Microsoft GitHub and Windows TCO
-
TechRadar ☛ A GitHub token leak could have put the entire Python language at risk
What if the Python programming language itself was malicious? It would be the most devastating supply chain attack in human history - but it almost happened after an important GitHub token was accidentally leaked.
Cybersecurity researchers from JFrog recently discovered a GitHub Personal Access Token in a public Docker container hosted on Docker Hub, which granted elevated access to the GitHub repositories of the Python language, Python Package Index (PyPI), and the Python Software Foundation (PSF).
-
Federal News Network ☛ Government IT systems in the hands of a single vendor puts agencies at risk
The Center for Cybersecurity Policy and Law (CCPL) wanted to look at this question of concentration risk. In order to provide both sides of the picture, CCPL conducted a real-time tabletop exercise in April that saw a group of security experts simulating an attack against two fictional U.S. agencies with varying degrees of IT concentration and diversity. The intent of the exercise was to investigate how these differently constructed systems, between the two government agency targets, influenced the actions, successes and failures of the adversarial team testing such networks. This exercise enables cybersecurity professionals to test their defenses, and similar exercises have been conducted by both government and industry.
-
The Record ☛ Columbus investigating potential data leak after ransomware attack
The government of Columbus, Ohio said it is aware of claims made by a ransomware gang that troves of sensitive city information are available for sale.
The Rhysida ransomware group took credit on Wednesday for the July 18 , threatening to leak 6.5 terabytes of exfiltrated information from the city’s systems allegedly containing emergency services data, access to city cameras and more.
-
Mat Duggan ☛ Teaching to the Test. Why It Security Audits Aren’t Making Stuff Safer
The better question is what was the forcing mechanism that convinced every corporation in the world that it was a good idea to install software like this on every single machine? Why is there such a cottage industry of companies that are effectively undermining Operating System security with the argument that they are doing more "advanced" security features and allowing (often unqualified) security and IT departments to make fundamental changes to things like TLS encryption and basic OS functionality? How did all these smart people let a random company push updates to everyone on Earth with zero control? The justification often give is "to pass the audit".