Remove tag secrets-security
article thumbnail

The GitHub Actions Worm: Compromising GitHub Repositories Through the Actions Dependency Tree

Prisma Clud

Get an in-depth look at the attack vectors, technical details and a real-world demo in this blog post highlighting our latest research. The payload tries to steal secrets or create a reverse shell, whether running in pipelines or production environments. Is the GITHUB_TOKEN as accessible as other secrets? We’ll soon find out.

Malware 144
article thumbnail

Cybersecurity Snapshot: CISA Says Midnight Blizzard Swiped U.S. Gov’t Emails During Microsoft Hack, Tells Fed Agencies To Take Immediate Action

Tenable

And the NSA is sharing best practices for data security. Cybersecurity and Infrastructure Security Agency (CISA) in its Emergency Directive 24-02 , sent to federal civilian agencies last week and made public this week. Already, 22% of polled organizations use generative AI for security. And much more!

Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

Trending Sources

article thumbnail

Strengthening the Nessus Software Supply Chain with SLSA

Tenable

But sometimes we like to give you a peek behind the curtain to share how we protect our own house against cyberattacks – and that’s what this blog is about. Today we’re sharing our experience adopting the supply-chain security framework SLSA, with the hopes that the lessons we learned will be helpful to you. What is SLSA?

article thumbnail

Unpinnable Actions: How Malicious Code Can Sneak into Your GitHub Actions Workflows

Prisma Clud

As we discussed in the previous blog post, Third-Party GitHub Actions: Effects of an Opt-Out Permission Model , the permissive nature of GitHub Actions workflows is prevalent throughout the open-source community and private projects on GitHub. Figure 1: GitHub Actions workflow consumes a secure, pinned version of a third-party action.

article thumbnail

How to make your web application more secure by using Interactive Application Security Testing (IAST) – PART 3 of Application Security Testing series

Xebia

Introduction Welcome to part three of the blog series about Application Security Testing. In part one of this series, we looked at Static Application Security Testing (SAST) and in part two at Dynamic Application Security Testing (DAST). First a brief explanation is given about IAST. This is done via an agent.

article thumbnail

Share secrets with standalone projects with project context restrictions

CircleCI

In this blog post, we hope to explain the value of this feature and how it can be used to further secure your workflows. Contexts provide a mechanism for securing and sharing environment variables across projects. Without restrictions, secrets stored in contexts are shared organization-wide by default. What’s next?

Groups 52
article thumbnail

Shifting Left with Feature Flags and Bug Bounty Programs

LaunchDarkly

In this blog post, we’re going to cover a method to reduce your risk exposure by leveraging feature flags and your existing bug bounty program. Companies are now the shepherds of an ever-growing inventory of personal data, sensitive secrets, and business-critical services. The application security funnel.