Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

DevOps

Kerberos Tickets and Authentication in Active Directory

Kerberos is an authentication protocol. It is designed for client-server applications and requires mutual verification. Kerberos, the default protocol used for logging into a Windows machine that is part of a domain, relies on a secure communication channel between the client and the Domain Controller (DC). Windows updates address security concerns such as vulnerabilities in this channel, ensuring that the user database stored on the DC is protected.

A Guide to Standard SBOM Formats

The software bill of materials (SBOM) has become an increasingly important tool for providing much-needed clarity about the components that make up software — both for application security purposes and governmental compliance. Unlike manual spreadsheets, SBOMs standardize everything into a particular format to minimize inconsistencies. There are three primary SBOM formats currently available, which allow companies to easily generate, share, and consume SBOM data.

A developer's guide to implementing Policy as Code

In 2022, the adoption of infrastructure as code (IaC) soared, with IaC domain specific languages like HCL, Shell and GoLang gaining popularity and momentum across the open source tools ecosystem. In fact, the rise of Policy as Code is the result of a new paradigm blurring the lines between IT, legal and R&D departments – everything as code. But what do developers have to do with compliance and infrastructure provisioning? What does PaC entail, and what types of PaC are there?

TFiR Let's Talk! Recovery of Velero Backups to AKS & EKS

Sebastian Glab, Cloud Architect at CloudCasa, shows you how CloudCasa for Velero allows Velero users to manage their cluster using our software as a service platform. By plugging directly into Velero, CloudCasa provides user friendly, intuitive UI for Kubernetes cluster management utilizing Velero as the backup tool. Users can centrally manage their current backups and configuration across multiple clusters and cloud providers (AKS, EKS and GKE) in one place. They don't have to jump across different environments, access different clusters to see what's going on, they can simply go to Cloud Casa, and manage everything from there.

Curating Open source Libraries on JFrog Platform, part II.

Software supply chain security has been the most widely discussed topic for anyone who is writing applications utilizing the majority of open-source or third-party libraries. This webinar will showcase JFrog Platform's abilities to curate and compose workflows to help isolate libraries that have vulnerabilities and promote libraries to repositories that can be safely used. This webinar will also demonstrate self-service curation workflows.

RSA Conference 2023: Key Takeaways From Our Five Favorite Sessions

RSA 2023 is a wrap, but that doesn’t mean we are finished with the annual event. Sharing information, success stories, and lessons learned lies at the heart of RSA. And after a week of talking to attendees and pundits, giving demos, and gleaning knowledge from a slew of sessions, it’s going to take some time to sort through all the treasure from that trove of knowledge. For starters, here are a few of the more noteworthy sessions we saw at the show.

Apache Superset RCE Vulnerability CVE-2023-27524 Highlights Ongoing Issues with Flask AppBuilder, Joining List of Previously Discovered CVEs

On Apr 24, 2023 Naveen Sunkavally, Chief Architect at Horizon3.ai, announced the discovery of a new vulnerability, CVE-2023-27524, in Apache Superset and wrote comprehensively about the whole process. The vulnerability was caused by an insecure default configuration in the application. This is not the first time this type of vulnerability has been found in similar applications.