News & Information       http://info.owt.com

Security

03/25/2024   InfoWorld Security

The key benefits of platform engineering are increased developer productivity, better quality of software, reduced lead time for deployment, and more stable applications, according to Puppet by Perforce’s 2024 State of Devops Report: The Evolution of Platform Engineering.

The report is based on a survey of 474 participants who work with a platform engineering team at their organizations. The survey was conducted in the summer of 2023.

Other benefits cited include cost savings, reduced time for product development, reduced errors, and reduced risk of security breaches. “Security has never just been IT’s job,” said Kapil Tandon, Puppet by Perforce vice president of product management, in the executive summary. “With secure tools built into most platforms, platform engineering is empowering more people than ever to take responsibility for security.”

To read this article in full, please click here

03/25/2024   InfoWorld Security

The benefits of developing software in the cloud include increased flexibility and reliability, greater efficiency, and reduced costs. But cloud-based development also presents a host of challenges. Knowing what to watch out for is the first step to protecting your applications and development efforts. Here, are 10 pitfalls to consider before developing, testing, or deploying applications in the cloud.

10 reasons to think twice before developing in the cloud

  1. Performance and latency issues
  2. Cybersecurity and data protection threats
  3. Vendor lock-in
  4. Runaway costs
  5. Regulatory compliance requirements
  6. Compatibility and integration issues
  7. Scalability demands
  8. Distributed collaboration and communication
  9. Testing and deployment hurdles
  10. Developing for a global market

Performance and latency issues

While cloud services are generally reliable in terms of availability and performance, service outages or performance issues can impact development efforts.

To read this article in full, please click here

03/22/2024   InfoWorld Security

Java Development Kit (JDK) 22, released by Oracle March 19 as the latest version of standard Java, offers a number of security enhancements, covering areas ranging from an asymmetric key interface to a new security option for -XshowSettings that allows developers to easily display security-related settings.

In a March 20 blog post on Oracle’s inside.java web page, Sean Mullan, technical lead of the Java Security libraries team and lead of the OpenJDK Security Group, detailed the security enhancements in JDK 22.

To read this article in full, please click here

03/20/2024   InfoWorld Security

GitHub is previewing code scanning autofix, a feature that combines its GitHub Copilot AI assistant with its CodeQL code scanner to provide suggested fixes to discovered vulnerabilities. Code scanning autofix is available in a public beta to GitHub Advanced Security customers.

Launched March 20, code scanning autofix makes vulnerability fixes available right away as a developer is coding, GitHub said. GitHub Copilot AI is used to provide a code suggestion and explanation directly in the pull request. Code scanning autofix covers more than 90% of alert types in JavaScript, TypeScript, Java, and Python, and remediates more than two-thirds of found vulnerabilities with little or no editing, according to the company.

To read this article in full, please click here

03/20/2024   InfoWorld Security

In JFrog’s just-released Software Supply Chain State of the Union 2024 report, the software supply chain platform provider found extensive use of AI and machine learning tools for security. However, only one in three software developers the company surveyed use generative AI to write code.

While 90% of survey respondents indicate their organizations currently use AI/ML-powered tools in some capacity to assist in security scanning and remediation, only about one in three professionals, 32%, said their organizations use AI/ML-powered tools to write code. This indicates the majority still are wary of the potential vulnerabilities that AI-generated code can introduce to enterprise software, JFrog said.

To read this article in full, please click here

03/20/2024   InfoWorld Security

The internet of things (IoT) has transformed the way we interact with the world, connecting a myriad of devices to the internet, from smart thermostats in our homes to industrial sensors in manufacturing plants. A significant portion of these IoT devices relies on the Linux operating system due to its flexibility, robustness, and open-source nature.

Deploying software to Linux-based devices, at scale, is a complex and critical process that requires planning, well-thought-out processes, and adherence to best practices to ensure the stability, security, and manageability of the IoT fleet. In this article, we’ll explore some best practices for deploying software on large fleets of Linux-based IoT devices.

To read this article in full, please click here

03/18/2024   InfoWorld Security

C++ creator Bjarne Stroustrup has defended the widely used programming language in response to a Biden administration report that calls on developers to use memory-safe languages and avoid using vulnerable ones such as C++ and C.

In a March 15 response to an inquiry from InfoWorld, Stroustrup pointed out strengths of C++, which was designed in 1979. “I find it surprising that the writers of those government documents seem oblivious of the strengths of contemporary C++ and the efforts to provide strong safety guarantees,” Stroustrup said. “On the other hand, they seem to have realized that a programming language is just one part of a tool chain, so that improved tools and development processes are essential.”

To read this article in full, please click here

03/14/2024   InfoWorld Security

Frank Crane wasn’t talking about open source when he famously said, “You may be deceived if you trust too much, but you will live in torment if you don’t trust enough.”

But that’s a great way to summarize today’s gap between how open source is actually being consumed, versus the zero trust patterns that enterprises are trying to codify into their DevSecOps practices.

Every study I see suggests that between 90% and 98% of the world’s software is open source. We’re all taking code written by other people—standing on the shoulders of giants—and building and modifying all that code, implicitly trusting every author, maintainer, and contributor that’s come before us.

To read this article in full, please click here

03/13/2024   InfoWorld Security

The US federal government has released a software attestation form intended to ensure that software producers partnering with the government leverage minimum secure development techniques and tool sets.

The form was announced March 11 by the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA), which developed the form with the Office of Management and Budget (OMB). The form identifies minimum secure software development requirements a software producer must meet and attest to meeting. Software requires attestation if it was developed after September 14, 2022. Software developed prior to this date requires attestation if it was modified by major version changes after September 14, 2022. Attestation also is required if the producer delivers constant changes to the code.

To read this article in full, please click here

03/12/2024   InfoWorld Security

JetBrains has released fixes for two critical security vulnerabilities in its TeamCity On-Premises CI/CD system discovered by cybersecurity company Rapid7.

The two vulnerabilities reported in late-February by Rapid7 would enable an authenticated attacker with HTTP(S) access to a TeamCity On-Premises server to bypass authentication checks and gain administrative control. These vulnerabilities affected all TeamCity On-Premises versions through 2023.11.3, but have been fixed in TeamCity On-Premises 2023.11.4. For users unable to update their server to version 2023.11.4, JetBrains also released a security patch plugin.

To read this article in full, please click here

03/05/2024   InfoWorld Security

Cloudflare has announced the development of Firewall for AI, a protection layer that can be deployed in front of large language models (LLMs) that promises to identify abuses before they reach the models.

Unveiled March 4, Firewall for AI is intended to be an advanced web application firewall (WAF) for applications that use LLMs, comprising a set of tools that can be deployed in front of applications to detect vulnerabilities and provide visibility into the threats to models.

To read this article in full, please click here

03/01/2024   InfoWorld Security

President Joseph Biden has issued an executive order intended to protect Americans’ sensitive personal data from exploitation from countries of concern including China, Russa, Iran, and North Korea.

Issued February 28, the order authorizes the attorney general to prevent the large-scale transfer of Americans’ personal data to countries of concern and offers safeguards around other activities that can give these countries access to this sensitive data.

To read this article in full, please click here

03/01/2024   InfoWorld Security

GitHub has begun rolling out push protection for all of its users, a secrets scanning feature that gives users the option to remove secrets from commits or bypass a block.

The policy, announced February 29, affects supported secrets. It might take one to two weeks for this change to apply to an account; developers can verify status and opt in early in code security and analysis settings. GitHub secret scanning guards more than 200 token types and patterns from more than 180 service providers.

To read this article in full, please click here

02/29/2024   InfoWorld Security

With the growth of sophisticated attacks against critical software and infrastructure systems, multi-factor authentication (MFA) has emerged as a critical layer of defense against unauthorized access. An increasing number of enterprise and developer-facing technology applications and platforms, from GitHub to Salesforce to Amazon Web Services, are making MFA mandatory for users.

That said, we are all used to passwords, and many people like the status quo. Not surprisingly, the introduction of MFA has added friction to the login process. This can negatively impact the user experience.

A newer technology that can provide even greater security benefits than MFA is now becoming more widely deployed. That technology is called passkeys. Based on widely accepted industry standards, passkeys offers the tantalizing promise of eliminating the need for passwords and the risks passwords create without adding user experience friction like MFA.

To read this article in full, please click here

02/28/2024   InfoWorld Security

Nearly three-quarters of codebases assessed for risk by Synopsis in 2023 contained open source components with high-risk vulnerabilities, according to a just-released report from the company, a provider of application security testing tools.

While the number of codebases with at least one open source vulnerability remained consistent year over year at 84%, Synopsis said, the number that contained high-risk vulnerabilities increased dramatically, from 48% in 2022 to 74% in 2023. Synopsis defines high-risk vulnerabilities as vulnerabilities that have been exploited, or have documented proof-of-concept exploits, or have been classified as remote code execution vulnerabilities.

To read this article in full, please click here

02/27/2024   InfoWorld Security

US President Joe Biden’s administration wants software developers to use memory-safe programming languages and ditch vulnerable ones like C and C++.

The White House Office of the National Cyber Director (ONCD), in a report released Monday, called on developers to reduce the risk of cyberattacks by using programming languages that don’t have memory safety vulnerabilities. Technology companies “can prevent entire classes of vulnerabilities from entering the digital ecosystem” by adopting memory-safe programming languages, the White House said in a news release.

To read this article in full, please click here