VSHN.timer #62: Dodging Threats Like A Pro

Welcome to another VSHN.timer! Every Monday, 5 links related to Kubernetes, OpenShift, CI / CD, and DevOps; all stuff coming out of our own chat system, making us think, laugh, or simply work better.

This week we’re going to talk about how companies face the increasing occurrence of security threats in Cloud Native applications.

1. In a world of containers, threats can be hard to spot; a badly configured Docker instance, for example, might expose a weakness which, when exploited, allows attackers to build malicious images containing any kind of payload they want. Fascinating (even if scary) find by the Aqua Security team. You might want to read their latest research report, by the way.

https://blog.aquasec.com/malicious-container-image-docker-container-host

2. A few days ago we received notification of CVE-2020-15598, a „Denial of Service vulnerability in the underlying ModSecurity engine“. Affecting one of the most popular open source application firewalls, this vulnerability allows for low complexity attacks of potentially high impact.

https://coreruleset.org/20200914/cve-2020-15598/

3. The Swiss cloud security scene is very active, which is not surprising given the huge number of financial institutions around here. For professionals interested in securing this sensitive ecosystem, two resources: first, a handy set of KPIs to follow; and second, a ticket to the (online) Swiss Web Security Day 2020 co-organized by our friends at SWITCH and scheduled for October 28th.

https://www.eventbrite.de/e/swiss-web-security-day-2020-tickets-97289416263

4. If you’re a Thunderbird user, you should upgrade to version 78 as soon as possible; this new version is not compatible with Enigmail anymore, instead including a built-in OpenPGP feature. We’re big, big fans of Thunderbird in VSHN, and now even more.

https://blog.thunderbird.net/2020/09/openpgp-in-thunderbird-78/

5. The tool of the week is Veeral Patel’s „How to Secure Anything“ compilation of documents, papers, and guidelines. An absolute treasure with plenty of interesting information.

https://github.com/veeral-patel/how-to-secure-anything

Which strategies do you use to keep your systems secure? How do you balance the flexibility required by DevOps teams with the rigidity of security regulations? Would you like to share something with the community? Get in touch with us through the form at the bottom of this page, and see you next week for another edition of VSHN.timer.

PS: would you like to receive VSHN.timer every Monday in your inbox? Subscribe to our new VSHN.timer newsletter!

PS (again): We have published quite a few VSHN.timer entries dedicated to security, check them out:  #8, #17, #22, #27, #32  and #54.