devopsy.kinsta.cloud

Tag: security

  • Salesforce Adds Ability to Apply Custom Security Policies to APIs

    Salesforce Adds Ability to Apply Custom Security Policies to APIs

    Salesforce today added the ability to customize security policies for application programming interfaces (APIs) to the Mulesoft Anypoint API management platform.

    Gerry Egan, vice president of product management for Mulesoft at Salesforce, said this capability makes it possible for organizations to use an Anypoint Flex Gateway Policy Development Kit to streamline development of custom API security policies that can be implemented as code.

    In addition to providing integrations with integrated development environments (IDEs), the Anypoint Flex Gateway Policy Development Kit also provides test policies that can be employed to ensure API security.

    That approach makes it simpler to ensure APIs are secure as they are being built and deployed within the context of an automated DevOps workflow versus having to rely entirely on a separate API security platform, he noted.

    The Mulesoft Anypoint Gateway already comes with security policies that DevSecOps teams can readily implement. Salesforce is now adding the ability to apply custom policies that DevOps teams can apply as it becomes apparent cyberattacks against APIs are becoming more sophisticated, noted Egan. Those policies can, for example, be used to remove sensitive data or replace it with a token, he added.

    Responsibility for API security is often not well established in many organizations, but as more accountability for API security shifts left toward DevSecOps teams, there is growing interest in addressing the issue as code when APIs are developed and deployed. While cybersecurity teams are responsible for maintaining cybersecurity after APIs are deployed, few of them have any insight into how an API is crafted. That’s a significant issue because cybercriminals have become more adept at both exfiltrating data via external facing APIs in addition to manipulating the underlying business logic to compromise a digital process, noted Egan.

    The Mulesoft Anypoint Gateway automates the process of building and applying security policies to APIs as part of the software development life cycle (SDLC) in a way that minimizes any impact on developer productivity, he added. That approach provides the added benefit of reducing the level of cognitive load developers would otherwise experience if they had to manually create software policies, said Egan.

    In general, most APIs are internally facing, but it’s not uncommon for them to suddenly be exposed to the internet as application use cases evolve. The best way to ensure API security is at the point of creation. Providing developers with API security tools gives them an opportunity to address security issues at the beginning of the application development process.

    There have already been several cybersecurity breaches involving APIs in the past year. It may only be a matter of time before there are additional breaches that could prove catastrophic. Regardless of the size of the API breach, the application development team that created and deployed the API in the first place is ultimately going to be held accountable for fixing it. The challenge is to find the simplest way to eliminate the issue in the first place at a time when the number of APIs being built and deployed only continues to explode.

  • Mobb Extends DevSecOps Reach of Tool to Generate Patches

    Mobb Extends DevSecOps Reach of Tool to Generate Patches

    Mobb today added an ability to instantly surface patches for vulnerabilities at the time when code is being committed during a DevSecOps workflow.

    Previously, the tool provided by Mobb to create validated patches based on the scan results of third-party SAST tools would only surface issues to individual developers.

    Mobb CEO Eitan Worcel said organizations can now address these issues within the context of DevSecOps workflow.

    The Mobb platform combines proprietary security research and traditional semantic analysis with generative artificial intelligence (AI) to automatically create patches for vulnerabilities. The overall goal is to make it simpler for DevSecOps teams to consistently ensure applications with known vulnerabilities are remediated before they are deployed, said Worcel.

    The Mobb approach eliminates the need for IT teams to sort through static application security testing (SAST) scans themselves. Each vulnerability typically requires at least 30 minutes to fix, so the Mobb platform improves application security while simultaneously making developers more productive.

    Historically, one of the reasons for the wide divide between application development teams and cybersecurity professionals is that many of the vulnerabilities discovered don’t actually impact applications running in production environments. Development teams then find themselves wasting time investigating vulnerabilities and, when they do determine a vulnerability is an issue, spending time developing a patch. The Mobb tool automatically creates the necessary patch, so there is less of a need to debate which vulnerabilities are worthy of the time required to create a patch.

    For decades, application development teams have been attempting to find a way to remediate vulnerabilities as quickly as possible. With increased focus on adopting DevSecOps best practices to address those vulnerabilities, more organizations are now reviewing software supply chains as part of a larger effort to improve application security.

    There will, of course, be vulnerabilities that the Mobb tool will not be able to address simply because there may not be enough affected applications to warrant pre-building a patch. Even with the most robust set of rules, it is improbable that an automated tool can, with 100% certainty, safely fix every issue. However, given the number of routine vulnerabilities present in applications, such as SQL injections, there’s plenty of opportunity to improve developer productivity by relying on patches that address common vulnerabilities.

    The process by which patches are prioritized, developed and then applied has, of course, long been a source of DevOps frustration. Anything that streamlines that process will go a long way toward improving the overall state of application security at a time when cybercriminals are becoming more adept at exploiting vulnerabilities. The challenge is finding a way to remediate vulnerabilities that developers will embrace rather than resist. The Mobb approach still provides them with control over what patches are applied but the toil involved with creating a patch in the first place has been substantially reduced.

    It’s not clear how long it might be before automated approaches to building patches might improve the overall state of application security but, as always, every journey needs to begin with a first step in the right general direction.

  • Hybrid Cloud in 2024: Trends and Predictions

    Hybrid Cloud in 2024: Trends and Predictions

    Hybrid cloud environments are becoming increasingly pivotal for DevOps teams, primarily due to their ability to bridge the gap between the rapid deployment of public cloud resources and the security and control of private cloud infrastructure. This blending of environments provides DevOps teams with flexibility and scalability, which is crucial for operating continuous integration and continuous deployment (CI/CD) in large enterprises.

    In a hybrid cloud setup, DevOps teams can swiftly deploy and test new applications in a cost-effective and scalable public cloud environment. Once the applications are ready for production, they can be seamlessly transitioned to a private cloud or on-premises environment, where they benefit from enhanced security and control. This allows DevOps teams to optimize their workflows, reduce time to market, and respond more effectively to business needs.

    The hybrid cloud also enables a more collaborative and agile working environment. DevOps teams can leverage various tools and platforms available in the public cloud while ensuring that sensitive data and critical applications are securely managed in the private cloud. This both enhances operational efficiency and improves compliance with data governance and regulatory requirements. These benefits will make hybrid cloud an indispensable asset for DevOps teams in 2024 and beyond.

    What is a Hybrid Cloud?

    Let’s start with a brief definition. A hybrid cloud is a computing environment that combines a public cloud and a private cloud by allowing data and applications to be shared between them. This combination allows businesses to enjoy the best of both worlds, leveraging the scalability and cost efficiencies of public cloud platforms while enjoying the security and control offered by private cloud infrastructure.

    This hybrid cloud model provides businesses with more deployment options and greater flexibility to scale computing resources. It also helps in reducing capital expenditure and improving security by allowing sensitive data to be stored on a private cloud. A hybrid cloud strategy enables businesses to allocate resources efficiently, keeping less critical applications on the public cloud, while mission-critical applications run on the private cloud.

    Current State of Hybrid Cloud Computing

    The hybrid cloud market is in a state of rapid growth and evolution. As businesses increasingly recognize the benefits of a hybrid approach, the adoption of hybrid cloud strategies is on the rise.

    In a world where digital transformation is the norm, hybrid cloud computing has emerged as a key enabler. It offers the flexibility needed to adapt quickly to changing business conditions, the scalability to handle sudden increases in workload, and the security to protect sensitive data. These benefits have made hybrid cloud a cornerstone of digital transformation strategies.

    However, the journey to hybrid cloud is not without its challenges. Businesses are grappling with issues related to data security, compliance, integration, and management. There are also complexities related to workload portability, interoperability, and the need for skilled resources. Despite these challenges, the adoption of hybrid cloud continues to grow as businesses seek to leverage its benefits to drive innovation and competitive advantage.

    Emerging Trends in Hybrid Cloud for 2024

    Increased Adoption Across Industries

    Many industries, including the banking and finance sector, healthcare, retail, manufacturing, and even the government sector, are seeing increased adoption of hybrid cloud strategies. This trend is driven by the need for greater agility and flexibility, better cost management, and improved security and compliance.

    In the healthcare sector, for example, hybrid cloud is enabling the integration of disparate systems, facilitating the sharing of patient data, and supporting telehealth initiatives. In the banking sector, it is helping to manage risk, improve customer experiences, and drive innovation. In retail, hybrid cloud is supporting omnichannel strategies, personalizing customer experiences, and improving supply chain efficiency.

    Advancements in Cloud Technology

    The hybrid cloud landscape in 2024 will be shaped by advancements in cloud technologies. Technologies like containers and Kubernetes are simplifying the deployment and management of applications, making it easier for businesses to adopt a hybrid cloud strategy. The rise of serverless computing is also contributing to the growth of hybrid cloud by eliminating the need to manage servers and allowing developers to focus on writing code.

    Furthermore, advancements in networking technologies are making it easier to connect and integrate public and private clouds. The emergence of 5G is expected to further accelerate the adoption of hybrid cloud by providing the high-speed connectivity needed to support real-time applications.

    Integration of AI and Machine Learning

    The integration of artificial intelligence (AI) and machine learning (ML) into hybrid cloud environments is a trend that is rapidly gaining momentum. One key aspect of this integration is the ability to use AI for better resource management within the hybrid cloud. AI algorithms can analyze patterns in data usage and application performance, allowing for more efficient allocation of resources across public and private cloud environments.

    Furthermore, AI and ML are also facilitating better data management and analytics. Cloud-based services are making AI/ML more accessible to businesses of all sizes. By integrating these technologies, businesses can unlock insights from vast amounts of data stored across different cloud environments.

    Predictions for Hybrid Cloud in 2024

    Growth in Edge Computing Integration

    By 2024, the integration of edge computing with hybrid cloud architectures is expected to grow significantly. Edge computing brings data processing closer to the location where it is needed, optimizing response times and saving bandwidth. 

    In a hybrid cloud context, this means that organizations can process critical data at the edge, in real-time, while still leveraging the cloud for less time-sensitive tasks. This integration is particularly beneficial for industries like manufacturing and autonomous vehicles, where real-time data processing is crucial. The combination of edge and hybrid cloud computing enables businesses to harness the power of cloud computing while maintaining the speed and efficiency of edge processing.

    Improved Security and Compliance Measures

    In 2024, we anticipate significant advancements in the security and compliance aspects of hybrid cloud environments. As these environments become more complex, the need for robust security measures that span both public and private clouds is crucial. Enhanced encryption techniques, more sophisticated identity and access management systems, and advanced threat detection tools will become standard. 

    Additionally, we expect to see the development of more streamlined compliance benchmarks and frameworks designed specifically for hybrid cloud architectures, simplifying the process of adhering to various regulatory standards and ensuring data privacy and protection across multiple platforms.

    Innovations in Cloud Management Platforms

    The year 2024 is likely to witness substantial innovations in cloud management platforms, driven by the need to manage complex hybrid cloud environments more efficiently. These platforms will offer enhanced capabilities in terms of automation, orchestration, and unified management across multiple cloud services. 

    The use of AI and machine learning for predictive analysis, resource optimization, and proactive problem resolution will become more prevalent. These platforms will also provide better tools for cost management and analytics, giving businesses a more granular understanding of their cloud usage and enabling more cost-effective decision-making.

    Customizable and Flexible Cloud Solutions

    As hybrid cloud environments continue to evolve, 2024 will likely see a rise in more customizable and flexible cloud solutions tailored to specific business needs. Providers will offer a range of options that allow businesses to mix and match services from both public and private clouds, creating highly personalized cloud environments. 

    This customization will extend to aspects like security, performance, and compliance, allowing businesses to fine-tune their cloud infrastructure to their specific requirements. Such flexibility will be particularly beneficial for businesses in niche markets or those with unique operational needs, enabling them to leverage the power of cloud computing without compromising on their specific requirements.

    Conclusion

    By 2024, hybrid cloud computing will have significantly evolved, becoming a critical component in the digital transformation strategies of various industries. This technology offers a blend of public and private cloud benefits, crucial for DevOps teams in terms of flexibility, scalability, and security. The integration of advanced technologies like AI, machine learning, and edge computing will enhance resource management, data analytics, and real-time data processing. Additionally, the hybrid cloud’s role in ensuring agility, better cost management, and compliance is expected to drive its wider adoption across sectors like healthcare, banking, retail, and government.

    The landscape will also see advancements in security and compliance, with sophisticated measures spanning both cloud types and cloud management platforms will evolve to include AI and machine learning for more efficient operations. Customizable and flexible cloud solutions will become prevalent, allowing businesses to tailor their cloud environments according to specific needs. Overall, hybrid cloud in 2024 will be a strategic enabler, equipping businesses with the necessary tools and capabilities to thrive in an increasingly digital world.

  • Shared Responsibility? Yeah.

    Shared Responsibility? Yeah.

    One of the things that the last decade or two of enhancements has brought about is an increasing reliance on everyone across the organization to be more secure. While users have long since thrown up their hands and looked for ways to minimize the fallout when a vendor they frequent is compromised, enterprises have to lock down their own things. And given the ever-increasing volume and sophistication of attacks, the demands are growing.

    Cloud brought us the concept of a ‘shared responsibility‘ model. It is necessary in a world where an org does not control the physical servers and supporting infrastructure that applications ultimately run on. The fact is, the shared responsibility model was really cloud vendors reminding us that we still have to protect our apps, no matter where they’re deployed.

    This model and DevOps together have driven us to demand more of developers and DevOps teams with regard to security. It has also driven ops to have to care more, as more is exposed and security demands are up while security staff isn’t.

    And I’ll just remind you of the obvious. If you are responsible for security at the organization, you can get help from everyone, but those people’s job and direct responsibility is not security. They’re lending a hand because everyone cares, and that is the current state of most enterprises – DevOps made everyone involved in the SDLC a bit more responsible for all the things that aren’t their jobs (often a very good thing, often … not), but they’re not specially trained for it. That’s what security teams are for. And high-quality development security/policy management tools offer Dev and Ops and everyone in between a bit of guidance to good security practices along the way. I’ve praised putting security feedback right in the IDE half a dozen times here and elsewhere, and as a security-conscious developer, will continue to do so until it is so pervasive that people start to worry I’m losing it by going on about it. That’s a great example of helping everyone be more secure without requiring a ton of security staff hours in training. Developers don’t purposely write insecure code any more than they set out to make buggy spaghetti code. Giving tools to help them make the code more secure is a huge bonus – to them and to the corporate security team. So, if you’re not using them, start. And look into all of the other options to help non-security staff lock down their bit. The number of available security people on the market is perhaps the largest it has ever been (It’s so bad I actually know a security researcher who took months to find a new gig – that is pretty much unheard of or a unique case before recent days), but budgets to grow the security team aren’t there – any more than they are currently there to grow most teams. So tools to help are still imperative because you’re not going to get double the security staff in 2024 unless there’s only one of you … and you threatened to quit if they don’t get you help, which no one recommends as a negotiation tactic, so even if you’re solo, no doubling for you.

    Just remember who is responsible for overall infosec. Make use of the specialist and their knowledge in their space by finding tools to help them secure in a manner that matches workflow. Then verify because the organization’s security posture is security’s job.

    And keep rocking it. We’ve got so much cool stuff going on at the moment in IT in general that there is plenty of opportunity to improve architectures that are even relatively recent. Check what you have, consider it from a security perspective, improve what you have and keep rolling along.

    But first, relax, take a breather, and enjoy the holiday period.

  • How Encryption Innovation Will Power Cloud Privacy for Developers in 2024

    How Encryption Innovation Will Power Cloud Privacy for Developers in 2024

    For developers, the surge in cloud computing adoption has brought both new opportunities and challenges. On the one hand, developers are turning to cloud services for data storage, processing and accessibility due to their flexibility, convenience and cost-effectiveness. And because the cloud takes care of these infrastructure and operational concerns, it’s allowing developers to focus on coding, innovation and delivering value to end-users. It also allows companies to scale more easily when their market grows or when new hardware becomes available.

    However, this paradigm shift has led to the accumulation of vast volumes of sensitive data on remote cloud servers—including personal, health, financial and proprietary business information. As the volume of sensitive data on the cloud continues to grow, it has naturally raised mounting security concerns, from data breaches and cyberattacks, to unauthorised access and the complexities in complying with specific industry regulations, such as GDPR or CCPA.

    For some, having to rely on the cloud provider to maintain robust security practices and data protection has also led to hesitancy in sharing data, both within and between organizations. This not only limits the potential for data-driven collaboration, research, and innovation—essentially halting progress in fields like health care, science, and social sciences—but businesses of all types and sizes could miss opportunities for cost savings, scalability, and efficiency if they’re not willing to adopt innovative technologies. There are also cases when companies are forbidden to do something by law because of privacy, again causing roadblocks.

    All of this has meant that up until now, maintaining data privacy while making the most of cloud computing has been somewhat of a balancing act for developers and companies. Companies want to fulfill their clients’ needs, while developers have to find technical solutions that provide the level of privacy required.

    Traditional Encryption methods Vs. Fully Homomorphic Encryption (FHE)

    Currently, there are several technologies and practices employed to protect data in the cloud, one of the most commonly used being traditional data encryption, which provides protection only during data transmission and storage.

    However, when data is processed, it must be decrypted—at which point it can expose data to eavesdropping, rendering it susceptible to potential threats. The aim of FHE is to ensure that the computations can be carried out on cloud-based machines while the data itself remains encrypted. With FHE, the data is really encrypted end-to-end: not only is it encrypted during transport and storage, but also it is encrypted during computations. It is only when the data or results are sent back to the client side that they are decrypted.

    This means that in the event of a data leak, the exposed information would be rendered meaningless without the decryption key, which stays securely in the hands of the owner. In other words, neither the cloud provider nor any potential spyware on the cloud machine would have the capability to decrypt the encrypted data.

    This approach, which ensures sensitive data remains encrypted throughout its entire life cycle on the cloud, even during processing and analysis, significantly enhances data security and privacy.

    Current Limitations and FHE’s Future Developments

    While developers using traditional cloud services previously had to decide whether to use the cloud with some privacy concerns or forgo its benefits altogether, with FHE we are starting to see a possible shift in attention from users’ reliance on the cloud provider to a more user-controlled approach.

    As FHE becomes more widespread, users gain the ability to make their computations over any cloud provider, even those they may not fully trust. This means the upfront costs of building new cloud platforms can be lowered by providing only FHE computation.

    While the encryption of data ensures that computations are secure and no unauthorized access or breaches can occur, this new tech is not without its limitations. For the enhanced security FHE offers, there may come a trade-off of longer execution times. Presently, we are mainly reliant on CPUs for computations. However it’s worth noting that as the technology advances and hardware accelerators become available, the execution time is expected to improve in the future. In fact, we anticipate that by 2026, FHE implementations will see a considerable increase in speed, potentially by factors of 100x or 1,000x, expanding the applicability of FHE to a wider range of use cases.

    Other benefits currently being worked on include usability. FHE had a reputation of being very complex and so used to be reserved for those with cryptography PhDs. By developing open source tools and extending the community’s knowledge around FHE, the aim is to democratize FHE so that anyone can use it, companies can experiment free of charge and check if it fulfills their needs.

    Looking to the future, privacy will likely remain high on the agenda for almost everyone. Thankfully, with new encryption technologies rapidly developing in terms of speed and usability, developers look set to achieve this, ensuring their cloud-based applications and services are as secure as possible.

  • BMC Mainframe Survey Results Show a Platform on the Rise

    BMC Mainframe Survey Results Show a Platform on the Rise

    What if I told you that the oldest active computing platform is also one of the most innovative, seen as a platform for growth and new workloads, not just by seasoned professionals, but by a new generation of stewards, too? The 2023 BMC Mainframe Survey shows just that. In addition to an overwhelmingly positive perception and growth mindset regarding the mainframe, the survey reveals that the majority of those who are most enthusiastic about its future are relative newcomers to the platform.

    Now in its 18th edition, the annual BMC Mainframe Survey gauges the opinions of more than 800 executive and technical professionals on a range of topics, from overall perception of the platform to top priorities, common practices and greatest challenges.

    This year’s results show that 94% of respondents have a positive perception of the mainframe, with 62% citing it as a platform to grow and attract new workloads. This tracks the 62% who report adopting DevOps practices on the platform. It’s no surprise, then, that two of the top five priorities cited by respondents are efforts to enhance automation and modernize applications. Organizations around the world recognize that the mainframe can be a leader in innovation, powering their digital transformations.

    Modern Management Approaches

    This innovation goes beyond the software and services developed for the mainframe to include those used to manage the platform. It’s reported that 35% of respondents listed the implementation of cloud technologies as one of their top four priorities for the coming year, with 41% saying they are considering cloud-based storage and backup. With the growing volume of mainframe data and the emergence of new regulations and standards governing data security and recovery, organizations are turning to cloud-based data management to reduce costs and improve recovery options.

    Year over year, the number of survey respondents reporting the use of AIOps hasn’t changed considerably, but those reporting its cross-platform use on both mainframe and non-mainframe systems has jumped 7% from 2021.

    Organizations are recognizing the need to take advantage of the greatest business values of AIOps — cited in the survey as improved uptime and the ability to detect problems quickly, understand trends and respond proactively — as part of a holistic approach to enterprise IT operations management.

    With increased cross-platform use, significant benefits and a decrease in the number of respondents reporting implementation challenges like cost, complexity and the need for specialized skillsets, BMC sees AIOps as an area ripe for significant growth in the coming year.

    Investment Pays Dividends

    Improving the availability, quality and efficiency of the mainframe, of course, requires investment. In our report on the results of the 2023 BMC Mainframe Survey, we compare the responses of maximizers (those planning to increase investment in the platform) with those of minimizers (those planning to decrease investment levels). The results are eye-opening.

    Maximizers have invested in future-proofing their workforce in a variety of ways, and the data bears that out; 81% have ten or fewer years of experience on the platform. The new generation of stewards sees the mainframe not as a legacy platform, but one of continued growth and innovation, worthy of the investment required not just to keep it modern, but to place it at the forefront of digital transformation.

    Another key difference between maximizers and minimizers relates to security, which was cited as the top overall priority of survey respondents for the fourth consecutive year. Maximizers are more likely than minimizers to have a dedicated resource to investigate security events and to have dedicated ransomware recovery capabilities in place. It should come as no surprise, then, that maximizers were 20% more likely than minimizers to report that their mainframe security controls for ransomware are extremely effective.

    These results show that the differences between maximizers and minimizers go beyond outlook, producing tangible effects on outcomes. The maximizers increasing their investment in the mainframe report fewer challenges with staffing and skills shortages and a stronger stance against increasingly sophisticated cyberthreats. The minimizers decreasing their investment in the platform not only have greater difficulty in maintaining a skilled workforce, which increases the risk of falling behind competitively, but it also puts their organizations at serious risk of potentially catastrophic security breaches.

    A Bright Future

    In short, the results of the 2023 BMC Mainframe Survey reflect a positive outlook for the platform’s future. By investing in their workforces and the tools required to advance and protect the platform while adopting modern techniques and practices, organizations can reduce risk and promote innovation that delights their customers.

  • At Some Level, We’re Doing Security Wrong

    At Some Level, We’re Doing Security Wrong

    Years ago, right here in this blog, I pointed out that the worst of gamification was being applied to information security–play the game until you lose. I wish I could say we were past that, but we are not. And I think it is time for us to have a bit of a rethink (as my UK colleagues would say).

    Consider this. Twenty years ago, breaches were relatively common and we were concerned enough to enact laws about data, security, etc. Today, breaches are relatively common. In the intervening years, we implemented more and more security.

    The problem is that our environments—from mainframes to today—have grown increasingly complex. Our mission to make applications more useful and accessible makes them more vulnerable at the same time. And the changes are constant.

    If we were doing this right, breach notifications would be super rare, and we’d all want to know if it was a broken machine or human at fault—kind of like aircraft crashes are handled and reported in most of the world. Instead, we go out to a site like haveibeenpwned to see if we’ve been impacted, shrug and assume that the free credit monitoring service from the last five breaches should have us covered financially, and we move along.

    Internally, there is a post-mortem that closes whatever hole the attacker got through or exfiltrated data through and carry on, knowing full well that a different attack is coming.

    We are currently staring longingly at the bright lights of AI, hoping it can protect us from unknown vulnerabilities going forward. A bit of critical thinking will make it obvious that this is simply keeping up with attackers who also have access to AI and are using it to refine and launch even more complex attacks.

    The problem is that we all see the non-stop changes to attack vectors and architectures and don’t know how we could protect more broadly—and that is the appeal of trainable AI. We hope that it can rapidly generalize from its training to detect previously unknown attacks and, given enough inputs, can computationally detect attacks humans might miss in the sea of data. But that is still a point solution, in my opinion.

    How attackers approach the problem and what tools (both tooling and vulnerabilities) they have available are constantly changing, but the goals are unchanged. And I think we have to adapt our thinking to address those goals instead. Policy enforcement is a step in that direction—but, again, that means we’re protecting against the known.

    I don’t have the answers. I keep thinking of two approaches—airplanes are routed around a ton of threats to get their cargo to its destination safely, and that seems to be analogous to the problem. And hardened fortresses that literally ignore current mentality of “the perimeter is everywhere” and take the core, important bits of applications and lock them away even more tightly than we do today, with single-API access to a given bit and the API is monitored and analyzed constantly.

    But those are both sweeping, drastic approaches, and that may be our problem. Security spaces are merging slowly, but we still have a largely “That’s ops, that’s dev” mentality in security (as just one example of why sweeping overall protections are problematic). So, maybe with merges, the time will come that this is naturally resolved. But we’re not there yet.

    If you think about it, we’ve solved much more intractable problems, as the phone in your hand or the online game you enjoy spending a bit of time on demonstrate—we in IT and Dev are capable of amazing feats if we set clear goals and commit to both developing and implementing a solution. We just need those clear goals, and fighting today’s attack and hoping against hope another won’t come tomorrow just isn’t it.

  • Checkmarx Surfaces Threat to GitHub Repositories

    Checkmarx Surfaces Threat to GitHub Repositories

    Checkmarx, a provider of application security testing tools, today reported that malicious actors have been able to compromise the free automated dependency management tool for software projects, known as Dependabot, that GitHub provides.

    It’s not clear how prevalent the compromise is, but the attack involves the tokens that GitHub provides to allow access to Dependabot. Once cybercriminals gain access to a repository, they then add additional emails to the account that, once authorized, are used to inject malicious code into a repository that exfiltrates defined secrets to an external server. Cybercriminals can then modify any existing JavaScript files using a password-stealer to steal the credentials of any end user submitting their password in a web form.

    Guy Nachshon, a security researcher for Checkmarx, said Checkmarx was only able to discover the threat because one of the cyberattackers made a mistake. DevOps teams are advised to confirm the identity of each user that has access to both public and private GitHub repositories to ensure their software supply chain has not been compromised, he added.

    In general, attacks against software supply chains are becoming more sophisticated, noted Nachshon. Beyond launching phishing attacks to steal the credentials of individual members of an application development team, it appears cybercriminals are employing tactics and techniques that enable them to steal the credentials of an entire team contributing to a repository.

    These attacks, of course, have become a matter of national security. Governments around the world are crafting legislation that will hold organizations more accountable for the security of the applications they build and deploy. It may be a while before those proposals become law, but it’s clear the pressure on organizations to secure their software supply chains is building. More organizations than ever are, as a result, embracing DevSecOps best practices to better protect their software supply chains.

    The challenge is that many of the components used within those supply chains are from open source projects that organizations don’t have the ability to patch should a vulnerability be discovered. More troubling still, even when a patch is available, many organizations are reluctant to upgrade for fear of breaking an application. In effect, they are betting cybercriminals are not going to discover a potential exploit that exists in their application portfolio or that the damage inflicted will be less than what might otherwise be experienced should an application break following the update of a critical component.

    Playing the equivalent of Russian Roulette with application security is, to put it mildly, inadvisable. DevSecOps teams need to not only address vulnerabilities in applications as they are being built but also address the massive amount of technical debt relating to known vulnerabilities that have been allowed to accrue for more years than most anyone cares to admit.

    Unfortunately, cybercriminals are now clearly aware of the soft underbelly that exists within application environments, so the race to address an issue that has been allowed to fester is now on. And the odds, alas, are already stacked in favor of the malicious actors that are ready and willing to wreak havoc.