Australian Signals Directorate’s Post

CISA and Partners Release Guidance for Exploring Memory Safety in Critical Open Source Projects: Today, CISA, in partnership with the Federal Bureau of Investigation, Australian Signals Directorate’s Australian Cyber Security Centre, and Canadian Cyber Security Center, released Exploring Memory Safety in Critical Open Source Projects. This guidance was crafted to provide organizations with findings on the scale of memory safety risk in selected open source software (OSS). This joint guidance builds on the guide The Case for Memory Safe Roadmaps by providing a starting point for software manufacturers to create memory safe roadmaps, including plans to address memory safety in external dependencies which commonly include OSS. Exploring Memory Safety in Critical Open Source Projects also aligns with the 2023 National Cybersecurity Strategy and corresponding implementation plan, which discusses investing in memory safety and collaborating with the open source community—including the establishment of the interagency Open Source Software Security Initiative (OS3I) and investment in memory-safe programming languages. CISA encourages all organizations and software manufacturers to review the methodology and results found in the guidance to: * Reduce memory safety vulnerabilities; * Make secure and informed choices; * Understand the memory-unsafety risk in OSS; * Evaluate approaches to reducing this risk; and * Continue efforts to drive risk-reducing action by software manufacturers. To learn more about taking a top-down approach to developing secure products, visit CISA’s Secure by Design webpage. https://lnkd.in/g3YfxJHr

Open-source forms the bedrock of contemporary digital frameworks, offering openly accessible source code for public collaboration. While this fosters rapid innovation and widespread use, it also brings distinct security challenges. The transparent nature of open-source can inadvertently reveal security gaps, potentially inviting malicious attacks. https://lnkd.in/gTfpVGEB

on 26 June 2024, CISA, in partnership with the Federal Bureau of Investigation, Australian Signals Directorate’s Australian Cyber Security Centre, and Canadian Cyber Security Center, released Exploring Memory Safety in Critical Open Source Projects. This guidance was crafted to provide organizations with findings on the scale of memory safety risk in selected open source software (OSS). This joint guidance builds on the guide The Case for Memory Safe Roadmaps by providing a starting point for software manufacturers to create memory safe roadmaps, including plans to address memory safety in external dependencies which commonly include OSS. Exploring Memory Safety in Critical Open Source Projects also aligns with the 2023 National Cybersecurity Strategy and corresponding implementation plan, which discusses investing in memory safety and collaborating with the open source community—including the establishment of the interagency Open Source Software Security Initiative (OS3I) and investment in memory-safe programming languages. CISA encourages all organizations and software manufacturers to review the methodology and results found in the guidance to: - Reduce memory safety vulnerabilities; - Make secure and informed choices; - Understand the memory-unsafety risk in OSS; - Evaluate approaches to reducing this risk; and - Continue efforts to drive risk-reducing action by software manufacturers.

Wireshark 4.4.1 Released, What’s new!: Wireshark, the world’s leading network protocol analyzer, has just released version 4.4.1, bringing a host of bug fixes and updates to enhance user experience and functionality. Hosted by the Wireshark Foundation, this tool is indispensable for troubleshooting, analysis, development, and education in network protocol analysis. Here’s a detailed look at what’s new in this release. […] The post Wireshark 4.4.1 Released, What’s new! appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

CISA's Open Source Software Security Summit marked a significant stride in fortifying the security of the open source ecosystem. The event, highlighting OSS's essential role in today's technology and addressing vulnerabilities like Log4Shell, brought together key leaders and community representatives. Initiatives announced include collaborations for security framework implementations, enhanced information sharing, and the publication of exercise materials to benefit the wider community. Support from the Rust Foundation, Python Software Foundation, and npm exemplifies the industry's unified effort to bolster OSS security. The summit not only emphasized OSS's importance for national security and innovation but also garnered praise for its collaborative approach to risk mitigation. This aligns with federal endeavors to improve global cyber resilience and safeguard essential infrastructures, showcasing a deep commitment to securing open source software. #opensourcesoftware #riskmitigation #cyberresilience #safeguard

A new CISA report reveals that 52% of critical #opensource projects contain memory-unsafe code, posing potential security risks. This finding is particularly concerning given recent hijacking attempts on major open-source tools, highlighting the need for increased vigilance in the open-source community. The full scoop is here: https://ow.ly/3s0w30sERE3

🎓🎓 #RomHack2024 #Training https://lnkd.in/dd2pakDX 🎓🎓  From 24 to 27 September 2024 in Rome 🔗 If you’re planning to attend, it's probably a good idea to secure your spot at an early-bird price (10% off) 😉. https://lnkd.in/dd2pakDX - Steven Seeley: “Master of Pwn” in Pwn2Own 2020 and known for his long track record of 0 days, Steven's session on “Full Stack Web Attack” is a must for anyone looking to understand the intricate layers of web vulnerabilities. Richard Johnson: Known for his deep dive into software security, reverse engineering and fuzzing, Richard's “Advanced Fuzzing and Crash Analysis” is a treasure trove for security researchers willing to sharpen their fuzzing skills. Silvio La Porta, PhD and Antonio Villani: Their combined expertise in “EDR: The Great Escape” promises to unveil cutting-edge strategies to bypass endpoint security products. John I.: A renowned figure in network security, John's “Advanced Active Directory Exploitation” is set to be a masterclass in directory services vulnerabilities. - Pedro Ribeiro and Radek Domanski: Part of the Flashback team at Pwn2Own, Pedro and Radek's session on “Hunting Zero-Days in Embedded Devices” is an unmissable opportunity for those interested in hardware and embedded system security. - Andrey Konovalov: Author of the famous tool “syzkaller”, and leading authority on Linux security, Andrey’s “Exploiting the Linux Kernel” session is poised to be a deep dive into Linux Kernel Exploitation techniques. 🚀 Each of these sessions is set to be a mind-blowing experience. Don't miss this opportunity to learn from the best in the field. #CyberSecurityExperts #LearnFromTheBest #CyberSecurityTraining

Hey Connections! I've written a blog post discussing Memory Safe Languages, outlining their importance in mitigating memory-related vulnerabilities and improving software security. 🔍 Key highlights include: 1. Understanding the risks associated with memory-related vulnerabilities in C and C++. 2. Exploring the features and benefits of Memory Safe Languages. 3. Discussing the implications of adopting #MSLs for cybersecurity professionals and organizations. This blog might be helpful for both cybersecurity enthusiasts and developers interested in implementing a "secure by design" architecture. 📖 Read the full article here: https://lnkd.in/dw4VvGsZ I'd love to hear your thoughts and insights on this topic. Feel free to share your feedback in the comments section!

Tackling cybersecurity vulnerabilities through Secure by Design Our new report — Secure by Design at Google — outlines our principles and approaches for strengthening security through a process that implements software security from the beginning of the design phase, onward. #ukmanufacturing #shoutaboutukmfg #supportukmfg https://lnkd.in/e_c8g-3T

A new CISA report reveals that 52% of critical #opensource projects contain memory-unsafe code, posing potential security risks. This finding is particularly concerning given recent hijacking attempts on major open-source tools, highlighting the need for increased vigilance in the open-source community. The full scoop is here: https://ow.ly/8lOE30sEGMs