Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Security

IBM Z Application Environment Modernization with Sysdig

Recently, IBM announced the IBM Z and Cloud Modernization Center1 for the acceleration of hybrid cloud and to help IBM Z clients accelerate the modernization of their applications, data, and processes in an open hybrid cloud architecture. By combining IBM Z systems built for transactional integrity, throughput, reliability, and availability with hybrid cloud development, IBM is combining the best of both worlds.

Introducing the Netskope Cloud Security Certification Program

Netskope Academy is pleased to introduce the Netskope Cloud Security Certification program. This new program provides an opportunity for customers, partners, and employees to validate their skills and be recognized for their knowledge of the Netskope Security Cloud platform, as well as general cloud security technologies. The program is launching with two levels of high-stakes, third-party proctored certifications, with more to follow.

Tackling NCSC Guidance - Part 2 (Data Security)

In part one of this two-part blog series, we analyzed the UK National Cyber Security Centre’s (NCSC) guidance relating to backups and data protection. Now in this post, we will examine NCSC’s guidance around mitigating malware and ransomware attacks. Recall that NCSC, at present, provides information and practical guidance in various articles on its website rather than formal requirements or regulations.

cr8escape: New Vulnerability in CRI-O Container Engine Discovered by CrowdStrike (CVE-2022-0811)

CrowdStrike’s Cloud Threat Research team discovered a zero-day vulnerability (CVE-2022-0811) in CRI-O (a container runtime engine underpinning Kubernetes). Dubbed “cr8escape,” when invoked, an attacker could escape from a Kubernetes container and gain root access to the host and be able to move anywhere in the cluster.

Detecting and responding to Dirty Pipe with Elastic

In recent days, several security vendors have published blogs about the Linux-based exploitation (CVE-2022-0847), also known as Dirty Pipe. The Elastic Security Research team is sharing the first detailed research to help organizations find and alert on the exploitation with Elastic Security products. We are releasing this research so that users can defend themselves, since very little information has been shared on the actual detection of exploitation attempts.

Tools for infrastructure drift detection

Predicting infrastructure drift is like predicting snowfall in winter… you know it will happen at some point but you can’t predict exactly when. And just like snowfall, having a way to detect it as early as possible is what will make you the most prepared and your infrastructure more secure! In this article, we’ll explore the principles of drift detection, the different kinds of drift and why they happen, and tools to help detect drift with a simple example.

Purple Team Exercises: Preparing a Cybersecurity Team for a Red Team Attack

This is the second in a series of blogs that describes the importance and inner workings of conducting Red and Purple Team exercises. Part 1 of this blog series gave an overview of how to properly conduct these drills. This blog examines the role Purple Teams play in an effective security testing strategy.

Veracode Announces Significant Growth Investment From TA Associates

I am pleased to share the exciting news that TA Associates (“TA”), a leading global growth equity firm, has signed an agreement to make a strategic growth investment in Veracode, taking a majority equity position in the business. Thoma Bravo will also continue to be an investor alongside TA. This new partnership is forming at a critical moment in the evolution of the software security market.

How to build collaboration across security and DevOps teams-and why it's business critical

For security and DevOps teams, staying a step ahead of the competition comes down to staying in lockstep with each other. Whether that competition takes the form of a threat actor lurking on a network or a rival company taking new products to market, collaboration can help security and DevOps teams better protect their organizations and develop innovative technology solutions.