Security Leftovers
-
OpenSSF Outlook Q3 2023: Continuing to Strengthen the Open Source Ecosystem
Join us for a conversation with new OpenSSF General Manager, Omkhar Arasaratnam, veteran cybersecurity and technical risk management executive with more than 25 years of experience leading global organizations. In this Q&A, Omkhar covers everything from the challenges he foresees in his role to what he thinks is the most important factor to keep in mind that affects the future of the open source community.
-
Google toys with internet air-gap for some staff PCs
In a bid to shrink the attack surface of its army of employees, and thus boost security, Google is taking an experimental approach: cutting some of their workstations off from the internet.
The Chocolate Factory has seen fit to sever staffers' links to the outside electronic world, admittedly on a small scale, according to internal documents viewed by CNBC. Roughly 2,500 Googlers were selected for the internet air-gap trial, and then following some feedback the search giant adjusted it so that people can opt out and others can volunteer.
The Register was able to confirm the pilot program with Google, which told us it was being limited to fewer than two percent of workstations. Those who choose to participate will have their general internet access removed along with root privileges on their individual boxes if they had that.
-
More Software Projects need Defenses of Design
I was gonna write an rant about the potential probabilistic model checking, then realized I needed to look at projects besides PRISM and STORM. Then I checked out simpy and saw it had a Defense of Design (DoD):
This document explains why SimPy is designed the way it is and how its design evolved over time.
-
Exploit Attempts for "Stagil navigation for Jira Menus & Themes" CVE-2023-26255 and CVE-2023-26256, (Tue, Jul 18th)
Today, I noticed the following URL on our "first seen URLs" page:
-
67% of daily security alerts overwhelm SOC analysts - Help Net Security
While the majority of SOC analysts consider their tools effective, they express concerns about missing important security events.