Prisma Clud

SEPTEMBER 14, 2023

Learn how a novel attack vector in GitHub Actions allows attackers to distribute malware across repositories using a technique that exploits the actions dependency tree and puts countless open-source projects and internal repositories at risk.

Malware 144

Malware Open Source Research Software 144

Prisma Clud

AUGUST 30, 2023

As we discussed in the previous blog post, Third-Party GitHub Actions: Effects of an Opt-Out Permission Model , the permissive nature of GitHub Actions workflows is prevalent throughout the open-source community and private projects on GitHub. Figure 1: GitHub Actions workflow consumes a secure, pinned version of a third-party action.

Software Review 98

Software Review Systems Review Open Source Resources 98

Prisma Clud

JANUARY 17, 2023

Avoiding secrets exposure is critical, but is not always easy. Secrets can hide anywhere — in infrastructure as code (IaC) and application code files, repo config files, delivery pipeline config files and more — and if those files become public, for whatever reason, those secrets can fall into the wrong hands.

Weak Development Team 52

Weak Development Team Firewall Applications Authentication 52

Prisma Clud

JANUARY 10, 2023

You’ve decided to shift your cloud security left. You researched vendors, evaluated solutions, did a proof of concept and now you’re off the IaC security races. You know what your efficient, secure-by-default future holds, but how do you get there? Path 3 enables the most complete adoption of IaC security.

Programming 52

Programming Development Team Review Software Review Policies 52

Palo Alto Networks

OCTOBER 9, 2020

I propose that there are three fundamental and concrete practices DevOps and security teams can adopt to add security into the CI/CD pipeline and secure critical applications, involving: Infrastructure-as-Code (IaC). DevOps Teams Do Not Need to Be Security Experts. Security Teams Require a Trust-But-Verify Posture.

DevOps 96

DevOps Software Review Compliance Technical Review 96

Prisma Clud

DECEMBER 13, 2022

Developers use secrets to enable their applications to securely communicate with other services. Unfortunately, version control systems (VCS) like GitHub are not secure, which creates potential exposures that can be exploited. If the repo is made public, threat actors can easily find and use the secrets in their attack path.

Policies 97

Policies Cloud Internet Development 97