Operations | Monitoring | ITSM | DevOps | Cloud

The latest News and Information on CyberSecurity for Applications, Services and Infrastructure, and related technologies.

Change in behavior: multiple cf-execd processes

Recently we introduced new feature where you can trigger agent runs and report collection from the Mission Portal UI. This required our daemon cf-execd to behave a bit differently when periodic agent runs occur. Previously the daemon would create a new thread in which to run cf-agent, capture output, wait for completion and move on. We changed the behavior so that the daemon forks itself and then fork/execs cf-agent as before, with the forked cf-execd processing agent run output.

Key advantages of the Calico eBPF data plane

Project Calico has offered a production-ready data plane based on eBPF since September 2020, and it’s been available for technical evaluation for even longer (since February 2020). The pre-requisites and limitations are simple to review, it’s easy to enable, and it’s easy to validate your configuration. So, there’s never been a better time to start experiencing the benefits! You do know what those are, don’t you? Don’t worry if not!

3 ways to boost your company's cybersecurity

Cybersecurity is on the mind of every business leader, and for good reason: The number of data breaches rose 24% between 2020 and 2021, according to global ThoughtLab research co-sponsored by ServiceNow. Organizations everywhere need advanced security programs to navigate today’s fluid threat landscape. Here are three ways to help do that: 1. Create a framework Customers are increasingly concerned about data security.

How to audit Node.js modules

Node.js is one of the best and most widely used Javascript runtimes used for building APIs. But, this popularity status has led to many hackers distributing insecure modules that exploit the Node.js application or provide a weak point for exploitation. In this tutorial, you will learn how to audit Node.js modules and also detect vulnerabilities in modules using npm audit.

Anatomy of a Supply Chain Attack Detection and Response

In today's world of global supply chains, a breach never stops at a supplier level but cascades all the way up the chain. So being able to detect and stop a supply chain attack at an early stage before an attacker exfiltrates confidential company data or damages company operations and reputation is critical to your organization's survival. Luckily, hackers always leave a trace, so proper detection can help you stop breaches at an early stage before hackers achieve their goals.

What are CIS Controls, and Why Are They Important?

Way back in the early days of the Internet, having an antivirus was the end-all-be-all of cybersecurity. These were admittedly wilder times but in a way, only a few bad actors had the tools and knowledge to threaten and breach corporate IT infrastructures. Times have changed and thanks to the dissemination of information and widespread accessibility to more hacking technology, cyber-attacks have become a very real and tangible menace with potentially devastating consequences.

Using Zero Trust Networking in Cloud Migrations

Moving workloads to the cloud has many benefits, and one that is often overlooked is the opportunity to modernize your network. In a traditional “perimeter-based” architecture, users and devices are authenticated and authorized on a device-by-device basis when connecting remotely via VPN.

Sponsored Post

How much could software errors be costing your company?

Errors are an inevitable part of building software. But while you can't eradicate them, you can definitely mitigate them. If you don't measure, track or resolve errors, you're ignoring a loss in revenue. It's time to pay attention to how much software errors are costing your company and take action, catching them early with methods like smarter testing and crash reporting. Using a few industry averages, you can put a number to the real cost of software errors in your company and start to plug cash leaks like wasted developer time and lost customers.

Follina Zero-Day Vulnerability: Overview and Alert Upon Detection for CVE-2022-30190

On May 27, 2022, an interesting Microsoft Word doc was uploaded to VirusTotal by an independent security research team called nao_sec. The Word doc contains built-in code that calls an HTML file from a remote source that in-turn executes more (malicious) code and Microsoft Defender for Endpoint misses detection. Two days later, May 29, Kevin Beaumont publishes an article describing the behavior of this Word doc, and deems this a new 0-day vulnerability in Office/Windows products.

What's new in Calico Enterprise 3.14: WAF, Calico CNI on AKS, and support for RKE2

At Tigera, we strive to innovate at every opportunity thrown at us and deliver what you need! We have listened to what users ask and today we are excited to announce the early preview of Calico Enterprise 3.14. From new capabilities to product supportability and extending partnerships with our trusted partners, let’s take a look at some of the new features in this release.