Security: Outsourced Computing, OpenSSF, Istio, and More

posted by Roy Schestowitz on Dec 14, 2023

• Federal News Network ☛ CISA releases new tools to help agencies secure Gmail, other Surveillance Giant Google applications [Ed: Better to avoid them instead]

  The addition of security baselines for Surveillance Giant Google Workspace products comes after CISA already released baseline configurations for Abusive Monopolist Microsoft 365.

• Scoop News Group ☛ CISA unveils Surveillance Giant Google Workspace guidelines informed by Chinese breach of Microsoft

  The cyber agency wants feedback on rules that aim to prevent a repeat of an incident in which China-based hackers stole sensitive emails.

• OpenSSF (Linux Foundation) ☛ OpenSSF End Users Working Group: Representing the Interests of Open Source Software Consumers

  This month’s spotlight focuses on the OpenSSF End Users Working Group, which aims to ensure that the distinct and impactful voice of end users is heard in the development and delivery of the technical vision of The Open Source Security Foundation (OpenSSF). It represents the interests of public and private sector organizations that primarily consume open source rather than produce it.

• ISTIO-SECURITY-2023-005

  All releases prior to 1.18.0
  1.18.0 to 1.18.5
  1.19.0 to 1.19.4
  1.20.0
  

  The Istio Security Committee were recently made aware of a potential scenario where the Istio CNI could be used as an attack vector on an already compromised node due to its high level of permissions. The vector involves abusing the istio-cni-repair-role ClusterRole on a compromised node to expand the scope of the compromise from local to the node to a cluster-wide compromise.

  The Istio maintainers are, therefore, gradually rolling out a change to the above ClusterRole that reduces the permissions to close this potential attack vector. In the patched versions, roles are limited to the bare minimum requirements based on the repair mode selected. Previously, regardless of the configuration all roles were granted, and the roles that were granted were excessive.

• Announcing Istio 1.20.1

  This release implements the security updates described in our Dec 12th post, ISTIO-SECURITY-2023-005 along with bug fixes to improve robustness.

  This release note describes what’s different between Istio 1.20.0 and 1.20.1.

• Announcing Istio 1.19.5

  This release implements the security updates described in our Dec 12th post, ISTIO-SECURITY-2023-005 along with bug fixes to improve robustness.

• Announcing Istio 1.18.6

  This release implements the security updates described in our Dec 12th post, ISTIO-SECURITY-2023-005 along with bug fixes to improve robustness.

  This release note describes what’s different between Istio 1.18.5 and 1.18.6. This is the last planned release for Istio 1.18, for more details see our Nov 29th end of support announcement.