Sign in Subscribe

Topic

Cybersecurity

A collection of 17 issues

We May Never Be Rid of Log4J. It Was, and Still Is, an Endemic Vulnerability. It’s the Long Tail That Is Concerning.

Log4J has a long tail. About 38% of Java applications are still vulnerable. Traces of exploit attempts are increasing across the Internet. CISA said that the Log4J vulnerability would be a long living and persistent one, and it is.

The Cybersecurity Attack Surface Is Getting Bigger and Bigger. We’ve Been Going Through a Mega-Evolution. It’s a Hypersurface Now.

We've invented and evolved thousands of computational thingamawhatsits to deploy applications with, and combined them in billions of permutations...then we need to build the cybersecurity around them. It's worth it to take a moment, step back, and ponder that.

Memory Safe Languages: Does Just Bossing around Developers Work (From a Security Perspective?)

One of the smartest computer security people around (not me) asks if we can just keep piling work on developers, including things like rewriting everything in memory-safe languages.

A Look at NIST 800-204D: Strategies for the Integration of Software Supply Chain Security in DevSecOps CI/CD Pipelines

At this point, the name Solarwinds has become almost synonymous with the idea of a Software Supply Chain (SSC) attack. And now, a few years after this particular attack, we have some recommendations from NIST on how to secure the systems that build and update software products.

Cyber Deterrence

We've long been under the global spectre of MAD, mutually assured destruction, but that's only one model of deterrence. We also need to examine what deterrence means in the context of cybersecurity.

In Linux Everything Is a File. In Threat Detection, Everything Is a Stream.

To detect threats, we need to look at all the events that occur across our infrastructure. The open-source Falco project has historically looked at system calls but can also analyze any streaming log file, such as those provided by cloud and SaaS platforms.

Cybersecurity, Safety Barriers, and Secure by Default

Rarely are systems secure out of the box; in fact, quite the opposite, most of the time we turn off every possible security feature or setting in the desire for expediency.