Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

DevOps

What is Infrastructure as Code Security (IaC) - Risk, Challenges & Best Practices

In recent years, Infrastructure as Code (IaC) has emerged as a game-changer for managing IT operations. By enabling teams to define and manage infrastructure using codes, IaC offers numerous benefits, such as increased agility, scalability, and consistency. However, along with the advantages, some unique security challenges also arise that must be addressed promptly. Here in the blog, we’ll explore the best practices to maintain the integrity and reliability of the Infrastructure.

Manage secrets with AWS Secrets Manager with Python - Tech Tip Tuesday

In this video, we show exactly how to use AWS Secrets Manager and how to connect it with your Python application. Secrets are hard to manage and while using methods like storing them as environment variables in a.env file can be suitable, a more secure method particularly in a team is to use a secrets manager so developers can avoid ever needing to handle the plain text secret. Subscribe to the channel to get more Tech Tips on Tuesdays (and also other days)

How LDAP is used in Active Directory

The primary protocol employed within Microsoft’s Active Directory(AD) is Lightweight Directory Access Protocol (LDAP). While LDAP serves as a fundamental component in AD, its application extends beyond, enabling user authentication in various tools and client environments. This includes Red Hat Directory Servers on UNIX systems and OpenLDAP, an open-source application used on Windows platforms.

LDAP Authentication, Configuration and Security Hardening - Signing, Binding and Configuring

Lightweight Directory Access Process (LDAP) serves as a user authentication mechanism tailored for directory services. This protocol is commonly employed by applications to retrieve resource data such as user profiles and various system elements. LDAP enables the identification of a client’s attributes with servers such as Active Directory, OpenLDAP, and Open DJ. Introduced in 1993, LDAP version 3 has been the Internet standard for directory services since 1997.

Introducing kntrl: Enhancing CI/CD Security with eBPF

CI/CD pipelines are formed by a series of steps that automate the process of software delivery. They integrate the practices of Continuous Integration (CI) and Continuous Delivery (CD) along with the tools, platforms, and repositories that enable them. Their goal is to simplify, streamline and automate large parts of the software development process.

Detect secrets in Slack channels with GitGUardian

Good news! GitGuardian can now help you find and remediate secrets exposed in Slack channels. You already know us for accurately detecting secrets in your code base. And now, we have extended the real-time detection capability to cover the world's most popular communications platform. Add Slack to your GitGuardian monitored perimeter, and help keep secrets sprawl out of your team communications channels!

Access This Computer From the Network - Best Practices for DC and Member Servers

This policy enables users on the network to establish connections with the computer, and it’s necessary for several network protocols such as Server Message Block (SMB), NetBIOS, Common Internet File System (CIFS), and Component Object Model Plus (COM+).

Breaking: What is Going on with the NVD? Does it Affect Me?

Headed by NIST, an American government institution, the National Vulnerability Database (NVD) contains vulnerability data that’s been key to protecting organizations both within and without the US borders for more than 20 years. Many security policies from both commercial and government organizations require that vendors take care of vulnerabilities of a particular severity as given by the NVD within a certain number of days.

The missing piece in image scanning

In the dynamic landscape of cloud-native cybersecurity, image scanning has become essential to ensuring the safety and integrity of cloud workloads and digital assets. Historically, image scanners focus on finding vulnerabilities (CVEs) that may be the cause of exploits in Kubernetes workloads. However, there’s a significant gap that often goes unnoticed. This gap is the lack of comprehensive scanning for malware, viruses, crypto miners, and other malicious threats.

OWASP Top 10 with OPA/Styra

Among other things, the OWASP organization delivers reports on the Top 10 most prevalent and important security risks for web-based software development. In 2019 they started reporting on the Top 10 API Security risks and refreshed that list in 2023. In this blog we describe how OPA/Styra can help with 9 of the 10 risks, and for each one we rate how impactful OPA/Styra is: Below we detail each of these 10 risks and briefly how to address them with OPA and Styra.