Introducing the newest member of the JFrog ecosystem team – Frogbot. This new git bot tool works for you by protecting your git projects, as they are being developed, from security vulnerabilities. Register for my talk “Bots to Protect your Source Code” swampUP 2022.
For the month of April, we are kicking off a series of posts here at Rezilion to celebrate our new partnership with GitLab. Our theme is: Secure it. Ship it. Why? Because the GitLab CI and Rezilion partnership is the answer to meet the needs and demands of modern developers and security teams who want to both innovate quickly and ensure the products they create are secure.
Guest Blog by Daniel Parmenvik – CEO of bytesafe.dev For many, Software Bill of Materials (SBOMs) have changed from a manual list of assets for due diligence procedures to become an integral and automated part of software development. The ever increasing appetite for open-source software translates into a need to keep track of software assets (or open-source dependencies) for all applications, at any given point in time.
In a key step to resolve the longstanding tension between developers and security teams, Rezilion and GitLab are partnering on an important integration to address those needs. This integration helps developers detect and remediate vulnerabilities early on in the development without adding extra work and steps and release products quickly and securely. Deployed in minutes, Rezilion’s DevSecOps platform is now natively integrated with GitLab CI.
1Password now includes full support for SSH keys, providing the easiest and most secure way for developers to manage SSH keys and use Git in their daily workflow.
Another day, another cloud service leaking personal data because of a misconfiguration. And before you jump to any conclusions, no, it’s not a leaky bucket on AWS S3 or a public blob on Microsoft Azure… The culprit is, once again, GitHub, where an open-source hardware manufacturer has inadvertently left exposed a private-to-public repository that “could have enabled unauthorized access to information about certain user accounts on or before 2019.”
State-sponsored threat actors continue to exploit legitimate cloud services. In their latest campaign, uncovered by Malwarebytes during January 2022, the North Korean group Lazarus (AKA HIDDEN COBRA) has been carrying out spear phishing attacks, delivering a malicious document masquerading as a job opportunity from Lockheed Martin (37% of malware is now delivered via Office documents).
