   aws s3 ls

Step 3: Initialize a Terraform Project

Create a Project Directory: Organize your Terraform configurations in a dedicated directory:

   mkdir terraform-project
   cd terraform-project

Write a Configuration File:

Create a main.tf file to define the resources (an example is provided later).
Initialize Terraform:

Run the following command to download provider plugins and prepare the working directory:

   terraform init

Sample Use Case: Deploying Infrastructure for a Web Application

Imagine a simple scenario where a CI/CD pipeline needs to provision:

A virtual machine for running the application.
A load balancer to manage traffic.
A database instance.

We’ll use Terraform to automate this.

Step 1: Prepare Terraform Configuration Files

`main.tf`

provider "aws" {
  region = "us-east-1"
}

resource "aws_instance" "app_server" {
  ami           = "ami-0c02fb55956c7d316" # Example AMI ID
  instance_type = "t2.micro"
  tags = {
    Name = "AppServer"
  }
}

resource "aws_elb" "app_lb" {
  name               = "app-lb"
  availability_zones = ["us-east-1a", "us-east-1b"]

  listener {
    instance_port     = 80
    instance_protocol = "HTTP"
    lb_port           = 80
    lb_protocol       = "HTTP"
  }

  health_check {
    target              = "HTTP:80/"
    interval            = 30
    timeout             = 5
    healthy_threshold   = 2
    unhealthy_threshold = 2
  }

  instances = [aws_instance.app_server.id]
}

resource "aws_db_instance" "app_db" {
  identifier            = "app-db"
  engine                = "mysql"
  instance_class        = "db.t2.micro"
  allocated_storage     = 20
  name                  = "appdb"
  username              = "admin"
  password              = "password"
  publicly_accessible   = true
  skip_final_snapshot   = true
}

Step 2: Integrate Terraform with a CI/CD Pipeline

Most CI/CD tools (e.g., GitHub Actions, Jenkins, GitLab CI/CD) support Terraform. Here’s how to integrate Terraform with GitHub Actions.

GitHub Actions Workflow File: `.github/workflows/terraform.yml`

name: Terraform Deployment

on:
  push:
    branches:
      - main

jobs:
  terraform:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout Code
        uses: actions/checkout@v3

      - name: Setup Terraform
        uses: hashicorp/setup-terraform@v2
        with:
          terraform_version: 1.5.0

      - name: Terraform Init
        run: terraform init

      - name: Terraform Plan
        run: terraform plan

      - name: Terraform Apply
        run: terraform apply -auto-approve

Step 3: Execute the Pipeline

Push your Terraform configurations and GitHub Actions workflow to your repository.
Upon pushing changes to the main branch, the GitHub Actions pipeline will:
- Initialize Terraform.
- Generate and display the execution plan.
- Apply the configurations to provision resources.

Key Considerations for CI/CD Automation

State Management: Use remote backends (e.g., AWS S3) to store Terraform state securely and enable collaboration.
Secrets Handling: Manage sensitive data (e.g., database credentials) securely using tools like AWS Secrets Manager or HashiCorp Vault.
Rollback Strategy: Automate resource cleanup in case of pipeline failures to minimize costs and maintain resource hygiene.
Testing: Incorporate automated testing tools like Terratest to validate infrastructure deployments.

Goodluck!

Setting up and using Terraform in CI/CD pipelines automates infrastructure provisioning, ensuring faster, consistent, and reliable deployments. By defining infrastructure as code, teams can focus on delivering high-quality applications without manual setup overhead.

Terraform’s versatility and wide cloud provider support make it a powerful tool for modern DevOps workflows. Start small by automating one piece of your infrastructure and scale gradually as you refine your pipeline processes.

Have questions or insights about Terraform in CI/CD? Let’s discuss in the comments!

Creating a Simple a Virus using Python

Isaeus "Asi" Guiang — Sat, 30 Nov 2024 17:15:00 +0000

Legal and Ethical Use

This script is provided for educational purposes only and should not be used to harm systems or coerce individuals. Misuse of this code could result in legal consequences.

Imagine this scenario: You’re working late, focused on a critical task, and suddenly, your browsers close, a cryptic pop-up appears on your screen, and a suspicious webpage opens, urging you to make a purchase. Panic sets in as you wonder what just happened.

This script demonstrates how easily such disruptions can be engineered using everyday programming tools. It serves as a cautionary tale, reminding us of the importance of cybersecurity, ethical programming practices, and the responsibility developers hold in safeguarding digital environments.

Through this analysis, we aim to understand the mechanics behind the code, not to encourage harm but to foster awareness of how vulnerabilities can be exploited—and how they can be prevented. As with any powerful tool, programming demands ethical stewardship to harness its potential for good.

Now, let’s examine how this script operates and how its techniques might be repurposed for positive applications in cybersecurity and system management.

This Python script combines system commands, GUI pop-ups, and web interactions to simulate malicious behavior.

You may access the code of the virus on my GitHub repo:
https://github.com/asiguiang/Creating-Simple-Virus/blob/main/SimpleEthicalVirus.py

Overview

This script is an educational example of how Python can be used for potentially malicious purposes, like disrupting system activity, displaying warnings, and opening URLs. It demonstrates methods to:

Interact with system processes.
Create pop-ups with urgent messages.
Open web links automatically.

Dependencies

Python 3.x
Libraries: webbrowser, os, platform, ctypes, tkinter

Functions

Function	Description
`close_other_browsers`	Closes active browser processes based on the operating system.
`show_popup`	Displays a pop-up dialog box with a message using `tkinter`.
`open_website`	Opens a specific URL in the user's default web browser using `webbrowser.open()`.

Platforms Supported

Windows
Linux
macOS (Darwin)

Security Concerns

Disruption: Terminates browser processes, which can result in loss of unsaved data.
Psychological Impact: Displays a fear-inducing pop-up.
Coercion: Opens a webpage that might attempt to scam the user.

Execution Flow

close_other_browsers():
- Detect the operating system.
- Close browser processes.
open_pup_website():
- Open the specified URL.
show_popup():
- Display the threatening message.

Improvements for Educational Value

Replace malicious elements with benign actions to teach functionality safely.
- Example: Use a harmless pop-up message like "System Check Complete."
- Redirect to a safe webpage instead of a suspicious link.
- Demonstrate proper browser process handling for managing application resources.

Code Explanation

Imports:
- webbrowser: Used to open a web page in the default web browser.
- os: Provides a way to interact with the operating system for task and process management.
- platform: Determines the current operating system.
- ctypes: Enables low-level Windows system calls (not explicitly used here but potentially for further malicious behavior).
- tkinter: Creates GUI elements, specifically the pop-up message.

Functions:
- close_other_browsers():
  - Detects the operating system using platform.system().
  - On Windows:
  - Uses taskkill to terminate browsers: Chrome, Firefox, and Edge.
  - On Linux:
  - Uses pkill to terminate browser processes.
  - On macOS (Darwin):
  - Uses pkill to terminate Safari processes.
  - Effect: Disrupts user browsing activity.
- show_popup():
  - Creates a pop-up window using tkinter.
  - Displays a threatening message ("YOU HAVE BEEN HACKED, 36 HOURS LEFT! BUY NOW!") in a dialog box.
- open_pup_website():
  - Opens a provided URL in the default browser using webbrowser.open().
  - URL is a link to a supposed antivirus purchase page.
Main Functionality:
- Executes the functions sequentially:
  1. Closes browser processes.
  2. Opens the specified website.
  3. Shows the threatening pop-up.

Purpose:
- The script simulates ransomware-like behavior by disrupting browsing, coercing a purchase, and presenting an alarming message. It may be designed to force users into purchasing a product or falling victim to a scam.

Disclaimer

The script simulates malicious activity and should only be used in a controlled environment for learning purposes. Any unauthorized use on third-party systems is unethical and potentially illegal.

Isaeus "Asi" Guiang

Regional Captain of AWS Cloud Clubs Philippines and a dedicated student at the Polytechnic University of the Philippines. With a strong passion for cloud computing and cybersecurity, Asi has played pivotal roles as the Former Captain, of AWS Cloud Club - PUP Manila, driving collaboration and innovation in the tech community.

Currently pursuing a Bachelor of Science in Computer Science, Asi has a wealth of experience, including being an AWS re/Start Course Coordinator Intern and a Soft Skills Review Instructor. He teaches practical AWS workshops and is now a Security Risk Assessment and Compliance Intern at Globe, enhancing his expertise in the field.

Currently studying and focusing on Cloud Financial Operations and Security Compliance.

Leadership Fatigue and Burnout

Isaeus "Asi" Guiang — Tue, 19 Nov 2024 00:03:37 +0000

Remember: Leadership isn’t just about driving change—it’s about sustaining it, starting with yourself.

When I started being a student-leader back in high school, I adopted what I called the "Lone-Wolf" Mentality. I made executions solely on my shoulders, and I often struggled to delegate tasks, thinking I could do everything myself.

Years have passed, and through my active involvement in the Amazon Web Services (AWS) User Groups realm and managing AWS Cloud Club Philippines since 2023, I’ve come to realize the toll this mentality has taken on me. This mindset cost me mental, emotional, and physical fatigue, as I constantly pushed myself to meet every expectation without relying on others. The pressure to perform at such a relentless pace began to chip away at my well-being.

I had to unlearn these habits and reframe my approach to leadership. Being part of AWS User Groups has shown me the power of collaboration, trust, and empowering others. Leadership isn’t about carrying the burden alone—it’s about fostering teamwork, building trust, and cultivating a shared sense of responsibility.

The journey hasn’t been easy since I need to re-program my years of system and practice ever since high school, but it’s been transformative. Learning to delegate, trust my team, and focus on contrast and balance has not only made me a better leader but also a healthier person.

In this blog post, I share more about one of the leadership roles I have, the risks of burnout, and how I’ve learned to find balance and sustainability in my leadership style!

Mental Fatigue leads to Leadership Burnouts

Fatigue is the price of Leadership, Mediocrity is the price of never getting tired.

As a Regional Captain in a vibrant and fast-paced community like AWS Cloud Club, I’ve experienced firsthand how leadership demands can push boundaries. Being a Regional Captain is not just a local role—it’s a country-level responsibility. The scope of the position is vast, with the weight of leading an entire region, which often encompasses multiple cities or provinces, or the entire nation. We strive to inspire, innovate, and lead by example—but sometimes, even the most passionate leaders face burnout.

Burnout isn’t a sign of weakness; it’s a reminder that we are human. Leading effectively requires not just dedication but also balance and self-care. Here’s how I manage to avoid burnout while navigating the responsibilities of leadership.

A Day in the Life of a Regional Captain

Being a Regional Captain is both an honor and a challenge. It’s a dynamic role that requires juggling multiple responsibilities while keeping the bigger picture in mind.

Core Responsibilities of a Regional Captain:

Community Building:
- Supporting local AWS Cloud Clubs and their leaders.
- Guiding new captains to set up, grow, and sustain their communities.
Event Management:
- Organizing large-scale events like hackathons, boot camps, and tech summits.
- Coordinating with sponsors, speakers, and volunteers to ensure seamless execution.
Leadership and Mentorship:
- Providing mentorship to students and budding professionals in tech.
- Offering guidance to captains on navigating challenges in their communities.
Partnerships and Collaboration:
- Building relationships with industry partners, educators, and organizations.
- Aligning initiatives with AWS’s broader mission to empower learners globally.
Advocacy:
- Representing the region in global forums.
- Advocating for technological innovation and democratizing access to AWS resources.
Operational Duties:
- Managing budgets, event logistics, and reporting outcomes to AWS leadership.
- Balancing technical involvement with administrative tasks.

This role isn’t a typical 9-to-5—it’s dynamic, evolving, and often unpredictable. From addressing last-minute logistical issues to inspiring teams at events, no two days are the same.

The Challenge of Balancing Responsibilities

With so much on the plate, it’s easy for a Regional Captain(me) to feel overwhelmed. The role demands:

Multi-tasking: Managing projects across different communities.
High adaptability: Responding to unexpected hurdles and shifting priorities.
Constant availability: Being accessible to captains, teams, and partners alike.

But these challenges also bring opportunities to grow as a leader, problem-solver, and mentor.

1. Recognize the Signs of Burnout

Burnout doesn’t happen overnight; it’s a gradual process with warning signs. Look out for:

Chronic fatigue: Feeling exhausted even after resting.
Loss of enthusiasm: A decline in motivation or interest in previously exciting tasks.
Emotional detachment: Feeling disconnected from your team or projects.
Decreased productivity: Struggling to focus or complete tasks efficiently.

Acknowledging these signs early can help you address burnout before it worsens.

2. Set Boundaries

Leadership often involves juggling multiple roles, but it’s essential to draw the line.

Define work hours: Avoid working late into the night unless absolutely necessary. (ALSO A HYPOCRITE ADVICEEEE! LOL, writing this blog at 4 AM, trust me im working on it.)
Learn to say no: Taking on too much dilutes your focus and effectiveness.
Delegate: Empower your team members to take ownership of tasks—they’ll grow, and you’ll gain breathing room.

By setting boundaries, you safeguard your energy for meaningful contributions.

3. Prioritize Self-Care

Leadership starts with taking care of yourself. Build habits that nurture your well-being:

Get enough sleep: Aim for 7-9 hours of quality rest every night.
Exercise regularly: Physical activity boosts energy levels and reduces stress. #FunFact: I Jog!
Practice mindfulness: Techniques like meditation or journaling can help you process emotions and stay grounded.
Eat healthily: Nutrition directly affects energy and mood—avoid skipping meals or relying on caffeine. (this is a hypocrite advice but i am working on this!)

Remember, self-care is not indulgence; it’s maintenance.

4. Cultivate a Support Network

Leadership can feel lonely at times, but it doesn’t have to be.

Connect with peers: Share experiences and challenges with fellow leaders.
Seek mentorship: A mentor can offer valuable advice and perspective.
Lean on your team: Trust your community to provide support and feedback. (i love my team so much)

Having a trusted network ensures you’re not carrying the weight of leadership alone.

5. Celebrate Small Wins

In the rush of achieving big goals, we often overlook the smaller victories.

Recognize individual and team accomplishments.
Reflect on how far you’ve come, even when the journey ahead feels overwhelming.
Use milestones as moments to recharge and reconnect with your “why.”

Celebrating wins—big or small—helps maintain momentum and fosters positivity.

6. Learn to Disconnect

Sometimes, the best way to reconnect with your passion is to step away temporarily.

Schedule downtime: Block off time for hobbies, family, or simply unwinding.
Unplug from tech: Take breaks from emails and notifications to recharge mentally.
Take vacations: A change of scenery can help reset your perspective.

Regular breaks ensure you return to your role refreshed and ready to lead.

7. Focus on Purpose

When burnout looms, reconnect with your purpose.

Why did you take on this leadership role?
How has your work impacted others positively?
What vision keeps you motivated?

Aligning with your core values and goals reignites passion and pushes back against fatigue.

Final Thoughts

As leaders, we often prioritize others over ourselves. But to inspire and guide effectively, we must first ensure our own well-being. By recognizing the signs of burnout, setting boundaries, practicing self-care, and leaning on a support network, you can lead with energy and enthusiasm.

Leadership is a marathon, not a sprint. Pace yourself, embrace the journey, and remember: resilience is not about avoiding stress but learning how to thrive amidst it.

We need to learn how to dance in the midst of the rain, because life is not about waiting for the storm to pass.

Being a Regional Captain position means embracing challenges with a clear purpose. You’re not just managing events or mentoring leaders—you’re shaping the future of tech communities in your region. But to be the best leader for others, you need to prioritize your own well-being.
Burnout isn’t the end of the road; it’s a reminder to recalibrate. By balancing responsibilities with self-care and seeking support when needed, you can lead with energy and enthusiasm while inspiring others to do the same.

Let’s lead sustainably—because our communities deserve leaders who are both passionate and present.

Take care of yourself, so you can take care of your team.

Awesome thanks to my partner in tech and considered my best friend in college for support me and reviewing this blog Mark Achiles Flores Jr!

Finally to my constant mentors who enabled me to do balance in my career and nurtured me in the process: Raphael Justin Jambalos, Raphael Francis Quisumbing, and Joshua Arvin Lat!

About the Author:

Isaeus "Asi" Guiang

Regional Captain of AWS Cloud Clubs Philippines and a dedicated student at the Polytechnic University of the Philippines. With a strong passion for cloud computing and cybersecurity, Asi has played pivotal roles as the Former Captain, of AWS Cloud Club - PUP Manila, driving collaboration and innovation in the tech community.

Currently pursuing a Bachelor of Science in Computer Science, Asi has a wealth of experience, including being an AWS re/Start Course Coordinator Intern and a Soft Skills Review Instructor. He teaches practical AWS workshops and is now a Security Risk Assessment and Compliance Intern at Globe, enhancing his expertise in the field.

Currently studying and focusing on Cloud Financial Operations and Security Compliance.

Introduction to Chaos Engineering and LitmusChaos

Isaeus "Asi" Guiang — Mon, 18 Nov 2024 22:54:11 +0000

“Chaos isn’t a pit. Chaos is a ladder.”

Like winter, you knew this was coming. This signature quotation from Littlefinger in Game of Thrones (later echoed forebodingly by Bran Stark in Season 7) captures the essence of Chaos Engineering. Chaos is not something to fear; instead, it’s an opportunity to ascend, to learn, and to grow stronger.

In the fast-paced world of modern software systems, where complexity often breeds fragility, Chaos Engineering emerges as the ladder to resilience. Instead of avoiding failure, it teaches us to embrace it, understand it, and prepare for it.

This blog explores Chaos Engineering, why it’s essential, and how tools like LitmusChaos make it accessible and effective for teams striving to build robust, reliable systems.

What is Chaos Engineering?

Chaos Engineering is more than just breaking things—it’s about understanding system behavior under stress and ensuring reliability when the unexpected happens. By deliberately injecting failures into a controlled environment, teams can assess whether their systems respond gracefully or crumble under pressure.

Unlike traditional testing, which is often limited to specific conditions, Chaos Engineering focuses on uncovering unknowns, providing a deeper understanding of system interdependencies and failure points.

Core Principles of Chaos Engineering:

Start with a Hypothesis: Define your system's steady state—what does "normal" look like?
Simulate Real-World Conditions: Mimic scenarios like server crashes, DNS outages, or resource exhaustion.
Measure Impact: Collect metrics to determine how your system deviates from the steady state during experiments.
Learn and Improve: Use findings to build more resilient architectures and improve incident response strategies.

The process of Chaos Engineering doesn’t just prepare systems for failures; it builds confidence in your ability to recover from them.

Why is Chaos Engineering Important?

Modern software architectures, powered by microservices, containerization, and cloud computing, have brought unparalleled scalability and flexibility. However, they also introduce complex interdependencies that make predicting system behavior increasingly difficult.

When a single component fails, it can trigger a domino effect of issues across the system. Chaos Engineering addresses this challenge by ensuring:

Proactive Resilience: Identify and mitigate vulnerabilities before they impact users.
Faster Recovery: Develop and validate automated recovery strategies for incidents.
Enhanced Team Preparedness: Empower teams to respond effectively during real-world outages.
Continuous Improvement: Foster a culture of learning and adaptation, critical for modern DevOps teams.

Introducing LitmusChaos

LitmusChaos is a Kubernetes-native Chaos Engineering platform designed to simplify the process of resilience testing for cloud-native systems. As a project under the CNCF (Cloud Native Computing Foundation), LitmusChaos is a powerful tool to test the reliability and robustness of distributed systems.

Why LitmusChaos?

Chaos Engineering tools like LitmusChaos help automate experiments and integrate them into existing workflows, reducing the manual effort involved. Its Kubernetes-first approach ensures seamless compatibility with modern cloud-native applications.

Key Features of LitmusChaos:

Chaos Workflows: Automate complex experiments using predefined workflows or build custom ones for unique scenarios.
ChaosHub: Access a library of curated chaos experiments to simulate a wide range of failure scenarios.
Observability Integration: Monitor the impact of chaos experiments with integrated dashboards, logs, and metrics.
Kubernetes-Native Design: Manage experiments as Kubernetes CRDs, making it easy to integrate with cluster management practices.
Extensibility and Customization: Create and run custom experiments tailored to your application's specific needs.

Common Use Cases:

CPU Stress Tests: Evaluate system performance under extreme CPU load.
Pod Termination: Simulate sudden pod crashes to test service recovery.
Network Chaos: Introduce latency, packet loss, or disconnections to study communication resilience.
Infrastructure Failures: Test the impact of node failures or cloud service outages.

Getting Started with LitmusChaos

1. Installation

LitmusChaos can be deployed on a Kubernetes cluster using Helm or YAML manifests. The tool includes a user-friendly Litmus Portal to manage and monitor chaos experiments.

2. Setting Up Chaos Experiments

Access ChaosHub: Explore existing experiments in ChaosHub or define custom scenarios.
Target Specific Resources: Configure experiments to test workloads, nodes, or services in your cluster.

3. Execution and Observability

Run experiments through the LitmusChaos UI or CLI.
Monitor system health and experiment impact using Prometheus, Grafana, or integrated observability tools.

4. Learning from Results

Use experiment data to identify weaknesses and apply necessary fixes, ensuring stronger system performance and resilience in the future.

Benefits of Using LitmusChaos

LitmusChaos is more than just a testing tool—it’s a resilience enabler:

CI/CD Integration: Run chaos experiments alongside automated testing pipelines to catch vulnerabilities earlier.
Cost-Effective: As an open-source tool, LitmusChaos minimizes the financial barrier to adopting Chaos Engineering practices.
Community-Driven Development: Contributions from a thriving open-source community ensure rapid evolution and feature development.
Built for Kubernetes: Designed to scale with modern cloud-native architectures, from small setups to large, complex clusters.

Conclusion

In a world where reliability is paramount, Chaos Engineering offers a powerful way to uncover hidden vulnerabilities and build confidence in your system’s resilience. LitmusChaos, with its open-source foundation and Kubernetes-native design, provides the perfect starting point for organizations looking to adopt this practice.

Remember: Chaos isn’t the enemy—it’s an opportunity. It’s a ladder to better systems, stronger architectures, and more reliable applications. So, take the first step. Start experimenting with LitmusChaos today, and ensure your systems can withstand even the harshest conditions.

Ready to elevate your reliability game? Explore LitmusChaos and join the global community of chaos engineers leading the way to resilience.

About the Author:
Isaeus "Asi" Guiang

Regional Captain of AWS Cloud Clubs Philippines and a dedicated student at the Polytechnic University of the Philippines. With a strong passion for cloud computing and cybersecurity, Asi has played pivotal roles as the Former Captain, of AWS Cloud Club - PUP Manila, driving collaboration and innovation in the tech community.
Currently pursuing a Bachelor of Science in Computer Science, Asi has a wealth of experience, including being an AWS re/Start Course Coordinator Intern and a Soft Skills Review Instructor. He teaches practical AWS workshops and is now a Security Risk Assessment and Compliance Intern at Globe, enhancing his expertise in the field.
Currently studying and focusing on Cloud Financial Operations and Security Compliance.

Create a Relational Database Application

Isaeus "Asi" Guiang — Mon, 18 Nov 2024 21:04:06 +0000

About The Project

A Company is implementing a robust RDBMS to streamline its employment application process. Our goal is to efficiently manage applications, track candidate progress, and enhance communication between recruiters and applicants.

About The Project
- Table Of Contents
- Features
- Technologies Used
Database Design
Website Snapshots
Getting Started
- Prerequisites
- Installation
Run
Contributors
License

Features

Authentication System
Log in and log out function
Dashboard
Queries
Applicant CRUD
Application CRUD
Education History CRUD
Employment History CRUD
Reference CRUD
Print Functionality
Search

Technologies Used

We use a number of open source projects to work properly:

React
Node.js
Express
MySQL
bcrypt
jsonwebtoken

Database Design

Database design plays a very important part in the Software Development Life Cycle (SDLC). This part includes creating metadata, normalization, and constructing an Entity-Relationship Diagram (ERD).

To add, provided here is the .sql file of dbKraft (the database used) if you want to have the database ready.

Website Snapshots

Log in page

Home page

CRUD page example

Query page

Query page example

Getting Started

KRAFT is not yet accessible to the world wide web, as it is yet to be deployed. But, if you're interested in seeing the UI and experience the website yourself, you are in the right section of the README. To get started with accessing the source code, follow the steps below.

Prequisites

Ensure that Node.js and npm are installed on your machine.

Installation

You can fork this repository, or you can also clone this repository directly on your local machine.
After cloning the repository on your local machine, access it on any IDE.

After opening the project, you should see all the files
Install dependencies using,
```
npm install
```
Create a .env on the server folder and type the code below. Make sure to replace YOUR_DB_PASSWORD_HERE with your actual MariaDB/MySQL/Any RDBMS password.
```
DATABASE_PASSWORD="YOUR_DB_PASSWORD_HERE"
```
Configure the database connection in server/config/db.js as per your MariaDB/MySQL/Any RDBMS database environment.
To install the required dependencies for the client folder, see the package.json for the client-side.
To install the required dependencies for the server folder, see the package.json for the server-side.

Run

Run the server on /server.
```
node server.js
```
With nodemon, you can run the server using,
```
npm run server
```
Run the client on /client.
```
npm start
```

Contributor's Table

Name	Avatar	GitHub	Contributions
Regina Bonifacio		Feiryrej	Fullstack Developer
Isaeus Guiang		asiguiang	Database Administrator, Technical Writer

Checkout My Colleague's Repository:
https://github.com/feiryrej/KRAFTCompany

License

Distributed under the MIT License. See LICENSE for more information.

AWS Cloud Club Captain - Do you have what it takes to be the next SUPER student-leader?

Isaeus "Asi" Guiang — Mon, 18 Nov 2024 18:42:43 +0000

What is a Student Leader?

A student leader is not merely someone who takes charge of projects or initiatives within their academic setting. It’s someone who inspires, innovates, and leads with purpose. Today’s student leaders are evolving, taking on roles that bridge academia, technology, and real-world challenges. They represent the voice of their peers, lead impactful initiatives, and pave the way for future leaders to follow in their footsteps.

AWS Cloud Club: Two Models, Regional and University

AWS Cloud Club empowers students to bring cloud computing closer to their peers. It operates under two primary models:

University Model – Tailored for a specific campus, University Cloud Clubs focus on creating localized impact. They organize events, workshops, and hands-on training for students within their school.
Regional Model – Regional Captains coordinate activities across multiple universities, amplifying their reach and connecting communities at a broader scale. They tackle higher-level initiatives, engage with AWS professionals, and promote cloud advocacy on a national or regional stage.

AWS Captains

What is an AWS Captain?

An AWS Captain is the face and voice of AWS Academic Advocacy within their community. Captains are the ones leading AWS Cloud Clubs, simplifying complex cloud concepts, and building bridges between students and industry professionals.

Types of Captains:

University Captains: Operate on campus to lead their university-specific Cloud Clubs.
Regional Captains: Guide multiple university clubs, spearhead country-wide initiatives, and represent the region in global AWS events.

Badge of a Captain:

The Captain Badge is more than just a symbol; it’s a mark of dedication, skill, and leadership in the world of cloud computing and student advocacy.

Why is Being an AWS Captain a Super Student-Leader Role?

Exceeding Standards and Traditions

Traditionally, student leaders have been tied to roles within university councils or clubs. AWS Captains break the mold, addressing modern tech challenges and creating a legacy that inspires others to explore cloud computing.

Simplifying Cloud Complexities

One common misconception is that you need to be an expert programmer to lead an AWS Club. Not true! Captains focus on making cloud computing concepts accessible, showing students that anyone can excel in this field.

Going Beyond University Curriculum

AWS Captains venture where standard academic frameworks cannot—bridging the gap between theoretical knowledge and real-world applications.

Connecting Industry Professionals and Academia

Captains often serve as liaisons, fostering partnerships between faculty members, students, and professionals in the tech industry.

Enjoying Unparalleled Perks

Free AWS exam certifications.
Premium licenses and subscriptions for learning tools.
Swag boxes delivered to your doorstep! See image below!

Access to a Global Network of Super Student-Leaders

Imagine working with peers from different time zones, collaborating on international projects, and forming lifelong connections—all while representing your university and community.

Watch our discussion here: https://www.facebook.com/AWSCloudClubPhilippines/videos/1152273682734962

Characteristics of an AWS Captain

Mental Strength

Balancing responsibilities, overcoming burnout, and handling high expectations are all part of the journey. True leaders find ways to recharge and persevere.

Academic Responsibility

You don’t need perfect grades to lead, but setting a good example in conduct and dedication is non-negotiable.

Emotional Intelligence

Understanding your peers' struggles and tailoring initiatives to address them is key. Leadership begins with empathy.

Physical Presence

Show up. Whether it’s shaking hands, taking pictures, or giving hugs (with consent!), being present is a superpower in itself.

The AWS Captain Superpower: C5

Charisma Inspire others and focus on providing opportunities for your peers.
Candidness Be real and passionate about your advocacy.
Creativity Think outside the box to address challenges like resource constraints or rigid policies.
Compassion Care deeply about the growth of your community.
Capability Execute projects effectively and make AWS concepts easy for students to grasp.

Scope of Responsibility

In Your School: Meeting the basic expectations of running a club.
In AWS Communities: Collaborating with AWS professionals and user groups.
Country-Level Advocacies: Regional Captains take on initiatives that impact the tech community at a national level.

Serve Hard and Recover Hard

Balance is essential. It’s okay to make mistakes as long as you learn and bounce back stronger. You’re still a student, after all!

Incorporating New Perspectives into the Blog

A thoughtful contribution from a fellow AWS Captain brings valuable insights that align perfectly with the essence of what being an AWS Captain entails. Here are the highlights, woven seamlessly into the original narrative to enhance the impact and depth of the message:

Identifying Failures and Embracing Them

Leadership is not about avoiding failure—it's about recognizing it, learning from it, and turning it into a stepping stone. Impromptu thinking and actions are vital, especially when plans don’t go as expected. A true captain adapts, recalibrates, and continues to lead with confidence.

Create a Visual Map for Your Journey

As a captain, mapping out your goals and milestones can provide clarity and direction. Here’s how to start:

Outline the events you want to organize (consider referring to the AWS Cloud Club Handbook for inspiration).
Set personal goals for leadership growth and technical expertise.
Define community achievements, ensuring both short-term and long-term objectives are meaningful and impactful.
For captains aiming to start a new club: Ensure your plan aligns with AWS's values and resonates with their mission. If it doesn’t, it might be best to refine your vision or reconsider applying.

Promote Inclusion in All Forms

Inclusivity is a cornerstone of effective leadership. Captains should aim to foster an environment that celebrates diversity, both within their teams and the broader community. Examples include:

Hosting minority-centric events, such as women-led speaker panels.
Ensuring that inclusion doesn’t inadvertently lead to bias; strive for a balance that uplifts all voices.

Ask for Help and Offer It Freely

Collaboration is the heart of the AWS Cloud Club program. Never hesitate to seek guidance when you’re overwhelmed, and be equally willing to support your peers. This spirit of mutual growth strengthens the global AWS Captain network.

Events Are Your Voice

Your events are a direct reflection of your leadership. They embody your creativity, resourcefulness, and ability to adapt. To ensure they resonate:

Identify your audience and tailor your approach accordingly.
Be open to learning and evolving as you plan, manage, and execute.
Use your events as a platform to communicate your vision and bring meaningful change.

Clear Communication and Gratitude

Dealing with the overwhelming responsibilities of being a captain requires maintaining clear communication with your team and community. Express gratitude—not just to speakers but also to attendees and everyone who contributes to your initiatives. A simple “thank you” can foster goodwill and motivate your peers.

Impact of an Active Captain

An engaged captain leads by example. Your presence, participation, and proactive approach can inspire others to step up and contribute to your collective goals.

Integrating AWS Leadership Principles

Being an AWS Cloud Captain is not just about understanding the technical side of AWS, it's about embracing leadership principles that extend far beyond the classroom. As a student leader, integrating AWS's leadership principles into your journey can elevate your impact and help you lead with purpose and vision.

1. Customer Obsession

As an AWS Cloud Captain, your primary "customers" are the students and faculty within your community. To be a super student leader, focus on understanding their needs, struggles, and goals. Whether it's through hosting events, answering questions, or providing resources, constantly ask yourself: How can I serve my community better? A customer-obsessed leader is always ready to listen, adapt, and provide value to those they lead.

2. Ownership

Taking ownership means being fully accountable for your actions, decisions, and the outcomes of your initiatives. For AWS Captains, this can mean taking charge of events, workshops, or community-building projects. Don’t wait for someone else to solve the problems—take initiative, step up, and be the leader who leads by example. You are responsible for the success and direction of your university’s AWS Cloud Club, and that responsibility should drive you to deliver the best results.

3. Invent and Simplify

AWS is built on innovation, and as a student leader, you should embrace the same mindset. Look for ways to improve existing processes, simplify complex topics for your peers, and always think outside the box when it comes to problem-solving. For example, you might create a more accessible learning path for newcomers to cloud computing or design an event format that better fits your university’s culture. Remember, simplifying complex cloud concepts for your peers is a powerful skill that shows true leadership.

4. Are Right, A Lot

This principle emphasizes the importance of good judgment, decision-making, and seeking diverse perspectives. As an AWS Captain, your role will often involve making decisions about events, team dynamics, and community engagement. Seek input from your peers and mentors, and make informed decisions that serve the best interests of the community. Being right a lot doesn’t mean being perfect—it means making thoughtful, well-rounded decisions based on knowledge and experience.

5. Learn and Be Curious

"Learn how to learn" is a mindset that aligns perfectly with the AWS leadership principle of learning and curiosity. As an AWS Cloud Captain, you need to continually expand your knowledge of AWS services, leadership techniques, and your peers' needs. Stay curious about the cloud, technology, and how to improve your leadership abilities. This principle will keep you flexible and adaptable, ensuring you never stop growing as a student leader.

6. Hire and Develop the Best

While you might not be hiring employees in your role as a captain, you are certainly developing your peers. The best leaders nurture talent, encourage growth, and help others reach their full potential. Foster a learning environment where everyone can thrive. Recognize potential in your team, mentor new captains, and promote leadership opportunities within your club. This can create a self-sustaining cycle of growth and excellence within your community.

7. Insist on the Highest Standards

Always hold yourself and your community to the highest standards, whether it's in your academic work, the quality of your events, or how you support your peers. The ability to maintain high standards despite obstacles or setbacks is a key trait of a strong AWS leader. Encourage your team to aim for excellence and consistently improve—never settle for “just good enough.” Your leadership will inspire others to do the same.

8. Think Big

The AWS leadership principle of thinking big encourages you to have an ambitious vision for the future. As a captain, think beyond your local university or region. Aim to connect with AWS leaders, build partnerships with other schools, or even contribute to larger AWS initiatives. The world of cloud computing is vast, and your leadership journey should reflect the same ambition and vision. Strive to make a global impact.

9. Bias for Action

Being a super student leader means not only thinking about what needs to be done but also acting decisively. The ability to take action quickly, especially in fast-paced or uncertain situations, is crucial for success as an AWS Captain. Whether it’s organizing an event at the last minute or troubleshooting an issue with AWS resources, make decisions quickly and move forward with confidence.

10. Frugality

Leadership doesn't always require a big budget. In fact, being resourceful and creative with limited resources can often yield the best results. As an AWS Cloud Captain, you’ll need to be frugal with your time, finances, and energy while delivering value to your community. This principle teaches you to prioritize what matters most and make the most of what you have.

11. Earn Trust

Trust is the foundation of strong leadership. As an AWS Cloud Captain, your peers will look to you for guidance and support. By demonstrating honesty, transparency, and integrity, you will earn their trust. Be reliable, follow through on commitments, and ensure that your actions align with the values you uphold as a leader.

12. Dive Deep

As a student leader, it’s essential to dig into the details—whether it's a technical challenge, a team issue, or event logistics. Don’t shy away from deep dives into topics that matter. Understanding the intricacies of AWS services, or thoroughly researching a problem before making decisions, will make you a better leader and a stronger advocate for your community.

13. Have Backbone; Disagree and Commit

There will be times when you may disagree with the direction of a project, team decision, or AWS policy. But as a leader, it’s important to voice your opinion respectfully. Once a decision is made, regardless of your stance, commit to it fully and help move the initiative forward. Your ability to stand firm, make decisions, and commit to them is a hallmark of strong leadership.

14. Deliver Results

Finally, to be a super student leader, you must deliver results. Whether it's executing an event, mentoring a peer, or contributing to a global AWS initiative, it’s crucial that you consistently deliver on your promises. The ability to execute and achieve tangible outcomes is what separates good leaders from great ones.

You need more than just technical expertise—you need to live and lead by the AWS Leadership Principles. By embracing these principles and applying them to your role as an AWS Cloud Captain, you will not only become a more effective leader but also inspire those around you to do the same. Remember, it's not just about building your university community—it’s about creating a lasting, positive impact on the global AWS community.

By incorporating these thoughts, we enrich our collective understanding of the AWS Captain’s journey. These additions emphasize resilience, planning, inclusivity, and the human side of leadership, rounding out the already comprehensive vision for what it means to be a Super Student-Leader.

To all aspiring captains: Map your journey, embrace collaboration, celebrate diversity, and most importantly, lead with purpose. Your legacy begins here.

Perks and Benefits Beyond AWS Academic Advocacy

Networking with industry leaders.
Securing internships and mentorship opportunities.
Building a strong reputation for becoming a future industry leader.

How to Apply as a Captain

Interested? Check the AWS Student Hub for application details and step-by-step guides on starting your own club. I designed a framework for your reference below to have a successful community building! Reach me out on slack or linkedIn if you need more guidance!

Get the full picture + templates here: https://www.canva.com/design/DAGW2jN3lvE/DFznhvUIKm4ynYQM3ubgGA/edit?utm_content=DAGW2jN3lvE&utm_campaign=designshare&utm_medium=link2&utm_source=sharebutton

Succession Planning for AWS Captains

Maintaining the legacy of your club requires thoughtful planning. Ensure you pass the torch to capable hands. This framework I designed is for successful and smooth transfer of power, feel free to readjust this guidance that fits your culture or way of leaderships.

Get the full picture + templates here: https://www.canva.com/design/DAGW2jN3lvE/DFznhvUIKm4ynYQM3ubgGA/edit?utm_content=DAGW2jN3lvE&utm_campaign=designshare&utm_medium=link2&utm_source=sharebutton

To Make a SUPER Student Leader at AWS:

Being an AWS Cloud Captain is not just about technical knowledge—it's about cultivating an environment of leadership, curiosity, and community. Here's how you can truly embody the role:

Know AWS from a Technical Perspective:

A super student leader must understand the core services that make AWS the powerhouse it is. Whether it's compute services like EC2, data storage solutions such as S3, or machine learning tools like SageMaker, each service has a unique purpose in the ecosystem. But it’s not enough to know what these services do—you must also be able to communicate their potential to your peers in a way that's clear and impactful.

This is where the "Learn how to learn" mindset comes into play. It's my favorite quote, and it truly captures the essence of leadership. It encourages curiosity, adaptability, and a growth mindset. You must be constantly learning, not just for yourself, but to teach others and inspire those around you to do the same. Embracing this mentality will allow you to evolve as a leader, even when faced with unfamiliar challenges.

Fostering the Right Environment:

While understanding AWS services is critical, the environment you create as a captain is just as important. The AWS Cloud Club is not just a technical hub; it's a space where leadership is built on principles of collaboration, inclusion, and respect. As a captain, you must guide your team, your university, and your community in a way that reflects these values.

Your leadership journey should not be limited to just your university or local group. Interconnectivity is key. As an AWS Cloud Captain, your influence should extend beyond your immediate community. Whether it’s supporting fellow captains across regions or contributing to global initiatives, your ability to collaborate virtually or on-site adds an exciting dimension to your leadership experience.

Why This Journey is Exciting:

Being a Super Student-Leader at AWS means that you're not just changing your university—you're shaping the future of cloud computing globally. Your journey becomes much more exciting when you realize that your work, ideas, and efforts can impact students and professionals across the world. Helping other regions or countries, whether remotely or in person, provides a fulfilling sense of interconnectedness and global leadership. It’s a continuous exchange of ideas, learning, and growth.

To be a SUPER student leader at AWS, you need to balance both technical expertise and leadership principles. "Learn how to learn" and apply this mindset to foster a collaborative, inclusive, and expansive environment. Strive to connect with and support your peers, not just within your university, but across the globe. This is the journey of leadership at AWS—exciting, dynamic, and full of possibilities.

Closing Remarks

Being an AWS Captain isn’t just about technical knowledge—it’s about inspiring, empowering, and leaving a lasting impact. As you navigate this journey, remember that you’re part of a global movement shaping the future of tech advocacy.

Through our collective efforts, we provided readers with a more comprehensive opinion and a solid basis for understanding student-leadership in the AWS Cloud Club landscape in our tenure. We aim to empower our community with these perspectives and an inspiration to aspiring future captains in the 2025 Cohort.

The author's blog is a comprehensive collaboration and peer reviewed with his outstanding co-captains in the AWS Cloud Club Program. This lineup of collaborators represents the best of the best, bringing together a wealth of knowledge and experience from various backgrounds. Each captain has demonstrated exceptional leadership and mentorship in their respective communities, ensuring that the insights shared in this blog are not only well-informed but also diverse and multifaceted.

You might be interested as well in learning the 7 Leadership Principle of AWS User Group Philippines authored by our very own AWS Community Hero, Mr. Raphael "Rafi" Quisumbing:

https://community.awsug.ph/principles/index.html

About the Author:
Regional Captain Isaeus "Asi" Guiang

Regional Captain of AWS Cloud Clubs Philippines and a dedicated student at the Polytechnic University of the Philippines. With a strong passion for cloud computing and cybersecurity, Asi has played pivotal roles as the Former Captain, of AWS Cloud Club - PUP Manila, driving collaboration and innovation in the tech community.
Currently pursuing a Bachelor of Science in Computer Science, Asi has a wealth of experience, including being an AWS re/Start Course Coordinator Intern and a Soft Skills Review Instructor. He teaches practical AWS workshops and is now a Security Risk Assessment and Compliance Intern at Globe, enhancing his expertise in the field.
Currently studying and focusing on Cloud Financial Operations and Security Compliance.

                           **Collaborators**

Regional Captain Nikolaos Douranos

Regional Captain and Founder of AWS Cloud Club Greece

Nikolaos Douranos is deeply passionate about the Computer Science industry. He is currently pursuing a dual degree in Computer Science at The University of Manchester and Management Science and Technology at Athens University of Economics and Business. Having moved to the United Kingdom five years ago, he earned an exceptional academic record and graduated from Cox Green School, achieving the second-highest score in A-Level exams. With excellent communication skills, Nikolaos excels in conveying complex ideas to diverse audiences. He recently completed a highly successful internship at Amazon Web Services (AWS) in Madrid, enhancing his skills in cloud computing and AI technologies. This year, he gained further practical experience at IBM in cutting-edge technologies and is currently pursuing his second internship at AWS in Madrid as a Solutions Architect.

Captain Alex Even

Captain of AWS Cloud Club London

Alex Even is a finance and machine learning undergraduate at Bayes Business School with a proven track record in global organizations like Amazon, Greystar, and Swiss Re across EMEA and APAC. In these roles, he’s led financial data analysis, cloud solutions, and business insights, driving measurable impact. As the founder of the City Innovation Hub, he built a community of 500+ members, bridging the tech skills gap for University of London students. Alex is also 1 of only 3 AWS Cloud Captains in London, spearheading cloud initiatives/ events and fostering further innovation at City, University of London.

Regional Captain Rukhsar Bakhtaj

Captain of AWS Cloud Club Pakistan

Rukhsar Bakhtaj, known as "Rukhsar AI," is shaping the future of tech in Pakistan. As a 2023 Google Generation Scholar, she leads from the front—founding AWS Cloud Club Pakistan and AWS Cloud Club AWKUM, creating spaces where innovation succeeds. A founder & former president of the Technology and Innovation Society at AWKUM, Rukhsar is all about empowering others, from coaching in AWS's New Voices Program to organizing tech events at scale. Her work in AI, cloud computing, and community-building speaks for itself.

Captain Rashi Dashore

Captain of AWS Cloud Club International Institute of Professional Studies

Rashi Dashore serves as a Centralised Placement Cell Coordinator at Devi Ahilya Vishwavidyalaya (DAVV), where she manages student data, collaborates with HR professionals, and organizes on-campus placement drives. Through her dedication, Rashi has successfully facilitated numerous recruitment events, helping many students achieve their career aspirations. Her role also involves gaining valuable experience in project development and strategic planning.
Currently pursuing a Master of Computer Applications (MCA) degree, Rashi holds a Bachelor of Computer Applications from the International Institute of Professional Studies (IIPS), DAVV, Indore. Her technical skills include proficiency in Java, Spring Frameworks, MySQL, Python, and AWS. She has also completed several certifications and virtual experience programs, such as the Wells Fargo Software Engineering Virtual Experience Program and the SQL Skill Verification by HackerRank.
Rashi is deeply passionate about problem-solving, programming, reading, and lifelong learning. Her proactive approach to self-improvement highlights her commitment to personal and professional growth.

Regional Captain Upendra Prasad Neupane

Regional Captain of AWS Cloud Club Nepal

A Computer Engineer specializing in DevOps and Cloud technologies. Known for being an excellent team player with strong leadership abilities, I am dedicated to continuous learning and professional growth. Passionate about communication, I enjoy sharing knowledge with others and building connections within the community. I actively contribute to community-building efforts, engaging with like-minded professionals to exchange insights and ideas.

Captain Dulari Bhushan

Captain of AWS Cloud Club CHARUSAT

A driven leader and enthusiast in AI/ML, currently serving as the Club Captain for AWS Cloud Club at CHARUSAT. Dulari has gained hands-on experience in AI research, particularly in explainable AI for emotion detection models, during an internship at CHARUSAT. Additionally, they have a background in firmware development through an internship at VOLANSYS and have demonstrated leadership skills as the Business Development Team Lead at AIESEC in India. Dulari is passionate about tech innovation and team development.

Captain Mohammed Bangie

Captain of AWS Cloud Club University of Witwatersrand

Mohammed Bangie is the founder of the first AWS Cloud Club in Southern Africa and a 2x AWS Certified professional. As a Software Development Engineer (SDE) Intern at AWS, his mission is to make cloud technologies accessible to students and aspiring professionals.

With experience leading cloud initiatives at the University of the Witwatersrand and mentoring on AWS and Azure certifications, Mohammed has presented at Africa's largest AWS Summit. He has practical expertise in AWS services, particularly Networking, IAM, and Security, and is preparing for additional certifications in Solutions Architect, Machine Learning, and Developer.

Mohammed is passionate about educating, inspiring, and connecting people in tech, sharing insights through his blog and workshops. He is committed to customer obsession, delivering high-quality content and solutions to the tech community.

REFERENCES


header Image source: 
_https://funderstanding.com/wp-content/uploads/2024/01/a_digital_art_piece_of_science_and_technology_in_a_c_a2de2481-dcde-4a88-8164-4e5cd1249035.png_

Simple Number Guessing Game in Python

Isaeus "Asi" Guiang — Mon, 18 Nov 2024 17:37:43 +0000

Number Guessing Game Overview:

This Python program is a fun and engaging Number Guessing Game where the user has five chances to guess a randomly generated number between 1 and 100. Here's a breakdown of how the game works and how the code operates:

How It Works

Welcome Message

When the game starts, the user is greeted with a playful message:

"Hello! This is Isaeus Guiang, and this is a number guessing game. You have 5 chances to guess the number, or... you will die :)."
Random Number Generation

The program generates a random integer between 1 and 100 using random.randint(1, 100). This number will be the target the user must guess.
User Input & Validation
- The user has five attempts to guess the number.
- If the user enters anything other than a valid integer, they are prompted to enter a number again without losing an attempt.
Feedback on Guesses

After each guess, the program provides feedback:
- If the guess is too low, the message is: "Too low! Try again."
- If the guess is too high, the message is: "Too high! Try again."
- If the guess is correct, the program congratulates the user and exits the game.
Game Over
- If the user runs out of attempts without guessing the number, the program reveals the correct number with the message: > *"Oops, sorry, the number was [number]. You are going to die :)."

Features of the Code

Random Number Generation

The game uses random.randint(1, 100) to create an unpredictable number, ensuring a fair and exciting challenge for every playthrough.
Input Validation

The code prevents invalid inputs (like letters or symbols) from counting as attempts, using a try-except block to handle errors gracefully.
Attempts Tracking

The guess_counter variable keeps track of how many guesses the user has made, ensuring the user gets exactly five chances.
Dynamic Feedback

The game provides helpful hints after each incorrect guess, guiding the player toward the correct number.
Humorous Twist

The playful messaging adds a fun, lighthearted tone to the game, making it more entertaining.

Sample Gameplay

Start of the Game:

   Hello! This is Isaeus Guiang, and this is a number guessing game. 
   You have 5 chances to guess the number, or...
   you will die :).

User Makes Guesses:

   Attempt 1/5 - Your Guess :) -> 50
   Too high! Try again.
   Attempt 2/5 - Your Guess :) -> 25
   Too low! Try again.
   Attempt 3/5 - Your Guess :) -> 37
   Too low! Try again.
   Attempt 4/5 - Your Guess :) -> 43
   Too high! Try again.
   Attempt 5/5 - Your Guess :) -> 40
   Oops, sorry, the number was 42. You are going to die :).

Correct Guess (Before 5 Attempts):

   Attempt 3/5 - Your Guess :) -> 42
   The number is 42, and you guessed it right in 3 attempt(s)!

This program is a great way to practice basic Python concepts, including loops, conditionals, user input, and error handling, while also enjoying a fun guessing game!

Feel free to use my code on my GitHub: https://github.com/asiguiang/Simple-python-game-Number-Guessing?tab=readme-ov-file#number-guessing-game-overview

About the Author:

Isaeus "Asi" Guiang

Regional Captain of AWS Cloud Clubs Philippines and a dedicated student at the Polytechnic University of the Philippines. With a strong passion for cloud computing and cybersecurity, Asi has played pivotal roles as the Former Captain, of AWS Cloud Club - PUP Manila, driving collaboration and innovation in the tech community.

Currently pursuing a Bachelor of Science in Computer Science, Asi has a wealth of experience, including being an AWS re/Start Course Coordinator Intern and a Soft Skills Review Instructor. He teaches practical AWS workshops and is now a Security Risk Assessment and Compliance Intern at Globe, enhancing his expertise in the field.

Currently studying and focusing on Cloud Financial Operations and Security Compliance.

DevSecOps?

Isaeus "Asi" Guiang — Mon, 18 Nov 2024 17:28:47 +0000

DevSecOps is not just a role within an organization; it is a holistic practice and culture that promotes collaboration among development, security, and operations teams. This paradigm shift recognizes that security should be an essential consideration throughout the entire software development lifecycle (SDLC), rather than merely an isolated function or a final checkpoint before deployment.

The Necessity of DevSecOps

As organizations accelerate their software delivery through Agile and DevOps methodologies, security often becomes an afterthought, typically addressed only at the end of the development process. This reactive approach can lead to significant vulnerabilities being overlooked until late in the lifecycle, which increases the cost and effort required to rectify security flaws.

Moreover, traditional methods often involve silos among the development, operations, and security teams, which can lead to disjointed efforts to manage security risks. DevSecOps encourages collaboration among these teams, ensuring that security is a shared responsibility rather than solely the domain of a separate security team. This aligns with the modern understanding that security needs should be incorporated from the beginning of the development workflow, facilitating early detection and remediation of vulnerabilities.

DevSecOps is a development practice that integrates security into every stage of the software development lifecycle (SDLC), ensuring that security is a shared responsibility among development, security, and operations teams. This approach evolves traditional software development by embedding security measures into the core processes rather than treating them as an afterthought.

Overview

DevSecOps stands for development, security, and operations, and represents the automation of security practices at each phase of application development—from initial design through to integration, testing, delivery, and deployment. This seamless integration addresses security issues as they arise, enabling teams to fix vulnerabilities more efficiently before deploying software into production. The primary goal of DevSecOps is to build security into the development pipeline, promoting a culture where every team member contributes to maintaining security standards.

Key Components of DevSecOps

The DevSecOps framework encompasses several key components that ensure effective security integration:

Continuous Integration and Continuous Delivery (CI/CD): In this approach, automated tests for security vulnerabilities are integrated into the CI/CD pipeline, allowing for immediate detection of issues during code development.

Automated Security Testing: This includes tools that perform static and dynamic analysis of the code as it is being developed, ensuring compliance with security standards throughout the process.

Threat Modeling: Incorporating threat modeling early helps identify potential vulnerabilities and mitigates them during the planning and development stages.

Collaboration and Communication: Successful DevSecOps requires effective collaboration between development, operations, and security teams to create a shared understanding of security standards and practices.

Benefits of DevSecOps

Implementing DevSecOps leads to numerous advantages for organizations:

Increased Security: By addressing security throughout the development cycle, organizations can reduce the risk of vulnerabilities in their applications.

Faster Time to Market: DevSecOps minimizes bottlenecks by automating security checks, allowing teams to deliver higher quality software at a faster pace.

Cost Efficiency: Identifying and resolving security issues early in the development process is generally cheaper than addressing them post-deployment.

DevSecOps promotes a proactive approach to security in software development, enhancing not only the safety and integrity of applications but also improving the overall efficiency of development teams.

In conclusion, the integration of security into DevOps as a formal practice known as DevSecOps is a vital response to the growing complexity of software applications and the threats they face.

About the Author:
Isaeus "Asi" Guiang

Regional Captain of AWS Cloud Clubs Philippines and a dedicated student at the Polytechnic University of the Philippines. With a strong passion for cloud computing and cybersecurity, Asi has played pivotal roles as the Former Captain, of AWS Cloud Club - PUP Manila, driving collaboration and innovation in the tech community.

Currently pursuing a Bachelor of Science in Computer Science, Asi has a wealth of experience, including being an AWS re/Start Course Coordinator Intern and a Soft Skills Review Instructor. He teaches practical AWS workshops and is now a Security Risk Assessment and Compliance Intern at Globe, enhancing his expertise in the field.

Currently studying and focusing on Cloud Financial Operations and Security Compliance.

DEV Community: Isaeus "Asi" Guiang

New Infostealer: FAKE CAPTCHA and Human Verification (Novel Lumma Malware); Detection, Prevention, and Incident Response.

Anatomy of the Attack

Detection and Mitigation

INCIDENT RESPONSE: What to Do When You've Downloaded the Lumma Malware?

Reformat your device (if necessary)

Preventive Measures

Prevention is better than cure!

Understanding Zero-Trust Architecture (ZTA)

What is Zero-Trust Architecture?

Core Principles of Zero-Trust Architecture

Key Components of Zero-Trust Architecture

JSON Configuration Example for Zero-Trust Policies

YAML Configuration Example for Network Segmentation

Implementing Zero-Trust Architecture

Benefits of Zero-Trust Architecture

Challenges and Considerations

Embrace!

Automating Infrastructure Deployment for CI/CD Pipelines Using Terraform

Why Automate Infrastructure Deployment in CI/CD?

Setting Up Terraform

Step 1: Install Terraform

Step 2: Configure a Cloud Provider

Step 3: Initialize a Terraform Project

Sample Use Case: Deploying Infrastructure for a Web Application

Step 1: Prepare Terraform Configuration Files

main.tf

Step 2: Integrate Terraform with a CI/CD Pipeline

GitHub Actions Workflow File: .github/workflows/terraform.yml

Step 3: Execute the Pipeline

Key Considerations for CI/CD Automation

Goodluck!

Creating a Simple a Virus using Python

Legal and Ethical Use

Overview

Dependencies

Functions

Platforms Supported

Security Concerns

Execution Flow

Improvements for Educational Value

Code Explanation

Disclaimer

Leadership Fatigue and Burnout

Mental Fatigue leads to Leadership Burnouts

A Day in the Life of a Regional Captain

Core Responsibilities of a Regional Captain:

The Challenge of Balancing Responsibilities

1. Recognize the Signs of Burnout

2. Set Boundaries

3. Prioritize Self-Care

4. Cultivate a Support Network

5. Celebrate Small Wins

6. Learn to Disconnect

7. Focus on Purpose

Final Thoughts

Introduction to Chaos Engineering and LitmusChaos

What is Chaos Engineering?

Core Principles of Chaos Engineering:

Why is Chaos Engineering Important?

Introducing LitmusChaos

Why LitmusChaos?

Key Features of LitmusChaos:

Common Use Cases:

Getting Started with LitmusChaos

1. Installation

2. Setting Up Chaos Experiments

3. Execution and Observability

4. Learning from Results

Benefits of Using LitmusChaos

Conclusion

Create a Relational Database Application

About The Project

Table Of Contents

Features

Technologies Used

Database Design

Website Snapshots

Log in page

Home page

`main.tf`

GitHub Actions Workflow File: `.github/workflows/terraform.yml`