DevOps.com

JULY 14, 2022

One of the leading operational issues DevOps teams encounter is permission issues. […]. The post Resolving CI/CD Permissions Issues to Address Delivery Needs appeared first on DevOps.com. Operational hurdles are all too common in DevOps pipelines, leading to miscommunication between team members and the broader organization.

DevOps 99

DevOps Organization Cloud 99

DevOps.com

MAY 16, 2022

Development teams want a frictionless path to deploy new code but often struggle with access permissions that are linked to services. The post Why Over-Permissive CI/CD Pipelines are an Unnecessary Evil appeared first on DevOps.com. This is no different in modern DevOps.

DevOps 120

DevOps Software Development Innovation Development 120

David Heinemeier Hansson

JANUARY 6, 2024

The freedom to make our own choices, good or bad, without ever having to ask anyone for permission. But do you hold your ability to pick the software it runs in such low regard that you’re scared of doing so without a master like Apple telling you what’s permissible? It’s why we’ve built our business on the web. Yeah, me too.

Software Review 83

Software Review Internet Software Guidelines 83

Aqua Security

JUNE 20, 2022

We learned about a bug in GitHub that for about five days at the end of February allowed connected GitHub third-party applications to generate new scoped installation tokens with elevated permissions.

Windows 126

Windows Examples Applications Data 126

Invid Group

APRIL 28, 2021

How SharePoint works: Search and Permissions BY: NEISHA SANTIAGO Yes, You Can Control Who Sees Your Documents. If you have run a traditional intranet server in the past, you probably have run into the pain of managing permissions. With SharePoint permissions, you can precisely control who sees your documents!

Groups 83

Groups Resources Examples Company 83

CTOvision

JUNE 24, 2020

Read Raj Mallempati explain the cloud permissions management on Dark Reading : By using the AAA permissions management framework for cloud operations, organizations can address authentication, authorization, and auditing. As […].

Cloud 103

Cloud Authentication Organization 103

Netflix Tech

MARCH 10, 2021

ConsoleMe: A Central Control Plane for AWS Permissions and Access By Curtis Castrapel , Patrick Sanders , and Hee Won Kim At AWS re:Invent 2020, we open sourced two new tools for managing multi-account AWS permissions and access. They are the one-stop-shop for cloud permissions and access. This happened for us at Netflix.

AWS 100

AWS Policies Resources Software Review 100

DevOps.com

AUGUST 29, 2021

The post Popular iOS Apps Request Excessive User Data Permissions appeared first on DevOps.com. Many users are quick to allow access to personal information without hesitation. However, in recent years, it’s become apparent that many apps are […].

Data 110

Data Architecture Applications Performance 110

Prisma Clud

AUGUST 16, 2023

In this post, we share how the world’s most popular repositories fail to manage their build permissions and walk you through the why and the how of proper permissions management in GitHub Actions. Action’s Permissions When a workflow runs, GitHub issues a short-lived GITHUB_TOKEN for the workflow to interact with the repository.

Software Review 52

Software Review Open Source Weak Development Team Project Management 52

CTOvision

SEPTEMBER 14, 2020

Read why Eyal Arazi says that excessive permissions in cloud computing are harmful on iTWire: In this new environment, workload security is defined by which users have access to a […].

Cloud 89

Cloud 89

Next Level Blog

SEPTEMBER 15, 2020

It’s a lot of things, actually, but one of the big ones is whether or not the organization has created a permission structure for innovation. Where are you on the permission structure spectrum? Some companies have been successful in pivoting quickly, while others have found it more challenging. What else would work or help, instead?

Innovation 84

Innovation How To Culture Agile 84

Lacework

FEBRUARY 16, 2022

One of the items to look for specifically in the logs is use of various permissions as users and systems with too many permissions are extremely common in any environment. Too Many Permissions. In our discussion, Dave made a great point about elevated permissions, “You should have break glass detection…”. That’s bad.

Weak Development Team 52

Weak Development Team Load Balancer Survey Google Cloud 52

DevOps.com

OCTOBER 25, 2023

Have you ever experienced the frustration of discovering an unexpected charge on your bank statement for a forgotten gym membership? Perhaps you kept it active “just in case” you wanted to exercise someday. Similarly, always-on privileged access, also known as “standing privileges,” can lead to similar challenges.

Exercises 108

Exercises Banking Organization Continuous Delivery 108

Aqua Security

JUNE 3, 2019

I want to start with a quote attributed to another inspiring woman, Grace Hopper, the founder of computer languages, who said " It is often easier to ask for forgiveness than it is to get permission. ". Meanwhile, let’s consider permissions in the context of both Linux and Kubernetes. Wait until the end of the blog to find out!

Linux 90

Linux 90

CIO

MARCH 5, 2024

It also requires that LLMs that are unreliable or still under test only be made available in Indian Internet with explicit permission from the government, and only be deployed accompanied by a warning of their unreliability. The process of granting permission is not clear and what vendors need to do to get the permission is unclear as well.

Artificial Inteligence 321

Artificial Inteligence Generative AI Technical Review Artificial Intelligence 321

Apps Associates

JULY 30, 2020

If any of these situations apply to you, you may have permission issues within your Salesforce org. … Continue reading "Permissions – Where do I start?". The post Permissions – Where do I start? Are your customer service teams struggling to collaborate together on a case? appeared first on Apps Associates.

Applications 40

Applications Cloud 40

TechCrunch

DECEMBER 13, 2023

Many, if not most, generative AI tech vendors argue that fair use entitles them to train AI models on copyrighted material scraped from the internet — even if they don’t get permission from the rightsholders.

Training 283

Training Generative AI Internet Media 283

TechCrunch

NOVEMBER 14, 2023

As recently as yesterday, a Tesla US order agreement page included a threat to sue Cybertruck buyers who resell the vehicle without permission during their first year of ownership. Tesla seems to be walking back the punitive limits it placed on buyers of its yet-to-be-released Cybertrucks. All rights reserved. For personal use only.

Transportation 291

Transportation 291

Terry Starbucker

FEBRUARY 24, 2013

I remember when I didn’t have permission to fail. Given me permission to fail. I had to give my team permission to fail. Or, to say it a bit more precisely, when I was really afraid to fail. I wasn’t a very productive employee. I never took chances. I never stepped out of the narrow little box I was existing in.

Course 149

Course Meeting Leadership 149

Aqua Security

MARCH 7, 2019

The best mitigation is to remove the “patch” permissions from untrusted users, and we have also updated Kube-Hunter to check if your cluster is vulnerable.

Open Source 80

Open Source 80

CIO

MARCH 20, 2024

Finally, the authority accused Google of using news content to train its Bard AI service (now called Gemini), without the permission of the publishers, and without providing access to an opt-out tool that would have let them contest the AI usage.

Generative AI 363

Generative AI Training Tools Company 363

CIO

OCTOBER 20, 2023

This may seem like a minor problem, given that their actions are constrained by the permissions they’ve been granted. Chaining together numerous tactics provides pathways to laterally move around network locations and permission boundaries. Few accounts have enterprise admin rights, so how much harm can a general user really do?

Policies 358

Policies Authentication Enterprise Network 358

TechCrunch

NOVEMBER 23, 2022

Modify All Data and View All Data permissions do exactly what they say. These are the super user permissions for Salesforce. These permissions should only be given to administrators and even then, to a very limited number of people. We’ll start with the obvious and most dangerous.

Software Review 230

Software Review Systems Review DevOps Infrastructure 230

Xebia

DECEMBER 16, 2023

They focus on three things: Restrict permission for the GITHUB_TOKEN Add security agent for GitHub hosted runner (Ubuntu only) Pin actions to a full SHA hash Restrict permission for the GITHUB_TOKEN One of the best practices is to always indicate what permissions you want to allow for the GitHub token that will be used in your workflow.

Open Source 130

Open Source Firewall Policies Examples 130

Ooda Loop

FEBRUARY 8, 2024

Google recently announced a new feature of Google Play Protect, which will block the installation of sideloaded applications that request sensitive permissions on Android devices. Fraudsters frequently leverage these permissions to intercept passwords via SMS or notifications.

Applications 111

Applications 111

Xebia

DECEMBER 7, 2022

You need organization level permission to configure GCP resource constraints. Gladly, you can scope these permissions to your workload context by using Resource Tags and IAM conditions. Sadly, this permission is granted at the Organization -level. You can use IAM conditions to scope IAM permissions to certain resources.

Policies 130

Policies Resources Examples Organization 130

TechCrunch

APRIL 5, 2021

Over the course of their careers, Alex Bovee and Paul Querna realized that while the use of SaaS apps and cloud infrastructure was exploding, the process to give employees permission to use them was not keeping up. This was resulting in delayed employee access to apps, or to the over-permissioning employees from day one.

Infrastructure 244

Infrastructure Software Review Systems Review Technical Review 244

Xebia

MAY 15, 2023

This poses a security risk because most of the time these AWS credentials are long-lived credentials with a lot of permissions. Add the permissions you want to role to have, in this example we will use the AWS managed permission ReadOnlyAccess. If these credentials get leaked or misused the damage done could be huge.

AWS 130

AWS Authentication How To Google Cloud 130

CIO

DECEMBER 20, 2022

Overly permissive access privileges Overly permissive access policies and privileges enable expanded access to far more assets than needed. Common cloud misconfiguration gotchas As with many things, prevention begins with awareness. Be on the lookout for these common cloud misconfiguration gotchas.

Cloud 355

Cloud Firewall Storage Policies 355

Prisma Clud

SEPTEMBER 14, 2023

To achieve control or write permissions on a repository, attackers draw from a range of established techniques: 1. We still have two options: Infecting by pushing code to a branch : We can use the GITHUB_TOKEN or PAT used in a job to push malicious code to a branch if the token is granted with the contents:write permission.

Malware 144

Malware Open Source Research Software 144

Ooda Loop

MARCH 28, 2024

intellectual property without permission. In February, US Intelligence officials informed senators that the Chinese pharmaceutical firm WuXi AppTec had given China U.S.

Pharmaceuticals 105

Pharmaceuticals Data Organization 105

Perficient

JANUARY 31, 2024

In this blog post, we’ll delve into three key parser modes: FailFast , Permissive, and Drop Malformed. csv(filePath) Permissive Mode: Permissive mode, Spark takes a more lenient approach. val dfPermissive = spark.read.option("mode","PERMISSIVE").csv(filePath) val dfFailFast = spark.read.option("mode","FAILFAST").csv(filePath)

Open Source 52

Open Source Big Data Data Analytics 52

Prisma Clud

SEPTEMBER 26, 2023

Specifically, an EC2 instance endowed with s3:GetObject and s3:ListObject permissions and lacking the shield of IMDSv2 can result in data exfiltration. Finding s3:GetObject and s3:ListObject permissions gives them the keys to the bank vault, allowing them to list and retrieve whatever they wish from the specified S3 buckets.

Policies 116

Policies Cloud AWS Technical Review 116

Honeycomb

FEBRUARY 14, 2024

They are: Limited in permissions: Can only be used to write telemetry data, and optionally, to create new datasets. Immutable: Once created, their permissions cannot be altered, making them the safest option for client-side instrumentation.

Compliance 103

Compliance Policies System Data 103

CIO

FEBRUARY 14, 2024

But when it comes to implementing those projects successfully, they turn out to rely on how well the IT organization has implemented basics like connectivity, permissions, and configuration management. I heard people say, ‘It’s breaking all my permissions.’ Managing Copilot isn’t just about permissions management,” he adds.

Artificial Inteligence 358

Artificial Inteligence Generative AI Software Review Development Team Review 358

Xebia

JANUARY 26, 2024

Using the Terraform Cloud environment based workspaces method described in my previous article we are granted this traceability for the code itself, however using the Terraform Cloud UI to handle our variables means we cannot trace when these have been changed, as well as having to grant permissions to users to access them.

Cloud 130

Cloud Software Review Storage Development 130

CIO

MARCH 1, 2024

Securing the AI model itself means identifying model risks, over-permissive access, and data flow violations throughout the AI pipeline. Security programs need to account for the context in which AI systems are used and their impact on sensitive data exposure, effective access, and regulatory compliance.

Artificial Inteligence 299

Artificial Inteligence Innovation Generative AI Artificial Intelligence 299