DEV Community: Durgesh Shukla

Devs watch out - another supply chain attack methodology emerges!

Durgesh Shukla — Wed, 21 Dec 2022 15:56:30 +0000

As a cybersecurity observer, I get amazed (on a daily basis) by the amount of innovation that attackers put behind exploiting the newest attack surfaces. Take the software supply chain for example - there was a malicious "SentinelOne" SDK package uploaded to PyPi python opensource repository.

what

This package pretends to be a legitimate SDK but was actually uploaded to the OSS repo with the intent of stealing data from developers. It has already been downloaded 1000+ times.

(SentinelOne is one of the known names in the cybersecurity space - looks like these attackers are taking inspiration from the phishermen carrying out phishing attacks in the name of Bank of America :P )

how

Here is how this opensource software supply chain attack methodology works:
1) Malicious SDK package with a legit-sounding name gets uploaded to the PyPi open-source repo but on a random IP not belonging to the SentinelOne vendor company.
2) Package has a trojan hidden inside, which besides offering access to SentinelOne API, also secretly captures the data being exchanged by the systems using this malicious package.
3) The systems whose developers download and utilize this package get compromised and then attackers are able to steal any sensitive data exchanged by the compromised system not limited to:
a) K8s/AWS config info
b) host/gitconfig files and credentials within these files
c) Bash / SSH histories

This begs the question, as a security professional or DevOps professional dealing with everchanging attack surface dynamics, how do you plan to deal with your software/infrastructure security in the future?

Lower risk, improve security and increase efficiency with a CWPP

Durgesh Shukla — Thu, 08 Dec 2022 16:10:14 +0000

A CWPP (Cloud Workload Protection Platform) can help you secure containers by providing visibility into their runtime behavior and applying security policies to prevent malicious activity. In addition to protecting cloud-native applications and containers, a CWPP can also help to secure the underlying cloud infrastructure.

When combined with other tools such as continuous integration/continuous delivery (CI/CD) and cloud security posture management (CSPM), a CWPP can help businesses to achieve a complete cloud-native application protection platform (CNAPP). What can these tools get you:

A) Improved security
By continuously monitoring and analyzing the behavior of cloud workloads, a CWPP can identify and alert on potential security threats, helping businesses to proactively defend against attacks. This is particularly important in the current threat landscape, where the use of cloud environments has become increasingly attractive to attackers due to their often-perceived lack of security.

B) Lower risk profile
In addition to improved security, implementing a CWPP can also help businesses to reduce their overall risk profile. By providing visibility into the behavior of cloud workloads, a CWPP can help businesses to identify and remediate potential vulnerabilities before they can be exploited by attackers. This can help to prevent costly data breaches and downtime, reducing the financial impact of security incidents.

c) Increased operational efficiency
Another key benefit of a CWPP is its ability to increase operational efficiency. By automating many of the manual processes involved in securing cloud environments, a CWPP can help businesses to free up valuable resources and focus on more strategic initiatives. This can also help to reduce the time and effort required to respond to security incidents, enabling businesses to quickly and effectively contain and remediate any threats.

A CWPP such as Sysdig Secure offers a comprehensive solution for protecting cloud workloads, enabling businesses to detect and prevent threats in real-time, while also providing visibility over their cloud infrastructure.

5 strategies for vulnerability patching for developers, cloud operators and security engineers

Durgesh Shukla — Thu, 08 Dec 2022 16:06:48 +0000

Vulnerability patching is often the least discussed part of the vulnerability management process, and these are 5️⃣ good strategies that teams can follow to improve patch management:

1️⃣ Prioritizing different vulnerabilities based on their potential impact and the likelihood of being exploited. This allows teams to focus their resources on addressing the most critical vulnerabilities first.

2️⃣ Implementing a "patch early, patch often" approach, where vulnerabilities are patched as soon as patches become available, rather than waiting for a specific time or date.

3️⃣ Conducting regular assessments of the network and systems to identify new vulnerabilities, and then implementing patches to address those vulnerabilities as quickly as possible.

4️⃣ Testing patches before deploying them to ensure that they do not cause any unforeseen problems or disruptions to the system.

5️⃣ Maintaining a detailed inventory of all installed software and systems and regularly checking for updates and patches to ensure that all vulnerabilities are addressed.

How else can teams improve and better protect their systems and networks from potential threats? Comment below. Definitely consider a tool like Sysdig's risk spotlight for prioritizing your container and cloud vulnerabilities and reducing your patching burden.

Value of Certifications to Job Seekers

Durgesh Shukla — Mon, 28 Nov 2022 04:14:45 +0000

In my previous role, I helped define certification prep for Kubernetes/Linux certifications and sell it to multiple market segments - from individuals to enterprise teams. In this post, I take a different direction and summarize the value of certifications with respect to entry-level/mid-senior-level roles for job seekers.

1) Certifications are 101

You have one means you are serious about the role you apply to. Having certifications does not mean you are a master but it "signals" your intent to master certain skills. Some certifications are prerequisites for certain types of jobs.

2) They make for reasonable talking points

Especially when you have fewer stories to tell during interviews. When you are changing job roles or have less number of working years, your journey toward certain certifications makes for a good interview discussion topic.

3) They help you get the "feel" of a role

In many scrum-related certifications, you have the chance to actually take part in mock scrum meetings. Many certifications such as PMP / CISSP will ask you questions that mock up real-world scenarios.

4) They are great career pivot opportunities

Certs can be used as instruments to turn your career in different directions. For example - if you are a developer who has always worked with asp dot net 2.0; and you want to have your next role in cloud technology, it helps to get a couple of Azure certs to familiarize yourself with the new playing ground.

5) One can get certified fairly quickly

Formal education takes time. Building a portfolio takes even longer. Certification prep and exams on the other hand are relatively quick to accomplish.

What Certifications are NOT:

1) Not Inherently valuable

You should also be able to explain the value of your certification. Any certification will only carry as much value as you can attribute to it in your growth story.

2) Not Substitutes for real-world experience

Anyone who claims otherwise to you while selling you certification prep is lying.

3) Not a Guarantee of proficiency

You will not be able to execute your skills with the exact same results in a real-world setting.

4) Not One and done

A certification should be a part of a larger learning strategy. Typically you will need multiple certifications in a single topic to explore it in depth. You will also need multiple combinations of various certifications.

5) Not Cheap

All certifications cost time. Many well-known certifications cost significant money.

3 ways Sundar Pichai inspires me in my professional life - especially due to his accent.

Durgesh Shukla — Mon, 21 Nov 2022 16:37:31 +0000

It took 𝐒𝐮𝐧𝐝𝐚𝐫 𝐏𝐢𝐜𝐡𝐚𝐢 becoming the CEO of Google to make me "own" my 𝐦𝐢𝐱𝐞𝐝-𝐮𝐩 𝐀𝐦𝐞𝐫𝐢𝐜𝐚𝐧𝐢𝐳𝐞𝐝 𝐒𝐨𝐮𝐭𝐡 𝐀𝐬𝐢𝐚𝐧 accent.

Growing up in Mumbai and then working in Bengaluru and Eastern US for a while - my accent evolved considerably. It was always reflective of who I am/was. {Own: To wear clothing, accessories, or physical features with confidence.}

Don't get me wrong, I was always comfortable with how I sounded.

𝐁𝐮𝐭 𝐢𝐧 𝐀𝐮𝐠𝐮𝐬𝐭 𝟐𝟎𝟏𝟓, 𝐒𝐮𝐧𝐝𝐚𝐫 𝐰𝐚𝐥𝐤𝐞𝐝 𝐨𝐧𝐭𝐨 𝐭𝐡𝐞 𝐬𝐭𝐚𝐠𝐞 and in front of the world spoke with an Americanized accent with deep Tamil intonations. He looked like any other techie you will meet in Chennai. Always humble on stage and full of energy while answering any questions.

These public appearances from Sundar pivoted the internal perception of a mixed-up accent in my head: from something I was conscious about to something that I started celebrating.

As I reflect on my professional journey, these are the 3 key changes that Sundar Pichai inspired in me:

𝐚) 𝐁𝐨𝐨𝐬𝐭𝐢𝐧𝐠 𝐜𝐨𝐧𝐟𝐢𝐝𝐞𝐧𝐜𝐞
Despite always being in roles that required active public speaking, I always have had stage fright. However, once the inhibitions about my uniquely sounding accent were out of the way, I could focus on prepping my presentation and script better. This mindset shift was the biggest contributor to my confidence in the last 5 years.

𝐛) 𝐋𝐨𝐬𝐢𝐧𝐠 𝐭𝐡𝐞 𝐚𝐜𝐜𝐞𝐧𝐭 𝐬𝐰𝐢𝐭𝐜𝐡
During my initial few years in the US, I used to switch my accent based on the audience. Now, I do not try to hide my South Asian intonations but neither do I try hard to lose my Americanized pronunciations. If anyone (American, European, South Asian, Middle-Eastern, Chinese etc) does not understand me, I am approachable enough for them to interrupt me and say "Pardon".

𝐜) 𝐌𝐨𝐝𝐞𝐫𝐚𝐭𝐢𝐧𝐠 𝐭𝐡𝐞 𝐬𝐩𝐞𝐞𝐝 𝐨𝐟 𝐜𝐨𝐦𝐦𝐮𝐧𝐢𝐜𝐚𝐭𝐢𝐨𝐧
Especially for webinars, presentations and recorded events - I have paced my speaking. Not only does it make it simple for my listeners but it also gives me the time required to actively think while speaking.

𝐏𝐒:
As I was writing this piece, I was worried about my current or future colleagues not liking these opinions on how accent affects communication OR even doubting my communication skills. But that worry made me want to publish this piece even more. After all, there is only so much that leaders like Sundar can do for us. We have to fight this perception management (internal & external) battle in our style.

Smooth cross-team collaboration is the top thing to do to amplify career growth in this hybrid work era

Durgesh Shukla — Sun, 20 Nov 2022 17:45:21 +0000

Smooth cross-team collaboration is the top thing to do to amplify career growth in this hybrid work era. Eyeing that promotion or applying for a dream role? Go beyond being just a good team player with these ABCDEs:

Appreciation

A simple "thank you Roger" on that slack channel goes a long way in fostering a great cross-team relationship. A direct message to your peers' manager with what/how they helped you will go even further.

Borrow credibility

It is extremely difficult to build relationships and hence - credibility with every stakeholder you work with. Feel free to borrow your teams/manager's/mission's credibility. And then work extremely hard to keep it, and also to expand on it.

Communicate clearly

The focus should be to be clear, not clever when talking to people with whom we do not interact often. Have a framework in mind when you set meetings - a good option is the "Purpose, Process & Payoffs" model. Pay special attention to setting context when messaging / emailing people.

Demonstrate leadership without direct authority

This is the "skill" to develop to rally the peers, the people who do not report to you, and the people within different teams around a common goal.

Empathy

Realizing the fact that every colleague of yours will have different and multiple motivations to achieve goals and will hence pursue each task with a different intensity.

These are the top things that come to my mind when thinking about cross-team collaboration with the amazing colleagues I work with at Sysdig and its partners. What are some things on top of yours?

3 great ways of giving constructive feedback😇 to your colleagues on any deliverable on a zoom call

Durgesh Shukla — Thu, 17 Nov 2022 16:50:11 +0000

Feel the urge to comment on the font/color/image/line-of-code used by your colleague in the morning meeting? HOLD IT 🤐 ! Do these things instead:

🤷🏼The So-What? question 🤷🏼

1️⃣ Ask the "so-what" question for your feedback (to yourself), and also on the item you are commenting on. If the "so-what" does not resonate, feel free to remain silent. Ex - "I don't like this logo image" / "This font is too large" is a terrible way to give feedback. Instead, ask yourself why you feel a certain way and explain your thought process to the recipient.

✍🏿Document feedback✍🏿

2️⃣ Document/write down feedback before vocalizing it. Do set up a follow-up call if needed. Ex - Writing helps you clarify the argument. Otherwise, there is a risk of communicating the opposite of what you actually wanted to say.

📈Trust in numbers, data and facts, not in feelings 📈

3️⃣ Train yourself to give "Data-based" reactions. Ex - If the question is about a certain call to action button's color, wait to see the data indicating what performs better.

With these habits, one can learn to be a better team player and an organizational contributor. What other best practices can one follow to be a better human in the remote/hybrid workplace? Comment below.

Explain this to your grandmother 👵🏻 - 6 tips to master this underrated technique

Durgesh Shukla — Tue, 25 Oct 2022 23:45:47 +0000

A company’s recruiters are the gatekeepers to the rest of your interview process. However, they typically are hiring for multiple roles across the organization and may/may not understand the full specifics of the role and title you are interviewing for.

In such situations the “explain it to your grandma” fr amework can come handy for explaining your core job responsibilities / interesting projects / skills. I have listed a few tips when creating these descriptions/story points about yourself.

Don’t be a jerk

Most of the time, recruiters have a fair idea of what is needed for the role, but have to understand what you can really bring on to the table. The grandma framework is not to “dumb things down” or be “condescending” to recruiters; but rather to have more humanized conversations.

Ex: I used to make it clear when speaking with different recruiters that I am using examples/analogies so that I can easily explain “myself” and not because they are not a technical audience.

Lose the Jargon

Many times people have a tendency to use terms that only the people from their industry understand.

Ex: I used to use terms such as “providers” and “pharmacy benefit managers” when I worked for a product company that created SaaS products for healthcare prescriptions. When I left that job, I used the more widely known terms such as Doctors/Nurses and Prescription Insurance Companies instead.

Spell out the abbreviations

Those handy short words you created for your daily meetings? Make sure you explain them fully when in interviews.

Ex: As a Product Owner I routinely used the MoSCoW method and even have it listed on my resume. But while talking to interviewers, I will always spell it out “Must have, Should have, Could have, Won’t have prioritization framework.”

Give “clear” and “contextual” analogies

People usually try to be clever with their analogies and end up using something that is very specific to the metaphorical situation itself. Instead, stick to using analogies that actually simplify the explanation and clarify the context.

Ex: I love soccer and would make the mistake of using complicated examples from the game to explain my roles. Over the years, I have found it easier to conduct a conversation instead when I stick to common concepts such as “captain” or “coach” that resonate with viewers of any sport.

Explain the basics first

Always build the story from the ground up. The objective here is not to oversimplify what you do - because then it will be counterproductive. Rather the goal is to give more context to the listener.

Ex: If you are a frontend developer creating .net websites; do explain a little bit about languages, programming and machine communication. Then be a bit more specific and explain what you exactly do - talking about the specific skill set.

Sum it up

End every story with an easy to remember story that they can correlate with the bullet points you have on your resume. Tell 2-4 stories around the skill / job role/ project that you want to call out.

Ex: A typical summary I want the recruiting manager to have in their head when they hear about my role building a certain cloud related product is “Durgesh assisted in communicating with the stakeholders, clarifying the requirements and showing the right direction to his teammates while being cognizant of the limits of the technology in use.”

🧑‍💻Value proposition slides for interviews.🧑‍💻

Durgesh Shukla — Tue, 18 Oct 2022 15:18:07 +0000

Here is my deck.

🚀Why create such a deck?
It becomes a visual tool to demonstrate your journey in the interview. Helps show your research, communication and your presentation skills. The deck creation helps you contemplate and visualize your fit for the role.

💥What if the interviewer rejects your request to present a deck?
You should always ask before you start sharing the deck. But if the request gets rejected - you still have mapped out the conversational journey in your own head and would be able to direct the conversation.

🔥What content can you present with such a deck?

✅Personal pitch
✅Career journey in a visual format
✅Contributions at the last role
✅Metrics/numbers do you care about?
✅Orgs you end up working with
✅Stakeholders you work with
✅What do you want to do next?
✅Your working style/process
✅Thought process & problem solving
✅What do you want to do next?

Thanks to SlidesCarnival for the amazing graphics on the slides.

🔥Something Most People Don’t Know About Job Hunting🔥

Durgesh Shukla — Mon, 17 Oct 2022 17:25:40 +0000

A successful "Job Hunt" is a combination of Strategy, Marketing and Sales tasks. The strategy and marketing pieces you can start doing today itself, even if you are 5 years away from your actual job hunt and applications.

🎯Strategy 🎯
In broad strokes -🔎 figure out 🔎what you want (earn/learn/title), what you do well(skills) and what next?
At the end of this exercise you should have a list with the ideal industry, company, job role, pay range, learning aspirations and company culture.
🔁 Iterate 🔁: Do spend 1-4 hrs on this but don't spend more than 4 - at the start of the hunt on strategic thoughts. Idea is to iterate on the strategy as you get feedback from your marketing activities.

🚀Marketing🚀
Many people will say "If only I knew how to sell my skill set better..I could be doing x and y at firm abc." What they actually mean to say is, "If I could Market my skills better.. " The piece you should spend maximum time on (7 days at least) is Branding & Positioning + Messaging & Community for yourself as a candidate.

💥Create a unique personal brand💥: For example, in my last job hunt, it was "Durgesh Shukla, a product manager who is great with ambiguity and understands a broad range of cloud technologies." What is the unique value prop you bring on to the table? Write it down.

👀Be visible👀 on Linkedin / Reddit / GitHub / StackOverflow / Tradeshows / Podcasts / Quora / Youtube / Tableau Dashboards: Create that Resume, personal pitch deck, those tableau dashboards or the GitHub projects you want people to take notice of. Get feedback on these items from different people. You want to be on people's minds. Answer the question "Why you vs 1000 other candidates?" and then create the answers via these forums.

✳️Community✳️: Find the tribe, your network and the stakeholders that connect with you as a professional, and have an idea about the value you bring to the table.

✨Sales✨
And now once you have built the top of the funnel you need to focus on selling “You” the employee/resource.

🗣 Networking and Outreach👥: Talk to recruiters, hiring managers, and your connections about you being in the market.

🔥Apply! Apply! Apply! 🔥: Cannot stress this enough - once you have a resume setup on linkedin/job sites you need to make 10-50 applications daily. You can skip the cover letters, speed is more important. Instead highlight your GitHub/ Open source contributions / personal pitch decks etc.

🔄Follow ups🔄: Create an excel tracker and be in touch with all the recruiters with regards to your active applications. Send follow ups at regular intervals.

Comment and message me to get the following assets that can help in the above steps:
🔆The job hunt funnel checklist to keep on track
🔆A personal pitch deck template
🔆A simple and proven resume template

How to start learning about the 🌟Jungle Gym framework🌟 for a fulfilling career?

Durgesh Shukla — Mon, 17 Oct 2022 17:24:20 +0000

I have compiled a simple 5 point list to help you get started in this post.

(Recap: To create a great career roadmap we need to stop thinking about our career as a ladder. If we instead see our career as a jungle gym, our career path becomes different blocks of interesting core skills to master along the way. But when I first got interested in this topic, I had a hard time figuring out where and how to get started.)

👉🏽So here are some great resources for you to get started.👈🏽

1️⃣ Read this blog by Amy Franko where she explains Pattie Seller's Jungle Gym concepts in detail: https://lnkd.in/g46gTDx4

2️⃣ Watch this short 20 min YouTube Video: Sheryl Sandberg addresses the class of 2012 at Harvard Business School https://lnkd.in/gNtjAxdJ . It is a must-watch beginner resource for anyone interested in this topic. A transcript is available on huffpost - https://lnkd.in/gh-vvrDK.

3️⃣ Check this webinar by Technicaly and Jobber's Sara Cooper: If you are an executive and want to adopt a Jungle Gym framework for your company/people who report to you for improving employee retention - https://lnkd.in/gtAzXmyy

4️⃣ Read This Book: “Lean in” by Sheryl Sandberg will give you a lay of the land, and is a helpful way to get your bearings. If you don't have the time, this blogger has got a summary of the Jungle Gym chapter for you - https://lnkd.in/gjH3WmC3
Also read the explanation of the framework by Dr K - https://lnkd.in/gPkE5m3c

5️⃣ This talk by Heidi Williams of Box: If you really want to start going down the rabbit hole, check out how typical tech-allied career roadmaps can look like when you adopt the jungle gym mindset - https://lnkd.in/gaU6qnNj

Hope these resources help clarify the guiding principles that can turbocharge your career!

𝘼 𝙛𝙪𝙣𝙙𝙖𝙢𝙚𝙣𝙩𝙖𝙡 𝙡𝙚𝙨𝙨𝙤𝙣 𝙩𝙝𝙚𝙮 𝙩𝙚𝙖𝙘𝙝 𝙖𝙩 𝙩𝙝𝙚 𝘿𝙚𝙡𝙤𝙞𝙩𝙩𝙚 𝘾𝙤𝙣𝙨𝙪𝙡𝙩𝙞𝙣𝙜 🟢 𝙤𝙧𝙞𝙚𝙣𝙩𝙖𝙩𝙞𝙤𝙣 𝙩𝙝𝙖𝙩 𝙝𝙖𝙨 𝙨𝙩𝙖𝙮𝙚𝙙 𝙬𝙞𝙩𝙝 𝙢𝙚.

Durgesh Shukla — Thu, 13 Oct 2022 02:54:27 +0000

👉🏽Always tell my story and share my personal value proposition!

Back then my story was something on the lines of "I am Durgesh from the University of Maryland, and have completed a stint in healthcare tech building SaaS products for physicians and patients. I have a keen interest in learning cloud tech. I also ... "

It was neither perfect nor the most elaborate story in the orientation room. But it was "my" story and the process to hone it began right from day one. I personalized it, contextualized it as needed in the conversations and humbly repeated it to every person I met. Many times these people did not fully understand the scope of my abilities - but I narrated anyway.

⚡️⚡️⚡️However, the next time these people heard about healthcare tech or met someone working with cloud, they remembered my story.⚡️⚡️⚡️

Some even looped me in with their connections and helped me network. I found my first client engagement as the manager on that project liked my story. A colleague with a similar story and interests became one of my best friends at the firm and we participated in multiple events together.

Here are 3 reasons why I still* (continuously) try to improve my personal value prop narration:

1️⃣ Telling my story is how I build credibility for my ideas.
2️⃣ This is one of the fastest ways for me to connect with people.
3️⃣ If I do not champion my own professional journey, who will?