Josh Ewing

🚨 CISA Alert: Urgent Update Needed for Apache Flink Vulnerability A critical vulnerability (CVE-2020-17519) has been added to the CISA Known Exploited Vulnerabilities Catalog. Ensure your systems are secure by updating to the latest versions. 👇 Learn more: https://lnkd.in/e29Bx-Bj --- #TuxCare #linux #cybersecurity #opensource #technology #ransomware #linuxsecurity #software #hacking #devops #privacy

11

🌟 Exciting News! LeakSignal's Elijah Lord will be speaking at LambdaConf 2024 in Colorado on May 6th. Join us as we unveil several critical vulnerabilities within AWS Lambda's Layer plugin system that pose significant security risks - potentially allowing attackers to conduct Man-In-The-Middle (MITM) attacks, manipulate function memory, and compromise sensitive information. Topics covered: ✔️ The methodology used to identify and exploit this vulnerability ✔️ Strategies for its mitigation and security best practices to protect against such vulnerabilities ✔️ How we repurposed these same techniques for enhancing security measures to monitor and filter traffic to and from a Lambda function You won't want to miss this insightful talk - register below if you haven't already! Get conference tickets: https://lnkd.in/g5GQJeGY Learn more: https://lnkd.in/gwd9Xkgr #Lambdaconf2024 #cybersecurity #serverless #datasecurity

10

1 Comment

🚨 Threat Alert: CUPS - A Critical 9.9 Linux Vulnerability Reviewed 🚨 There’s been a lot of concern about a recent critical Linux vulnerability in the Common UNIX Printing System (CUPS). While it may sound alarming, our Aqua Nautilus researchers found that several preconditions need to be met for this vulnerability to be exploited. In our latest blog, we break down the details, offer steps to detect potential exposure, and guide you through simple mitigation strategies. 🔍 What's Inside: • A current overview of the CUPS vulnerabilities and their conditions. • Steps to check if your system is at risk. • How Aqua can help block and identify non-compliant hosts using our Enforcer and Runtime Policies. Stay informed and protected by diving into the full analysis from our researchers. ➡️ https://lnkd.in/eynb_4w8 ⚠️ CUPS Vulnerability (CVE-2024-47076, CVE-2024-47175, CVE-2024-47176, CVE-2024-47177) #threatalert #aquanautilus #threatresearch

37

1 Comment

*brays loudly* Howdy, code wranglers! It's time for another rootin' tootin' Technical Tuesday! Today, we're gonna mosey on down to the SAST corral and see how them Static Application Security Testing tools work their magic. Now, for you greenhorns out there, SAST is like havin' a real persnickety ranch hand look over your code without actually runnin' it. It's checkin' for them pesky security varmints hiding in plain sight! So how do these SAST tools work? Well, saddle up and let me break it down for ya: 1. Code Parsing: First off, the SAST tool takes your code and turns it into something it can understand - like translatin' donkey brays into human speak. It creates what we call an Abstract Syntax Tree (AST). 2. Pattern Matching: Then, faster than a jackrabbit on a hot griddle, it starts lookin' for patterns that match known security issues. It's like spotting a wolf in sheep's clothing! 3. Data Flow Analysis: This here's where it gets real fancy. The tool follows your data as it flows through the code, looking for places where bad input could cause a ruckus. 4. Control Flow Analysis: It also checks how your code moves from one part to another, makin' sure there ain't no sneaky backdoors or loops that could cause trouble. 5. Configuration Check: Last but not least, it takes a gander at your config files to make sure you ain't left the barn door open, so to speak. Once it's done, it'll spit out a report faster than a spooked mustang, tellin' you where all the potential security holes are. Now, SAST ain't perfect - it can sometimes cry wolf or miss some crafty varmints. But it's a mighty fine first line of defense in your code security roundup! So there you have it, folks! Next time you're fixin' to run a SAST scan, you'll know just what that tool is doing under the hood. Keep your code secure, and your debuggers debuggin'! YEE-HAW! #TechnicalTuesday #SAST #ApplicationSecurity #InfosecDonkey

12

Andrew Ng’s take on California's proposed law SB-1047 is spot on: “There are many things wrong with this bill, but I’d like to focus here on just one: It defines an unreasonable “hazardous capability” designation that may make builders of large AI models potentially liable if someone uses their models to do something that exceeds the bill’s definition of harm (such as causing $500 million in damage). That is practically impossible for any AI builder to ensure. If the bill is passed in its present form, it will stifle AI model builders, especially open source developers. Some AI applications, for example in healthcare, are risky. But as I wrote previously, regulators should regulate applications rather than technology. Technology refers to tools that can be applied in many ways to solve various problems.Applications are specific implementations of technologies designed to meet particular customer needs. Safety is a property of applications, not a property of technologies (or models), as Arvind Narayanan and Sayash Kapoor have pointed out. Whether a blender is a safe one can’t be determined by examining the electric motor. A similar argument holds for AI.” #publicpolicy #policy #ai #machinelearning #ml #compliance #technology #society #sb1047 #opensourcesoftware #oss

4

Are you ramping up a threat modeling practice? No matter if you're new to threat modeling or are an expereinced pro, this guide is full of practical advice to support your efforts. 🔗 https://hubs.ly/Q02MZ26n0

6

2 Comments

When chaos strikes, you need a game plan—this is where incident response plans enter the chat! We breakdown developing an incident response plan here: https://hubs.la/Q02VZV-x0

5

🚨 Check out this live demo where we show how an attacker tries to move laterally (using remote PowerShell, PsExec, etc.), but is then detected, alerted, and stopped by Silverfort and SentinelOne working together: https://lnkd.in/ereRFh7Z 💥 #CyberSecurity #WeAreExclusive #Silverfort #SentinelOne

4

What You’ll See from SENTRA Every Week 🗓️ Hey everyone! As we get started, I wanted to let you know what you can expect from us here at SENTRA. We’re all about making cybersecurity simple, approachable, and (hopefully) a bit more interesting. Here’s how we’re planning to keep your feed fresh every week: ➡ Monday: Busting some of the biggest cybersecurity myths—because let’s be honest, there’s a lot of bad advice out there. ➡ Tuesday: Breaking down the latest tech and security news, so you’re always ahead of the game. ➡ Wednesday: A behind-the-scenes look at SENTRA—who we are, what we care about, and why we’re doing this. ➡ Thursday: A deep dive into the tech world—exploring the trends and challenges shaping how we work, build, and innovate in the Cyber landscape ➡ Friday: Sharing real stories—successes, lessons learned, and examples of what great cybersecurity can look like in action. Follow along, join the conversation, and let’s make cybersecurity one less thing to stress about. #WhySENTRA #CybersecurityMadeSimple #ScalingSecurely #TechTrends #SENTRACommunity

20

5 Comments

Pentesting has crazy burnout. Day in, day out - you’re presented with new systems, each with their complex business logic, bespoke configuration, sets of technologies, and insane time pressures to learn, plan, attack, exploit, cleanup, report, communicate and present - sometimes within only few days! Add on top of that, people can be unwilling and hostile towards pentesters who are meant to be the good guys. Why anyone wants to be a pentester is beyond me 🤷‍♂️

26

2 Comments

I only just started following Dan Goldin and really found this morning post insightful and appreciative of the team effort. However, while I agree that deep tech success requires a team effort, I’d add that while I’ve worked with non-technical superstar team members, the best storytellers and community builders, in my experience, often aren’t “non-technical”. To empathize with a technical audience, you need to understand their challenges and speak their language, and that takes real technical capacity. The most compelling stories often come from those who’ve lived the pain points — and can translate them into relatable narratives that resonate with both builders and decision-makers. It’s a unique blend of technical capability, creative communication and sometimes that shared imposter complex that drives trust and connection.

2

Should threat modeling be left solely to the security team? We don't think so! Recently, Tanya Janca joined 😷 Adam Shostack, Izar Tarandach 🎗️ and Jason McDonald to discuss threat modeling for developers. Watch the full episode here: https://lnkd.in/grQFgAiZ CC: OWASP® Foundation

14

🛠️ Developers, are you drowning in false positives from vulnerability scans? Learn how to cut through the noise and secure your open-source code effectively. Join us tomorrow, September 18 at 10 AM PT for actionable insights with Katie Kent and Cullen Harwood. 💡📉 Register here: https://lnkd.in/gMyrWUN3 #CodeSecurity #Semgrep #applicationsecurity

9

Chromium issues a quality ultimatum. In the most recent CA/Browser Forum face-to-face meeting, the Google Chrome root program gave a presentation clearly defining its expectations for quality of incident reporting from CAs with an eye to where many CAs have been failing. Jason Soroko and I relate Chromium's statements and their significance. #pki #security #ssl #cabf https://lnkd.in/ghYPCshs

19

1 Comment

Many infosec folks have been clamoring for this for a long time: vulnerability reporting from AWS! https://lnkd.in/ehbhXrcP "The Amazon CNA will issue CVEs that support customers in addressing valid security vulnerabilities" "Remediation... requires customer action, including making a risk-based decision on handling the remediation (OR customers need to assess possible impact) OR when a valid security vulnerability will become public" Devil is in the details... but this seems helpful.

5