Interesting 25 Python Packages

 

Introduction

Python community has evolved so much is the past few decades, today we will see some of the useful packages from PyPI - The Python Package Index. PyPI is the repository of the software for the python programming language.

Packages

1. Art

Module : art

Installation : pip install art

About:

    ASCII art is also known as "computer text art". It involves the smart placement of typed special characters or letters to make a visual shape that is spread over multiple lines of text.

    ART is a Python lib for text converting to ASCII art fancy. 

Sample:

from art import *

print("Coffee", art("coffee")) # return art as str in normal mode

print("")

print("Random", art("random")) # random 1-line art mode

print("")

print("Woman", art("woman",number=2)) # return multiple art as str

print("")

print("Butterfly")

aprint("butterfly") # print art

print("")

print("Happy")

aprint("happy") # print art

print("")

print("Text2Art")

print(text2art("art")) # Return ASCII text (default font) and default chr_ignore=True

Output:

Coffee c[_]

Random :-P

Woman ▓⚗_⚗▓ ▓⚗_⚗▓

Butterfly

Ƹ̵̡Ӝ̵̨̄Ʒ

Happy

ۜ\(סּںסּَ` )/ۜ

Text2Art

_

__ _ _ __ | |_

/ _` || '__|| __|

| (_| || | | |_

\__,_||_| \__|

Reference: https://pypi.org/project/art/

2. Beautiful

Module : BeautifulSoup

Installation : pip install BeautifulSoup

About:

    Beautiful Soup is a library that makes it easy to scrape information from web pages. It sits atop an HTML or XML parser, providing Pythonic idioms for iterating, searching, and modifying the parse tree.

Sample:

import requests

from bs4 import BeautifulSoup

URL = "http://www.values.com/inspirational-quotes"

r = requests.get(URL)

# Note: If this line causes an error, run 'pip install html5lib' or install html5lib

soup = BeautifulSoup(r.content, 'html5lib') 

print(soup.prettify())

Reference: https://pypi.org/project/BeautifulSoup/

3. Bokeh

Module : bokeh

Installation : pip install bokeh

About:

    Bokeh is an interactive visualization library for modern web browsers. It provides elegant, concise construction of versatile graphics, and affords high-performance interactivity over large or streaming datasets. Bokeh can help anyone who would like to quickly and easily make interactive plots, dashboards, and data applications.

Sample:

import numpy as np

from bokeh.plotting import figure, show

N = 500

x = np.linspace(0, 10, N)

y = np.linspace(0, 10, N)

xx, yy = np.meshgrid(x, y)

d = np.sin(xx)*np.cos(yy)

p = figure(tooltips=[("x", "$x"), ("y", "$y"), ("value", "@image")])

p.x_range.range_padding = p.y_range.range_padding = 0

# must give a vector of image data for image parameter

p.image(image=[d], x=0, y=0, dw=10, dh=10,

palette="Spectral11", level="image")

p.grid.grid_line_width = 0.5

show(p)

Output:

Reference: https://pypi.org/project/bokeh/

4. Dis

Module: dis

Installation: pip install dis

About:

    The dis module supports the analysis of CPython bytecode by disassembling it. The CPython bytecode which this module takes as an input is defined in the file Include/opcode.h and used by the compiler and the interpreter.

Source Code:

import dis

def print_hello(string):

print("Hello", string)

# This will display the disassembly of print_hello

dis.dis(print_hello)

Output:

4 0 LOAD_GLOBAL 0 (print)

2 LOAD_CONST 1 ('Hello')

4 LOAD_FAST 0 (string)

6 CALL_FUNCTION 2

8 POP_TOP

10 LOAD_CONST 0 (None)

12 RETURN_VALUE

Reference: https://pypi.org/project/dis/

5. Emoji

Module: emoji

Installation: pip install emoji

About: 

    Emoji for Python. The entire set of Emoji codes as defined by the unicode consortium is supported in addition to a bunch of aliases. By default, only the official list is enabled but doing emoji.emojize(language='alias') enables both the full list and aliases.

Sample:

import emoji

print(emoji.emojize('Python is :thumbs_up:'))

print(emoji.emojize('Python is :thumbsup:', language='alias'))

print(emoji.demojize('Python is 👍'))

print(emoji.emojize("Python is fun :red_heart:"))

print(emoji.emojize("Python is fun :red_heart:", variant="emoji_type"))

print(emoji.is_emoji("👍"))

Output:

Python is 👍

Python is 👍

Python is :thumbs_up:

Python is fun ❤️

Python is fun ❤️

True

Reference: https://pypi.org/project/emoji/

6. Faker

Module: Faker

Installation: pip install Faker

About: 

    Faker package helps to generate fake data, such as name, address, text, colour, date time, currencies, sentences, phone numbers and so on. To ensure that all the generated values are unique for specific funtion, the .unique method is called. Instead, to generate the same value each time, the seed() method is used.

Sample:

from faker import Faker

fake = Faker()

print("Name:", fake.name())

print("Address:", fake.address())

print("Email:", fake.email())

print("Phone Number:", fake.phone_number())

print("Company:", fake.company())

print("Text:", fake.text())

Output:

Name: Amy Odonnell

Address: 2984 Ortiz Stravenue

Lake Cynthia, LA 58335

Email: newtonbradley@gmail.com

Phone Number: (348)704-0954

Company: Weber-Carlson

Text: Response north speak yes five. Marriage under poor actually central. Send meet time great happy him future.

Analysis record half smile real rich. Partner for player social here.

Reference: https://pypi.org/project/Faker

7. Housie

Module : housie

Installation : pip install housie

About:

    As the festive season as begun, we would have lots of guests at home. Let's entertain them python way. Housie provides all the core models and logic required to simulate and play the classic game 'Housie' (also known as 'Bingo' or 'Tambola').

Execution:

python -m housie

Welcome to Housie!

Press 'N' to Host a New Game

Displays board, randomly picks numbers

Press 'T' to Generate Tickets

Generate tickets for Players to use to play the game

Press 'F' to Follow a Game

This mode allows you to follow a game being hosted by someone else, i.e. someone else is calling out the

numbers as you sit and mark your tickets. This mode automates the marking of your tickets and shows a nice

visual display of the board and your tickets. You can also quit and continue the game from where you left off

later. (Game state is persisted)

Before using this mode, enter your ticket(s) into 'data/followed_tickets.json' file in the current directory.

Then start this mode and keep entering the numbers being called out. The status of your ticket(s) are

automatically updated on screen.

(This mode saves files into the 'data' folder in order to store the

state of the housie board. If you want to start a new game, delete the file named 'data/followed_board.json')

Press 'Q' to Quit

Select an option to get started:

Reference: https://pypi.org/project/housie/

8. Mathematical

Module : mathematical

Installation : pip install mathematical

About:

    Includes tools for calculating mean, median and standard deviation of rows in data frames, detection of outliers, and statistical calculations

Sample:

from mathematical.outliers import quartile_outliers

data = [

[1, 2, 3, 4, 5],

[1, 2, 3, 4, 10],

[1, 2, 3, 4, 50],

[1, 2, 3, 4, 100],

[1, 2, 3, 4, 1000],

[1, 2, 3, 50, 1000],

]

for d in data:

outliers, data_exc_outliers = quartile_outliers(d)

print("data: ", d)

print("outliers: ", outliers)

print("data leaving outliers: ", data_exc_outliers)

print("")

Output:

data: [1, 2, 3, 4, 5]

outliers: []

data leaving outliers: [1, 2, 3, 4, 5]

data: [1, 2, 3, 4, 10]

outliers: [10]

data leaving outliers: [1, 2, 3, 4]

data: [1, 2, 3, 4, 50]

outliers: [50]

data leaving outliers: [1, 2, 3, 4]

data: [1, 2, 3, 4, 100]

outliers: [100]

data leaving outliers: [1, 2, 3, 4]

data: [1, 2, 3, 4, 1000]

outliers: [1000]

data leaving outliers: [1, 2, 3, 4]

data: [1, 2, 3, 50, 1000]

outliers: [1000]

data leaving outliers: [1, 2, 3, 50]

Reference: https://pypi.org/project/mathematical/

9. Matplotlib

Module : matplotlib

Installation : pip install matplotlib

About:

    Matplotlib produces publication-quality figures in a variety of hardcopy formats and interactive environments across platforms.

Source Code:

import matplotlib.pyplot as plt

fig, ax = plt.subplots()

fruits = ['apple', 'blueberry', 'cherry', 'orange']

counts = [40, 100, 30, 55]

bar_labels = ['red', 'blue', '_red', 'orange']

bar_colors = ['tab:red', 'tab:blue', 'tab:red', 'tab:orange']

ax.bar(fruits, counts, label=bar_labels, color=bar_colors)

ax.set_ylabel('fruit supply')

ax.set_title('Fruit supply by kind and color')

ax.legend(title='Fruit color')

plt.show()

Output:

Reference: https://pypi.org/project/matplotlib/

10. Moviepy

Module: moviepy

Installation: pip install moviepy

About: 

    MoviePy is a Python module for video editing, which can be used for basic operations (like cuts, concatenations, title insertions), video compositing (a.k.a. non-linear editing), video processing, or to create advanced effects. It can read and write the most common video formats, including GIF.

Sample:

# Blurring all frames of a video

from skimage.filters import gaussian_filter

from moviepy.editor import VideoFileClip

def blur(image):

""" Returns a blurred (radius=2 pixels) version of the image """

return gaussian_filter(image.astype(float), sigma=2)

clip = VideoFileClip("my_video.mp4")

clip_blurred = clip.fl_image(blur)

clip_blurred.write_videofile("blurred_video.mp4")

Reference: https://pypi.org/project/moviepy/

11. NLTK

Module : nltk

Installation : pip install nltk

About:

    Natural Language Toolkit (NLTK) is one of the leading Python platforms for processing language data. It is a set of language processing libraries and programs that provide a toolkit for:

- Classification

- Tokenization

- Stemming

- Tagging

- Parsing

- Semantic reasoning

Sample:

import nltk

sentence = """At eight o'clock on Thursday morning

... Arthur didn't feel very good."""

# Tokenization in NLP is the process by which a large quantity of text is divided into smaller parts called tokens.

tokens = nltk.word_tokenize(sentence)

tokens

['At', 'eight', "o'clock", 'on', 'Thursday', 'morning',

'Arthur', 'did', "n't", 'feel', 'very', 'good', '.']

# POS Tagging in NLTK is a process to mark up the words in text format for a particular part of a speech based on its definition and context.

tagged = nltk.pos_tag(tokens)

tagged[0:6]

[('At', 'IN'), ('eight', 'CD'), ("o'clock", 'JJ'), ('on', 'IN'),

('Thursday', 'NNP'), ('morning', 'NN')]

Reference:

https://pypi.org/project/nltk/

12. Pendulum

Module: pendulum

Installation: pip install pendulum

About: 

    Library to work with dates and times. Handling and manipulating date, different zones, differences requires lots of attention and coding. Well today we have a module which would ease datetimes manipulation.

Sample Source Code:

import pendulum

# Current time in India

now_in_india = pendulum.now('Asia/Kolkata')

print("Current time in India: {}".format(now_in_india))

# Convert time in UTC timezone

print("Converted time in UTC timezone: {}".format(now_in_india.in_timezone('UTC')))

# Easy manipulations for with the dates

tomorrow = pendulum.now().add(days=1)

print("Tomorrow's date: {}".format(tomorrow))

last_week = pendulum.now().subtract(weeks=1)

print("Last Week same day date: {}".format(last_week))

past = pendulum.now().subtract(minutes=2)

print("Two mins's back time: {}".format(past))

print("Two mins's back time human readable: {}".format(past.diff_for_humans()))

delta = past - last_week

delta.hours

print("Time differences: {}".format(delta.hours))

Output:

"""

Current time in India: 2022-12-23T12:09:42.824254+05:30

Converted time in UTC timezone: 2022-12-23T06:39:42.824254+00:00

Tomorrow's date: 2022-12-24T12:09:42.827856+05:30

Last Week same day date: 2022-12-16T12:09:42.827989+05:30

Two mins's back time: 2022-12-23T12:07:42.828059+05:30

Two mins's back time human readable: 2 minutes ago

Time differences: 23

"""

Reference: https://pypi.org/project/pendulum/

13. Pillow

Module : Pillow

Installation : pip install Pillow

About:

    The Python Imaging Library adds image processing capabilities to Python interpreter. This library provides extensive file format support, an efficient internal representation, and fairly powerful image processing capabilities. The core image library is designed for fast access to data stored in a few basic pixel formats. It provides a solid foundation for a general image processing tool.

Source:

from PIL import Image

import PIL

# Location of the image

img = Image.open("image.jpeg")

# Show the image

img.show()

# Size of the image

weight, height = img.size

print(weight, height)

# Format of the image

print(img.format)

# Rotating a image 90 deg counter clockwise

img = img.rotate(90, PIL.Image.NEAREST, expand = 1)

# Flip the original image vertically

img = img.transpose(method=Image.FLIP_TOP_BOTTOM)

# Setting the points for cropped image

left = 4

top = height / 5

right = 154

bottom = 10 * height / 5

# Cropped image of the given dimension

img = img.crop((left, top, right, bottom))

# Resize the image

newsize = (300, 300)

img = img.resize(newsize)

# Show the image

img.show()

Input:

Output:

Reference: https://pypi.org/project/Pillow/

14. PrettyPinter

Module : prettyprinter

Installation : pip install prettyprinter

About:

    Write pretty printers for your standard type list, dict, etc and own types with a dead simple, declarative interface.

Sample:

from datetime import datetime

from prettyprinter import pprint, register_pretty, pretty_call

class MyClass:

def __init__(self, one, two):

self.one = one

self.two = two

@register_pretty(MyClass)

def pretty_myclass(value, ctx):

return pretty_call(ctx, MyClass, one=value.one, two=value.two)

## print the output of the date in pretty format

pprint({'beautiful output': datetime.now()})

## print class object in pretty format

pprint({'beautiful MyClass instance': MyClass((1, 2, 3), {'a': 1, 'b': 2})})

Output:

{

'beautiful output': datetime.datetime(

year=2022,

month=12,

day=23,

hour=12,

minute=29,

second=13,

microsecond=446417

)

}

{

'beautiful MyClass instance': MyClass(

one=(1, 2, 3),

two={'a': 1, 'b': 2}

)

}

Reference: https://pypi.org/project/prettyprinter/

15. Pycurl

Module : pycurl

Installation : pip install pycurl

About:

PycURL is a Python interface to libcurl, the multiprotocol FILE, FTPS, HTTP, HTTPS, IMAP, POP3, SMTP, SCP, SMB, etc. file transfer library. PycURL module can be used to fetch objects with high speed from a URL.

Sample:

import pycurl

from io import BytesIO

b_obj = BytesIO()

crl = pycurl.Curl()

# Set URL value

crl.setopt(crl.URL, 'https://wiki.python.org/moin/BeginnersGuide')

# Write bytes that are utf-8 encoded

crl.setopt(crl.WRITEDATA, b_obj)

# Perform a file transfer

crl.perform()

# End curl session

crl.close()

# Get the content stored in the BytesIO object (in byte characters)

get_body = b_obj.getvalue()

# Decode the bytes stored in get_body to HTML and print the result

print('Output of GET request:\n%s' % get_body.decode('utf8'))

Output:

Output of GET request:

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">

<html>

.. < wiki page content > ..

</html>

Reference: https://pypi.org/project/pycurl/

16. Pygame

Module: pygame

Installation: pip install pygame

About:

    The pygame is a free and open-source cross-platform library for the development of multimedia applications like video games using Python.

Sample:

# Simple pygame program

# Import and initialize the pygame library

import pygame

pygame.init()

# Set up the drawing window

screen = pygame.display.set_mode([500, 500])

# Run until the user asks to quit

running = True

while running:

# Did the user click the window close button?

for event in pygame.event.get():

if event.type == pygame.QUIT:

running = False

# Fill the background with white

screen.fill((255, 255, 255))

# Draw a solid blue circle in the center

pygame.draw.circle(screen, (0, 0, 255), (250, 250), 75)

# Flip the display

pygame.display.flip()

# Done! Time to quit.

pygame.quit()

Output:

Reference: https://pypi.org/project/pygame/

17. Pynguin

Module : pynguin

Installation : pip install pynguin

About:

    Pynguin, the PYthoN General UnIt test geNerator, is a tool that allows developers to generate unit tests automatically.

Sample Source Code:

def triangle(x: int, y: int, z: int) -> str:

if x == y == z:

return "Equilateral triangle"

elif x == y or y == z or x == z:

return "Isosceles triangle"

else:

return "Scalene triangle"

Prerequisite:

    To help prevent harming the system that runs Pynguin, its CLI will immediately abort unless the environment variable PYNGUIN_DANGER_AWARE is set.

% export PYNGUIN_DANGER_AWARE=1  

Execution:

% pynguin --project_path ./ --output-path pynguin_output --module-name pynguin_demo

% cd pynguin_output

pynguin_output % ls -rtl

total 16

-rw-r--r-- 1 dev staff 879 29 May 23:26 test_pynguin_demo.py

-rw-r--r-- 1 dev staff 38 29 May 23:26 test_pynguin_demo_failing.py

Output:

## Below testcase are automatically created by the module

# Automatically generated by Pynguin.

import pynguin_demo as module_0

def test_case_0():

int_0 = -156

int_1 = -5206

str_0 = module_0.triangle(int_1, int_0, int_1)

assert str_0 == 'Isosceles triangle'

str_1 = module_0.triangle(int_0, int_0, int_0)

assert str_1 == 'Equilateral triangle'

def test_case_1():

int_0 = 1038

int_1 = 5772

str_0 = module_0.triangle(int_0, int_1, int_1)

assert str_0 == 'Isosceles triangle'

def test_case_2():

int_0 = -785

int_1 = 3730

int_2 = -1030

str_0 = module_0.triangle(int_1, int_1, int_2)

assert str_0 == 'Isosceles triangle'

str_1 = module_0.triangle(int_0, int_0, int_0)

assert str_1 == 'Equilateral triangle'

def test_case_3():

int_0 = 1910

int_1 = 899

int_2 = None

str_0 = module_0.triangle(int_0, int_1, int_2)

assert str_0 == 'Scalene triangle'

Reference: https://pypi.org/project/pynguin/

18. Pyscreenshot

Module: pyscreenshot

Installation: pip install pyscreenshot

About: 

    Pyscreenshot tries to allow to take screenshots without installing 3rd party libraries. It is cross-platform.

Sample Source Code:

"Grab the whole screen"

import pyscreenshot as ImageGrab

# grab fullscreen

im = ImageGrab.grab()

# save image file

im.save("fullscreen.png")

Execution:

$ python pyscreenshot_sample.py

Output:

# screen shot will be created and saved in the fullscreen.png file

$ ls -lrt fullscreen.png

Reference: https://pypi.org/project/pyscreenshot/

19. Scrape

Module: scrape

Installation: pip install scrape

About: 

    Scrape is a rule-based web crawler and information extraction     tool capable of manipulating and merging new and existing documents. XML Path Language (XPath) and regular expressions are used to define rules for filtering content and web traversal. Output may be converted into text, csv, pdf, and/or HTML formats.

Sample:

from scrape import scrape, utils

def call_scrape(cmd, filetype, num_files=None):

if not isinstance(cmd, list):

cmd = [cmd]

parser = scrape.get_parser()

args = vars(parser.parse_args(cmd))

args["overwrite"] = True # Avoid overwrite prompt

if args["crawl"] or args["crawl_all"]:

args["no_images"] = True # Avoid save image prompt when crawling

args[filetype] = True

if num_files is not None:

args[num_files] = True

return scrape.scrape(args)

call_scrape(["demo.html"], "text")

Input: demo.html

<html><body>

ADMISSION TO ONLINE COLLEGE

<P>

Aplicants are considered for admission to Online College

on the basis of their ISP, quality of their home pages and

quantity of emails exchanged per day.

<P>

It is recommended that students prepare for enrollment in

Online College by signing up for DSL service and

buying a new computer.

<P>

<A HREF="home.html">Back to Online College home page</A> </body>

</HTML>

Execution:

$ python scrape_sample.py

Output: demo.txt

ADMISSION TO ONLINE COLLEGEAplicants are considered for admission to Online College on the basis of their ISP, quality of their home pages and quantity of emails exchanged per day.It is recommended that students prepare for enrollment in Online College by signing up for DSL service and buying a new computer.

Back to Online College home page

Reference: https://pypi.org/project/scrape/

20. Scrapy

Module : Scrapy

Installation : pip install Scrapy

About:

    Scrapy is a fast high-level web crawling and web scraping framework, used to crawl websites and extract structured data from their pages. It can be used for a wide range of purposes, from data mining to monitoring and automated testing.

Sample:

import scrapy

class ToScrapeCSSSpider(scrapy.Spider):

name = "toscrape-css"

start_urls = [

'http://quotes.toscrape.com/',

]

def parse(self, response):

for quote in response.css("div.quote"):

yield {

'text': quote.css("span.text::text").extract_first(),

'author': quote.css("small.author::text").extract_first(),

'tags': quote.css("div.tags > a.tag::text").extract()

}

next_page_url = response.css("li.next > a::attr(href)").extract_first()

if next_page_url is not None:

yield scrapy.Request(response.urljoin(next_page_url))

Execution:

$ scrapy runspider scrape_sample.py -o quotes.json

Reference: https://pypi.org/project/Scrapy/

21. Tamilspellchecker

Module : tamilspellchecker

Installation : pip install tamilspellchecker

About:

    Tamil Spell Checker is used to suggest different spellings for a word. 

Source:

from tamilspellchecker.TamilSpellingAutoCorrect import TamilSpellingAutoCorrect, get_data

from pprint import pprint

from tamil.utf8 import get_letters

spellchecker = TamilSpellingAutoCorrect(get_data("tamil_bloom_filter.txt"), get_data("tamilwordlist.txt"))

###தமிழ்நாடு என்பது சரியான சொல்.

results = spellchecker.tamil_Norvig_correct_spelling("தமிழ்னாடு")

#filter for words >= 4 letters and for words <= 6 letters

results = list(filter(lambda x: len(get_letters(x)) >= 4,results ))

results = list(filter(lambda x: len(get_letters(x)) <= 6,results ))

pprint(results)

Output:

['தமிழ்கு',

'தமிழ்பு',

'தகை்னாடு',

'தமிழ்கொடு',

'தன்னாடு',

'தமிழ்ஏடு',

'தமிழ்நாடு',

'தமிழ்து',

'தமிணனாடு',

'தமிழ்பாடு',

'தமிழ்மு',

'தமிழ்விடு',

'தமினோோடு',

'தமிழ்கு',

'தமிழ்பு',

'தரீ்ஙோடு',

'தமிழ்கொடு',

'தமிழ்ஏடு',

'தமிழ்நாடு',

'தமிழோடு',

'தமிழ்து',

'தமிழ்பாடு',

'தமிழ்மு',

'தமிழ்விடு']

Reference: https://pypi.org/project/tamilspellchecker/

22. Thirukurral

Module : thirukkural

Installation : pip install thirukkural

About:

    A python3 module / command-line tool for Thirukkural.

Execution:

import thirukkural

print(thirukkural())

"""

# Display a random Thirukkural

% thirukkural

பால்: காமத்துப்பால்(3/3) | இயல்: களவியல்(9/10) | அதிகாரம்: தகையணங்குறுத்தல்(109/133)

குறள்-1085:

கூற்றமோ கண்ணோ பிணையோ மடவரல்

நோக்கமிம் மூன்றும் உடைத்து.

kootramoa kaNNoa piNaiyoa madavaral

noakkamim moondrum udaiththu

மு.வ உரை:

எமனோ. கண்ணோ, பெண்மானோ, இந்த இளம் பெண்ணின் பார்வை இந்த மூன்றன்

தன்மையும் உடையதாக இருக்கிறது.

சாலமன் பாப்பையா உரை:

என்னை துன்புறுத்துவது எமனா? என் மேனி எங்கும் படர்வதால் கண்ணா? ஏதோ ஒரு

பயம் தெரிவதால் பெண்மானா? இப்பெண்ணின் பார்வை இம்மூன்று குணங்களையும்

பெற்றிருக்கிறது.

# Display a random Thirukkural in English

% thirukkural -en

Category: Righteousness(1/3) | Sub-Category: Domestic Virtue(2/10) | Chapter: Duty to Society(22/133)

Verse-217:

Unfailing tree that healing balm distils from every part,

Is ample wealth that falls to him of large and noble heart.

Meaning:

If wealth be in the possession of a man who has the great excellence

(of benevolence), it is like a tree which as a medicine is an

infallible cure for disease.

"""

Reference: https://pypi.org/project/thirukkural/

23. Wikipedia

Module : wikipedia

Installation : pip install wikipedia

About:

    Wikipedia is a Python library that makes it easy to access and parse data from Wikipedia.

    Search Wikipedia, get article summaries, get data like links and images from a page, and more. Wikipedia wraps the MediaWiki API so you can focus on using Wikipedia data, not getting it.

Sample:

import wikipedia

print("Wikipedia: ", wikipedia.summary("Wikipedia"))

print("Python: ", wikipedia.search("Python"))

wikipedia.set_lang("fr")

print("Threads: ", wikipedia.summary("Threads", sentences=1))

data = wikipedia.page("India")

print("India Title: ", data.title)

print("India URL: ", data.url)

print("India content: ", data.content)

print("India links: ", data.links[0])

Reference: https://pypi.org/project/wikipedia/

24. Zip Analyzer

Module : zip-analyzer

Installation : pip install zip-analyzer

About:

    A cli script to analyze zip archive.

Execution:

# zipAnalyzer --help

usage: zipAnalyzer FILE [OPTIONS]

A cli script to analyze zip archive.

optional arguments:

-h, --help show this help message and exit

-c, --crack tries to crack the encryption by enumeration over a password list. Extracts the zip archive if the password was found

--passlist PASSLIST Path to custom password list

# zipAnalyzer sample.zip

encrypted: False

File Name Modified Size

zip_analzer_notes.txt 2022-11-14 23:28:32 545

Reference: https://pypi.org/project/zip-analyzer/

25. Zoomlog

Module : zoomlog

Installation : pip install zoomlog

About:

        Simple python logger

Sample:

from zoomlog import Logger, DEBUG, INFO

logger = Logger("test.log", name="test", level=DEBUG)

logger.debug("My logger is work!")

name = "Sergey"

logger.addLevel("NEW USER", INFO)

logger.log("NEW USER", "Created new user - %s" % name)

Output:

10:45:20 25.12.22 DEBUG:test >> My logger is work!

10:45:20 25.12.22 NEW USER:test >> Created new user - Sergey

Reference: https://pypi.org/project/zoomlog/

Conclusion

Today thought to share with you few modules which I came across but a lot more. Sincerely appreciate the developers taken efforts to enrich the community! 

References and Credits

https://pypi.org

Incident Management

 

Introduction

Every organization irrespective how secure they are, there will be incidents occurring either internal or external. Planning for such incidents are vital. We will see life cycle which covers the responsibilities from identification to investigation and to mitigation. 

Incident Response

As a security engineer one might need to face and handle different security issues every day such as malware detection, buffer overflow attack, DDOS attack, data theft, access misuse, disruption, down time, ransom attack and so on.

NIST - National Institute of Security and Technology provides complete security handbook called "NIST Special Publication 800-61 Revision 2" - https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf guidelines to handle the incident response lifecycle.

Incident Response Lifecycle

• Preparation
• Detection and Analysis
• Containment, Eradication and Recovery
• Post Incident Activity 

Incident Response Planning - Preparation

Incident response planning involves in preparation, roles, rules and procedures to tackle incident.

• Documentation
• Communication details and protocols
• Documentation for incident analysis
• Incident mitigation software
• Capture the data, including hardware and software to use later as evidence
• Policies while handling incidents
• Roles and Responsibilities:
• Incident Response Team - IRT, Cyber Incident Response Team - CIRT, SME plans and executes how to handle the intrusion. Trained team to handle the incidents for the entire cycle
• IT security management, precaution and post action measures such as firewalls
• Compliance officers, planning and communication
• Technical staff, helps in resolving 
• Users, awareness and training
• Vendors, awareness and training
• Management, strategies
• Communications team, informing the press or infected parties
• Legal team, decides when the information needs to be shared
• CIO - Chief Information Officer, CISO - Chief Information Security Officer, mission, policies and decision making
• Exercise
• It is important to ensure effectiveness during an event or identify any deficiencies in the process that should be addressed.
• Mock runs without impacting production or any system, rehearsal.
• Functional exercises, run through actual drill as they would perform during actual emergency. 
• Tabletop exercises as full drill would be time consuming and expensive, these would be in smaller simulated disaster version.
• Walk through, discuss and test processes, procedure from the tabletop exercise.
• Simulation, test the simulated event such as phishing attack
• Training, is critical to be given periodically to each teams based on their roles and responsibilities. Hence each roles and responsibilities needs to be clearing defined.
• Jump Kit
• As like first-aid, jump kit is prepared and available for immediate use of an incident.
• Communication
• Contact list needs to be update to date and accessible for everyone.
• Hardware and software for analysis and mitigation
• Secure storage facility
• Forensics workstations
• Portable printer
• Protocol analyzer
• Ancillary analysis resources
• Port lists
• Network diagrams
• Application architecture
• Continuity or Recovery Plans
• Disaster Recovery Plan
• To ensure full recovery of operational capacity following the natural disaster.
• Documentation, planning and periodic tests needs to be done.
• BCP or COOP - Continuity of operations planning
• Ensures the continuity of operations by restorations of an organization functions in the shortest time possible, even if the services resume at reduced level during emergency.
• COOP is similar to BCP but primarily focus on government and public sectors.
• Based on the incident either of the plan could be considered as part of recovery.
• Fundamentals of any disaster recovery plan involves backups.
• Retention Policies
• Backup of copies
• Regulatory compliance
• Operational needs

Attack Frameworks

IRT needs to understand the process of attack, how they are executed, and how to prevent. Having knowledge of these frameworks are crucial.

• Cyber Kill Chain
• Lockheed Martin developed to defend its network based on chain of attacks made by the attacker.
• Cyber kill chain adopts this process in cyber security.
• The cyber kill chain has steps involved the attacker attacks the system from the beginning to end, as a security engineer one needs to break this chain as early as possible.
• Lockheed Martin's cyber kill chain attack from the attacker's perspective in general includes below stages:
• Reconnaissance: Identifying the target
• Weaponization: Preparing for the attack
• Delivery: Launching the attack
• Exploitation: Gaining access from the attack
• Installation: Establishing persistence
• Command and Control: Enabling remote control for further manipulation
• Actions: Achieving the goals
• In order to defend, we need to understand the attacker's actions.
• There are different tools and solutions used at each stage, to break the chain before the attack reaches the goal.
• MITRE ATT&CK
• MITRE ATT&CK - Adversarial Tactics, Techniques and Common Knowledge Framework was created by MITRE Non Profit Organization in 2013 to document attacker tactics and techniques based on real-world observations.
• The document continues to evolve providing the organization's incident response team to understand the attackers behaviour and plan ahead to mitigate these attacks.

Credit: https://anomali.cdn.rackfoundry.net/images/uploads/research/mitre-attck-navigator.png

• Diamond Model of Intrusion Analysis
• Another similar framework to describe cyber attacks.
• There are 4 parts giving a comprehensive view for cyber attacks.
• Adversary
• Details about the attacker, who, why or purpose of the attack
• Infrastructure
• Infected physical or logical systems or data leak details
• Capability
• Develop or deploy using the attack tools or techniques
• Target
• Affected area, data centre or country or region
• The model provides flexible framework to analyze the threat as cognitive (understand interrelated logic) and as well as mathematical(improves strategic).

Credit: https://ars.els-cdn.com/content/image/1-s2.0-S0167404822002024-gr20.jpg

Incident Detection

• Challenge
• It is difficult to identify an incident has occurred as there is huge volume of data and hard to detect legitimate threats.
• Incidents are complex extensive knowledge is needed.
• Precursor
• Sign that an incident might occur in future
• Logs or vulnerability scanners giving the heads up incident
• Network traffic deviate from normal flow
• Unauthorized host configuration change alerts
• Indicators
• Sign of incident has occurred or may be occurring
• Alarms from anti malware or anti virus software
• Alerts from intrusion detection/prevention system
• Exploit announcement
• Direct contact from the attackers reach for ransom
• Isolation and Containment
• Sandboxes, to avoid malware spreading over the network it has brought to isolation run the malware and analyze the results
• Malware are smart at times they run differently or destruct the running system if they are isolated or unable to connect to other systems in network.
• Recovery after Incident
• Removing the malware is important following one of the methods
• Restore from backups
• Rebuild from scratch
• Replace compromised files
• Disable breached user accounts and create new 
• Tighten the system, such as 
• Firewalls
• Enable Multi Factor Authentication
• Certificate changes
• Reconstitution
• Eradication means removing the element of the incident such as malware.
• Recovery is restore systems to normally functional operations.
• Not all the incidents requires eradication, for some only recovery but be good enough, and sometimes bother eradication and recovery needs to work hand in hand.
• Eradication and recovery should be done in phased approach as recovery may take time and it needs to be efficient.
• Documentation
• Lessons learnt from the incident needs to be captured with all the details along with time and to be improved over a period of time.
• Functional impact of the incident, categorization such high impact or low
• Information impact of the incident, type of impact on the information, eg: data leak of PII can be classified as data breach
• Recoverability from the incident
• Post incident analysis documentation for future prevention.

Investigations

Suspected incident or indicators needs to analysed, first step would be to confirm if it is true positive. Different tools and frameworks are available to determine the scope of the incident. IRT will help the team to prioritize potential issue for deeper analysis or to take next action of incident mitigation.

Identify Vulnerability 

In the given system the vulnerability scanner will scan the entire device or application to check if there are any know vulnerabilities. In general these scanners will scan and match the signatures of existing identified vulnerabilities present in the device or it could warn us with the security controls not in place. 

After discovery we can read about the vulnerability and how to resolve this from different sources available in the internet or the vulnerability scanner itself can provide the details. One of the most popular site to refer is National Vulnerability Database at "https://nvd.nist.gov/vuln".

The scan report includes the issues such as malware found, firewall not configured, old version software found, unencrypted telnet server and much more. The report could produce false positives where it has identified a vulnerability but in reality it is not, which we need to be aware of. Sometimes it can have false negatives, the real issue is missed to report. To avoid such scenarios have the scanner up to date along with the signatures.

Credit: https://docs.gitlab.com/ee/user/application_security/vulnerability_report/img/project_level_vulnerability_report_v14_5.png

SIEM - Security Information and Event Management

SIEM is centralized log system, which will consolidate all the information and logs from different source systems such as operating systems, firewalls, routers, web servers, database servers, application servers and so on, to analyze from single reporting tool.

The logs are parsed and stored in common format, as each system would produce different style logs. As the single reporting system these information will converted and also tagged with different category, such as source system could tagged as linux, linux oracle server, and so on. Further each log entries would categorized as information, warnings, errors or urgent.

As these informations are collected over of a period of time it could be used to see the trends and proactively provide alerts or alarms. Additional reports and intelligence could be fed into these systems. SIEM provides interactive dashboards with charts, graphs, trends which can help investigator explore the data through interactive drilldowns.

Credit: https://www.softwaretestinghelp.com/wp-content/qa/uploads/2019/06/Splunk.png

Logging

Security monitoring process involves in creating and analyzing extensive logs and data. Log files will guide us where to look for the related data. Using these files we can gather information root cause information and plan for the solution. Hence while creating log files we  need to be careful as it takes up system resources - too much logs will be bog down the read operation though necessary information should be logged.

Log Files:

• Network logs
• Switch logs
• Router logs
• Firewall logs
• DNS logs
• Operating system logs
• Application logs
• Web application logs
• Database logs
• Audit logs
• System logs
• Call Manager logs
• Bandwidth logs
• Security logs
• Access logs - requests and connections between systems

Log Management:

• Syslogs
• Transferring logs from one device to centralized database usually SIEM is called syslogs in Linux.
• Logs come with different severity levels - debug, information, warning, error or fatal, we can configure to capture based on the level. Log level warning is good for the production and debug for development environment.
• Daemons running syslog are:
• syslog - syslog message includes the facility code and the severity level. A facility code is used to specify the type of system that is logging the message. Messages with different facilities may be handled differently. Eg: 0 - kernel messages, 1 - user messages, 2 - mail messages.
• rsyslog - Rocket Fast System Log
• syslog-ng - Logging with filter
• nxlog - Multi operating system platform log collector
• Journalctl
• The journald daemon collects data from all available sources and stores them in a binary format for easy and dynamic manipulation.
• Journalctl command is used to view, search and filter the logs stored in the binary format.
• Metadata
• The data that describes other data sources. Will be useful while performing the incident analysis.
• Eg: for email we will have standard header storing the sending and destination address, in mobile having the gps locations, etc.
• Network Activity
• Netflow
• Gathers the traffic statistics from all the traffic flow in the entire network.
• IPFIX
• IP Flow Information Export, tracks the IP actions in the network
• IPFIX collects the data packets from across the network, organized by an Exporter which sends the compiled version to the Collector.
• IPFIX provides the flexibility by customizing the templates, these templates outlines the data the user wants to collect.
• Serves as industry standard for the export of flow information from network devices.
• sFlow
• Sampled Flow, used for monitoring high speed switched networks.
• Packet sampling in embedded technology is used to monitor network devices such switches, routers, wireless access points.
• Only the portion of the actual network traffic is captured, yet been found useful in getting the complete network visibility, for defence against security threats.
• Protocol analyser
• Able to analyse the traffic at packet level, several tools such as wireshark protocol analyser

Incident Mitigation

In the process of incident mitigation is a critical part of the incident response process. Applying mitigation techniques or controls in order to secure an environment is a key to containment, eradication and recovery phases.

Incident mitigation requires eradication or containment of the malware for securing an endpoint as a precaution. An endpoint could be desktop computer, laptop, smartphone or tablet. As a security team its our responsibility for monitoring all of these different devices.

Approach

Controlling the applications running on the endpoint, creates more secure and stable environment.

• Allow List
• Create a list of applications that are approved
• Allow only the approved applications to run on the endpoint
• Restrictive approach 
• Deny List
• Maintain deny list of applications
• These list of applications will not be allowed to be executed on the endpoint
• Anti-virus and anti-malware behaves the same
• Quarantine
• Applications suspected to be malicious will not be allowed to run.
• It will move from that system and place it into a quarantine area, where no applications are allowed to run. This does not mean removing it or cleaning it, just in different area to avoid spread.
• Later security team can perform additional analysis on the suspected application and this will avoid its spread if proven malignant. 

Criteria

An ability to run or not run an application in an operating system is commonly built into the core functionality of the os. Security team can enable to disable different parameters to allow certain software to run or deny.

• Application Hash: Execute only if hash of the executable matches on the system.
• Certificate: Execute only if the digital signature matches.
• Path: Limit permissions to certain folders, allowing to be executed only from certain folders. Eg: one may run an application with local rights and accessing only those certain folders. Here this cannot extend accessing the folders belongs to root or other users.
• Network zone: Set a policy that would allow or disallow an application to run based on the zone it is executing from. Eg: an application run in private area but prohibited to be executed in public zone. 

Controls

• Firewalls
• Allow or deny application traversing in the network
• Block using rules such as ip address block or allow, zone wise allow or block
• MDM - Mobile Device Manager
• Have rules on the mobile devices that can allow or disallow access.
• These rules or polices can be configured using MDM and only security administrator can set or unset the policies
• DLP - Data Loss Prevention
• DLP identifies and blocks the transfer of any PII - Personally Identifiable Information.
• Eg: Credit card numbers, social security number, etc if it has been transferred outside will be blocked.
• Content filter/URL filter
• Restrict or allow only certain websites.
• Many of the these URL filters can also be integrated with third party blocklists.
• Blocklists can be updated constantly allowing real time blocking the malicious sites.
• Certificates
• Allow access from only trusted devices
• Deny the access if it does not have trusted certificate on that device
• Isolation
• Isolation is a process where a device or application is moved into an area where it has limited or no access to other resources.
• It is a key strategy while fighting against malicious software or software thats constantly trying to communicate back to a command and control location.
• Network Isolation
• Isolating device to a different network disabling the access to the rest of the network, when suspected malicious or not fully protected.
• No communication to other devices.
• Process Isolation
• When a process running on the device seems to be suspicious, we can disallow any access from that process to the rest of the network.
• This will limit application execution but allow device management.
• Containment
• Run each application in its own sandbox, limiting the interaction with the host operating system and other applications.
• Here it prevents the spread of malicious software to prevent from jumping outside of that application to infect the local machine or other devices in the network.
• Segmentation
• In general extensive security is created between the outside of the network and internal network. But once the malicious software enters inside network it is able to traverse freely without any concern of being blocked.
• To overcome this network administrators have started to create segmented networks within the network. 
• Eg: Database is usually placed in a network where it can be accessed only from backend application. And web application servers can be accessed from internet but internally it can only interact with backend applications.
• SOAR - Security, Orchestration, Automation and Response
• As there are different and many controls needs to be taken care, it would be challenging and mistakes can occur if done manually.
• To automate these processes we need SOAR.
• Using SOAR, an admin can integrate multiple third party tools and have them all work together.
• Runbooks
• A runbook holds detailed steps on how to perform particular task
• Playbooks
• When a particular event occurs, a set of runbook together performed is called a playbook.

References and Credits

https://gluu.biz/wp-content/uploads/2020/05/incident-management.png

https://www.professormesser.com/security-plus/sy0-601/sy0-601-video/sy0-601-comptia-security-plus-course/

Cloud Cybersecurity Solutions

 

Introduction

Cloud enables elasticity allowing users to dynamically avail resources based on the needs and only pay for what they use. Voila! a great invention for the digital world.

Allowing only authenticated services to scale up or down and ease of ramping up or down with immediate visibility to the authorized admins. The authentication, authorization, firewalls, audit and transaction visibility are crucial steps in cloud security. 

Though we technically own the servers, but as we know mostly we don't have physical control on the servers, leading to additional care. Cloud security it is shared responsibility of the customer and the cloud service provider - CSP. 

Today we shall discuss about cloud infrastructure and some of key elements in towards its security. 

Region and Availability Zones

Uptime and availability are one of the two important aspects of cloud security. Regions are different geographic locations the service providers maintain their infrastructure. For each region there can be more than one Availability Zones - AZ. For example a cloud service provider could support two regions India and Australia, and in each of the regions there could multiple AZs for instance in India two AZs in Mumbai but different parts.

Each of the AZs are self contained and independent. Each having different power providers, separate network confirmations and so on. Making in reliable, if any one AZs downtime will not affect the other AZ.

As user we can take advantage of this, and could configure our application to the nearest region of our users in order to reduce latency. Also load balance either through active/active or active/standby configuration. Providing the flexibility to switch when there is an issue or overload requests, enabling high availability.

Each region cost may different of the services and not all regions would provide all the services. Also while selecting the region the compliance regulations needs to be considered. 

Virtual Private Cloud (VPC)

In a public cloud space we can create a private isolated network known as VPC. It is just like the private cloud having both public and private subnets. The private does not exposing the IP addresses as public address and can be accessible only through restricted means. VPC is essentially at the network layer as a IAAS service. 

An analogy, in a IT parks we have different organizations having different facilities such as parks, auditorium but the work area is private only employees or restricted person can enter. Here private area is similar to VPC, we have major control over it and as well its considered to be secure. Separation is security opportunity, eg the web servers can be accessed from anywhere but the database should be accessed only by the backend application servers.

Multiple subnets could be created in the single VPC, definitely within the range of IP addresses the VPC is created with. The subnet could be either private or public, this draws the line for the servers in these network not to access from public network. 

VPC Gateway endpoints, allows connecting multiple VPCs keeping the data private without using the internet.

Virtual LAN (VLAN) is as like LAN way of partitioning the network as the group of servers connected can access each other without hitting internet. Here the partitioning occurs in the layer two of OSI model.

Virtual Private Network (VPN) uses encryption on top of the public network, making it secure and avoiding man-in-middle attacks.

Firewall

Security groups are acting as a “firewall” on instances. Using security group, we can control both the incoming and outgoing traffic. They are stateful, which means any traffic in is allowed to go out, can go back in. Supports only allow rules, means traffic cannot be explicitly blocked, rather only allow configured traffic in. 

NACLs are acting as a “firewall” at the subnet level. We can associate a single NACL to multiple subnets, but only one NACL can be assigned a subnet.

These stateless as the inbound and outbound rules apply for all traffic. For example, if the output traffic is allowed our request would reach out, but if expect a response, sorry it would need to have the outbound rules specified. Supports all both allow and deny rules for both inbound and outbound traffic. Here we can specify only reference a CIDR range (no hostname). 

Additionally we have services provided by CSPs to protect at different layers of OSI, such as WAF - web application firewall secures at layer 7, Network firewall protects at layer - 4 and so on. This could enhance the security blocking unusual API calls, not allowing or allowing access from certain geographic locations, track and report attempts made to access critical data.

IAM Policies

In cloud access to resources is governed by policies and their permissions centrally with audit enabled by default. Each policy can be attached to the entity, user, user group or a role.  

There are two basic policies either we call it identity based policy or resource based policy. Under identity based policy permissions are given to the user, user group or role. And for the resource based policy these policies define who can access and what activities they are allowed to perform.

Stating access will be granted only when both the policies allow, if either is denied access will not be granted. By default all the access would be denied, explicit allow only grants the access. But if there is explicit deny it will get higher precedence and access will be denied.

Granular access policies can be set such as allow or disallow certain IP addresses, data and time, group, geographic locations, etc. 

Managing Secrets

Applications that use API Keys, encryption keys or credentials should not have it hard coded. Cloud provides services to handle the secrets elegantly. Secrets are encrypted at rest and in transit. 

Secrets management protects and manages the access to the applications and services. IAM policies makes sure one has access to secrets. 

Central Logging

Monitoring and audit is crucial phase of cybersecurity. Cloud provides framework and services to manage and enable monitoring granular level. 

IAM access, policy change, infrastructure changes are some of the common tasks where the logging is default enabled and aggregated in the central location. But these would not be sufficient, cloud provides APIs to write more and customized logs based on the user's requirement.

These centralized logs can be further used for further inspecting and analysis, as well integrate with any SEIM Solution. Intuitive reports could be created from these logs. 

Cloud Access Security Broker (CASB)

Each cloud service provider provides a set of tools enabling the security tools. But there could be gaps or the requirements could not be matched by them. And as the data resides with the cloud service provider maintaining security and adhering security policies becomes important. In such scenarios on premises or third party offerings - CASB come to a rescue, fill in the gaps and compliment cloud security services. This is placed between the cloud consumer and cloud provider.  

CASB provides security software as a service addressing cloud service risks, enforce security policy, threat protection, data security, comply with regulations. This can be implemented as software running either locally or in cloud. CASB operates on four primary characteristics:

• Visibility: Visibility on the entire processes running on cloud and if it authorized. Validation and avoiding misconfigurations.
• Compliance: Following organization own or mandated policies, like HIPAA, PCI
• Threat prevention: Allow only authenticated and authorized users to the granular level, including multi level approvals or multi factor authentication.
• Data security: Protect and encrypt the sensitive data at rest and in transit. Ensure APIs is secure, where the attackers can exploit the interfaces.

CASB along with next-generation secure-web gateways (SWGs) monitoring and management of web APIs and user/entity behaviour analytics (UEBA) provide the capability to deliver static and dynamic access to the management.  

CASB is evolving into on huge service known as Secure Access Service Edge (SASE) architecture. SASE combines multiple security and networking technologies to provide comprehensive web and cloud security. Security Service Edge (SSE) is the convergence of multiple cloud-based security services as part of a Secure Access Service Edge (SASE) architecture. 

Security Awareness

Structural awareness solutions help manage risk and apply protections to systems and data.

• Cloud compliance and best practices: Visualization and continual assessment of the environment, including the ability to enforce known good standards
• Instance and container visibility: Monitoring and protection of containers through their life cycle
• Virtual private network: Secure access to applications running in a VPC for remote employees
• Secure data: Encryption and key management solutions to protect data and meet regulatory compliance standards
• Vulnerability assessment and management: Visibility into the attack surface to discover and resolve security issues
• Software composition analysis: Management and security for open-source licenses
• Operational intelligence: Aggregation and correlation for the analysis of data across security, performance, and availability
• DevSecOps: Automated and continuous process management for continual integration and delivery of secure applications
• Cyber risk management: Prioritized insight into the threats, vulnerabilities, and impacts of cloud assets
• Container security: Minimal or hardened operating system that is specifically designed to run containers. Running similar security demand services on a same host, limit the scope of intrusion.
• Backup: Maintaining backups ensuring availability by following the legal requirements such as holding information for 7 years, data should saved our of country.
• Permissions: Authentication and authorization at granular level and constant audit to ensure there is no break.

Situational awareness solutions detect security events and are capable of responding, recovering, and helping with continual improvement. 

• Firewalls and proxies: Provide fine-grained inspection of traffic for potential threats at both the network and application levels
• Endpoint detection and response: Protect endpoints, including cloud workloads from zero-day and other attacks
• Intrusion detection systems: Monitor networks and workloads for security events
• Backup and restoration: Protect data from errors, failures, and accidental deletion
• Disaster recovery: Provides additional flexibility to quickly recover from a disaster, ensuring that cloud workloads are available
• Security information and event management: Ingests, correlates, and prioritizes events for deeper visibility into anomalous behavior and threat mitigation
• Workload isolation: Provides dynamic security control for microservices, containers, and other workloads

References and Credits

https://www.cloudcodes.com/blog/wp-content/uploads/2020/05/cloud-security-for-dummies.png'

https://www.cloudflare.com/en-in/learning/cloud/what-is-a-virtual-private-cloud/

https://www.professormesser.com/security-plus/sy0-601/sy0-601-video/cloud-security-controls/