DevSecOpsLinks

🔔 Announcement

We're thrilled to announce FAUN Jobs , the community job board for developers and software engineers!

Anyone with an active account on FAUN can create and post jobs for absolutely FREE.

The job board is open for all sorts of software engineering jobs:

• ☁️ DevOps professionals and specialists,
• 🕸️ Network and system engineers,
• 🐍 Python developers,
• 📎 Golang developers,
• ⛓️ Blockchain developers
• and more!

It's also open for all job types: Contracts, Freelance, Full time, Part time, Internship, Remote, and Onsite.

👉 Start posting your first job, it's totally FREE !

Sponsor FAUN and reach developers where they are, not where you want them to be.

Download our mediakit.

🥶 Colder temps are coming and we've got you covered!

😎 20% off your purchase, free shipping 👉 Use code "THANKSFAUN".

his is a blog related to the author's recent CVE on ServiceNow. It was found while testing a bug bounty program that was using ServiceNow and their in-scope domain was ‘redacted.service-now.com’.

By @tutorialboy24

It may seem counterintuitive, but maybe organisations should consider delegating responsibility for DevSecOps to engineering teams, not security teams, argues Elastic’s Mandy Andress.

Healthy developer-team culture and adherence to devsecops best practices to protect against supply chain attacks are surprisingly commonplace in today’s security environment, according to a report from Google Cloud's DORA research program.

Zscaler Inc. made generally available new integrations with HashiCorp for its recently introduced cloud-native application protection platform Posture Control. The integration is particularly critical when adopting “infrastructure as code” as part of CI/CD pipelines. This enables the concept of shift-left to become a reality and reduces friction between development and security teams.

GraphQL APIs are a prize that could pay out a treasure trove of sensitive data. For these reasons, some attackers want nothing more than to locate and exploit your GraphQL API.

Attackers can be impressively resourceful at passively collecting valuable reconnaissance before they even risk sending packets at your application. Queries tell attackers what they’re dealing with GraphQL exists largely as a superior replacement technology that addresses and eliminates the cumbersome hassles of working with REST APIs .

By learning to recognize the telltale signs of these methods, DevSecOps teams can flip the script on attackers.

IaC enables enterprises to strengthen their security posture while simultaneously maintaining security and compliance over a period of time. While IaC provides the ability to increase speed and agility, it also comes with its own set of challenges.

Deepfactor announced that Inspide is using the newly released Deepfactor Developer Security 3.0.

• Deepfactor is a developer security platform. 
• Inspide is a Spanish geo-intelligence company that enables knowledge of people's behavior in physical and digital environments.
• Inspide uses Deepfactor Developer Security 3.0 as their DevSecOps platform to get developers to buy into security.
• “We had invested a lot in security from the point of view of the network or the site reliability engineers, but never from the software developer's perspective,” said Daniel Carrión, Chief Technology and Product Officer, Inspide.

The JFrog Security Research team released the findings of a recent investigation wherein they uncovered thousands of publicly exposed, active API tokens.

• This was accomplished while the team tested the new Secrets Detection feature in the company’s JFrog Advanced Security solution, part of JFrog Xray.
• The team scanned more than eight million artifacts in the most common open-source software registries.
• Each artifact was analyzed using the Secrets Detection scanners to find and verify leaked API tokens.
• After scanning all supported token types by Secrets Detection and verifying the tokens dynamically, AWS, GCP, and Telegram, API tokens were the most leaked tokens (in that order).  

Scribe Security announced the launch of its unique evidence-based security trust hub, offering for the first time true end-to-end software supply chain security.

• Unlike other software supply chain security solutions, Scribe's evidence-based security hub supports a workflow for sharing SBOMs, the company said.
• "SBOM is a best practice that is expected to become widely required and used to mitigate software supply chain risks. With that in mind, we decided to be the pioneers and launch a simple-to-use platform that serves as a hub for a plethora of security evidence for software products," said Rubi Arbel, Scribe Security Co-founder, and CEO
• Scribe helps developers in automatically generating, and managing SBOMs and security insights; validating the code integrity and provenance; tracking vulnerabilities in the containers, dependencies, and pipelines and detecting code tampering

GitLab patched an RCE bug in the GitHub import function.

• The vulnerability allowed attackers to stage various attacks against GitLab servers, including the cloud-hosted GitLab.com platform.
• The bug was reported by security researcher ‘yvvdwf’.
• The vulnerability was assigned CVE-2022-2884 with a critical base score of 9.9 in the Common Vulnerability Scoring System.

Toyota, the world’s largest car company, discovered that an access key for one of its data servers has been publicly available on GitHub for almost five years, exposing the data on this server to potential unauthorized third-party access.

• The data server in question stores information related to subscribers of Toyota’s T-Connect service.
• According to Toyota’s statement on this matter, a subcontractor developing the T-Connect website mistakenly uploaded part of the website’s source code to the subcontractor’s own GitHub account.
•  Toyota says that this action, which took place back in December 2017, violated its handling rules, but that it went unnoticed until September 15th of this year.

Venafi published a new cybersecurity research report:

• 81% of companies report that they have suffered a security incident in the cloud over the last year.
• Almost half (45%) report that their organization experienced at least four incidents.
• Companies currently host 41% of their applications on the cloud.
• That percentage is expected to rise to 57% throughout the next 18 months.
• As it rises, the need for robust cloud security will rise too.

A DevSecOps framework powered by Nix.

The DevSecOps toolset for REST APIs

Scans Software Bill of Materials (SBOMs) for security vulnerabilities

Detect and remediate misconfigurations and security risks across all your assets

An open source, cloud-native security and policy project