#DevOpsSpeakeasy at #KubeCon EU 2022 with Denis Rosa of Couchbase
Denis Rosa, Developer Advocate Manager at Couchbase, talks about the challenge of external dependencies with continuous integration and delivery
Security | Threat Detection | Cyberattacks | DevSecOps | Compliance
The Latest Cybersecurity News & Insights From Around The World
August 2022
Using Containers Responsibly
Tools to package your applications and services into container images are abound. They’re easier to use and integrate into your CI/CD pipelines now more than ever. We can appreciate these advancements in the form of time savings and decreasing complexity when deploying to a cloud native environment, but we cannot completely ignore the details involved in these technologies. It’s tempting to take simplicity for granted, but sometimes we do this at the expense of keeping our software safe and secure!
FROGBOT : Securing your git repository! What is new!
GitHub Security Alerts! Support for Yarn 2... Frogbot scans every pull request created for security vulnerabilities with JFrog Xray and in version 2.3.2 it even opens pull requests for upgrading vulnerable dependencies to a version with a fix! With Frogbot installed, you can make sure that new pull requests don’t add new security vulnerabilities to your code base alongside them. If they do, the creator of the pull request has the opportunity to change the code before it is merged.
#DevOpsSpeakeasy at #KubeCon EU 2022 with Michael Irwin of Docker
In this interview, Mike Irwin, Engineer Manager at Docker, discusses the release of Docker Desktop for Linux and Docker Extensions, as well as his thoughts on DevSecOps.
CVE-2021-38297 - Analysis of a Go Web Assembly vulnerability
The JFrog Security Research team continuously monitors reported vulnerabilities in open-source software (OSS) to help our customers and the wider community be aware of potential software supply chain security threats and their impact. In doing so, we often notice important trends and key learnings worth highlighting.
#DevOpsSpeakeasy at #KubeCon EU 2022 with James Strong on Supply Chain Security
James Strong, lead solution architect at Chainguard, discusses the challenges of securing software supply chains and recommendations for developers
SATisfying our way into remote code execution in the OPC UA industrial stack
The JFrog Security team recently competed in the Pwn2Own Miami 2022 hacking competition which focuses on Industrial Control Systems (ICS) security. One of our research targets for the competition was the Unified Automation C++-based OPC UA Server SDK. Other than the vulnerabilities we disclosed as part of the pwn2own competition, we managed to find and disclose eight additional vulnerabilities to the vendor. These vulnerabilities were fixed in the SDK in version 1.7.7.
A new generation of OTA updates for Linux devices with Jfrog Connect
Discover how you can update, control, monitor and secure remote Linux & IoT devices, at scale, with the click of a button.
Software Supply Chain Super Heroes: Binary Management Plus Security
Go to any DevOps or security conference today and you’re likely to see “Secure your Software Supply Chain” blazoned across most booths in some form or another. And that’s for good reason. Recent data shows that supply chain attacks have more than doubled in 2021, a trend that is likely to continue. Leading companies are actively rethinking their approach to how to develop and release software.
Black Hat 2022: The CVSS Fallacy - can you trust the world's most popular vulnerability metric?
The NVD defines one of the usages of CVSS as “a factor in prioritization of vulnerability remediation” and it is the current de-facto vulnerability metric, often seen as infallible guidance and a crucial element in many compliance processes. In our session we will go over real-world CVE examples, demonstrating cases and entire categories where CVSSv3.1 falls short of providing an accurate assessment, both due to its design and its various mishandlings. The session will also touch upon specific indicators in the CVE description that can raise the confidence in a CVSS score, and vice versa.
#DevOpsSpeakeasy at #KubeCon EU 2022 with Tom Granot on Developer -Native Observability
In this interview Tom walked us through the importance of devloper native observability and how it can be easily obtained with Lightrun.