• Top 9 Machine Learning Applications

• "yum install selinux; systemctl enable selinux; systemctl state selinux" # Install, enable and verify state
• "grep -i avc /var/log/audit/audit.log | audit2allow --module local > local.te" # Create module for something specific, review the policy, I am looking the web traffic since this is a web server
• "yum install policycoreutils-devel" # Gives users the ability to configure policies from the desktop
• "find / -name "local.te" print0 | xargs -0 -t semodule -i" # looks for local.te and installs it as one of the modules
• "setsebool -P httpd_read_user_content" # Sets the policy permanently to read pages that have been served up by nginx or apache

• SELinux - we need to work with the security teams and DevOps team to secure the application, filesystem, domain, executable/bin and application characteristics

• "setenforce 1; reboot; getenforce; yum install nginx; systemctl start nginx; semanage fcontext -a -R 'httpd_sys_context_t' '/usr/share/nginx/html(/.*)?'; setsebool -P http_read_user_content 1; semanage port -a -t 'http_port_t -p tcp 80,443 (this will limit what the external user has access to)"

• "iptables -I INPUT 1 -p tcp -m multiport --dport 80,443 -m conntrack --ctstate NEW -j ACCEPT"

• "for i in `rpm -qa | grep apache`; rpm -e $i ; done #(remove apache from the system (nginx is installed now)"

• "Docker configuration - yum install docker; systemctl start docker; docker login <enter user from docker hub>; docker pull nginx; docker run -p 8082:80 --name nginx2 -v $PWD:/usr/share/nginx/html/docs --restart unless-stopped nginx # this creates a docker container on your linux machine running nginx latest image or richarvey\nginx-php-fpm # works well using secure https" 

• Firewall - we need to start utilizing NGFW where the FW is able to think and look at the application's heuristics and understand the application. If there is an outside variant (i.e. Ransomware) and it activates encryption tools, the NGFW (onboard or external) needs to put that process in a container or isolate that process where its effects are limited, what can DevOps do to work with the Security teams to create a pre and post scenario when it finds this type of attack (collaborate to resolve this issue)
• ML - Machine Learning is missing from this equation but with the DevOps teams help by using Tensorflow techniques, we can train the ML aspect of the application to look for anomalies and variants (especially those that access ssh/keys over the internet after numerous attempts)

Interesting, I do think it depends on the type of work they are performing. If someone from the security team can review the code to determine if the code meets 'CMMI' coding best practices at the beginning of the Agile scrum development process, then yes I agree but that is dependent on the level of compentency the security team has when it comes to "SecDev" or the "Security Development process.

However, in most cases, security groups don't have coders on the team with a strong background in security, so I do think this aspect of the industry is evolving, by combining these business areas, in the long-run it will benefit the industry.