A Review of the Best News of the Week on Cloud Security, DevOps, AppSec
The aftermath of the Gentoo GitHub hack (Network World Security, Jul 10 2018)
A password guess and five days offline have left not only Gentoo’s GitHub admins, but all of us, with some things to think about.
Another Linux distro poisoned with malware (Naked Security – Sophos, Jul 11 2018)
This time, the malware poisoning happened to Arch Linux, another distro we’d characterise as hard-core, though very much more widely used than Gentoo.
Survey Finds DevOps Playing Key Role in Cloud Migration (DevOps, Jul 11 2018)
When it comes to lifting and shifting applications into the public cloud, too many organizations are still engaged in “wishful thinking.” Most applications migrating to the cloud will need to reworked to one degree or another, Lyman said.
Sponsored by LogRhythm
SIEM Magic Quadrant
Gartner Positions LogRhythm in SIEM Leaders Quadrant for 5th Consecutive Year. Get the report
Recovering from a rough Monday morning: An Amazon GuardDuty threat detection and remediation scenario (AWS Security Blog, Jul 10 2018)
This post, and the corresponding GitHub repository, will help prepare you for either type of experience by walking you through a threat detection and remediation scenario. The scenario will show you how to quickly enable GuardDuty, generate and examine test findings, and then review automated remediation examples using AWS Lambda.
Google Releases Open Source Tool to Containerize Java App Deployments (eWEEK, Jul 09 2018)
Jib ostensibly will make it much easier for organizations to deploy and control Java apps across use case deployments.
Methodology for the Mapping of the Cloud Controls Matrix (Cloud Security Alliance Blog, Jul 09 2018)
The Cloud Security Alliance (CSA) Cloud Controls Matrix (CCM) provides fundamental security principles to guide cloud vendors and cloud customers seeking to assess the overall security risk of a cloud service.
A Pragmatic Guide to Container Security (Container Journal, Jul 06 2018)
Containers aren’t the solution to every problem, but they do solve a number of significant issues around application development and deployment.
General availability of user behavior analytics tools in Azure Application Insights (Microsoft Azure Blog, Jul 10 2018)
“At Microsoft Build 2017, we introduced a set of user behavior analytics tools for Application Insights as a preview. Since then, we’ve listened to your feedback, adding additional capabilities and squashing bugs. We’ve also used these user behavior analytics tools on themselves, finding opportunities to improve your experience without you even having to ask!”
Trading Platforms Riddled With Severe Flaws (Dark Reading, Jul 06 2018)
In spite of routing trillions of dollars of stock and commodity trades every day, financial cousins to online banking applications are written very insecurely.
Intel Pays $100,000 Bounty for New Spectre Variants (SecurityWeek, Jul 11 2018)
Researchers have discovered new variations of the Spectre attack and they received $100,000 from Intel through the company’s bug bounty program.
Apple Patches KRACK Flaws in Boot Camp (SecurityWeek, Jul 09 2018)
Apple has released an update for its Boot Camp utility to address vulnerabilities related to the wireless Key Reinstallation Attacks (KRACK) that were disclosed late last year.
Poor security at Thomas Cook airlines leads to simple extraction of fliers’ personal data (Graham Cluley, Jul 09 2018)
Roy Solberg, a programmer in Norway, discovered that it was possible to retrieve the following information from Thomas Cook Airlines’ systems using only a booking reference number
WordPress issues out of band security and maintenance update (SC Magazine, Jul 10 2018)
WordPress issued an out of band security and maintenance release patching 18 bugs with version 4.9.7 being pushed live today.