The shift-left movement made code hygiene and supply chain hygiene paramount. But what if the risk to your codebase comes from an intentional act—an external attacker using stolen credentials or an insider with harmful intent? If you can’t monitor who has access to what in your GitHub environment, you’re likely reacting too late.? At Oleria, we help our clients secure their GitHub environments from the inside out. Our solution gives you centralized visibility into risks across your GitHub environment. Continuous risk monitoring surfaces anomalous activities, and Access Graphs make it quick and easy to investigate and respond—before insidious actions compromise your codebase. We’re veteran GitHub users like you—and we built Oleria Adaptive Security to allow developers to leverage GitHub’s flexibility, without limiting your security team’s visibility to untangle complex permissions. #GitHub #DataBreaches #IdentitySecurity #CloudSecurity
Oleria的动态
最相关的动态
-
“GitHub emphasizes the importance of regular verification of GitHub.com commits outside of the platform, as well as vulnerability patching. Users conducting verifications, including those in GHES, are encouraged to import the new public key hosted by GitHub. Regularly pulling the public key is recommended to ensure the usage of the most current data from GitHub, facilitating seamless adoption of new keys in the future.
-
#NEWS #SHARE GitHub enables push protection by default to stop secrets #leak. GitHub has enabled push protection by default for all public repositories to prevent accidental exposure of secrets such as access #tokens and API keys when pushing new code. Today's announcement comes after the company?introduced push protection?in beta almost two years ago, in April 2022, as an easy way to prevent sensitive information leaks automatically. The feature became?generally available?for all public repos in May 2023. Push protection proactively prevents leaks by scanning for secrets before 'git #push' operations are accepted and blocking the commits when a secret is detected. https://lnkd.in/gAXF3g9a
GitHub enables push protection by default to stop secrets leak
bleepingcomputer.com
-
One of the hardest parts of securing your company's secrets sprawl is first understanding your total exposure. You might have your corporate sources covered, but what about the public space? ?? GitGuardian has just released a free tool to help you get an instant audit of your GitHub attack surface, including: - The number of developers committing publicly - The number of secrets exposed - How many of those secrets are still valid You can run the audit yourself here: https://lnkd.in/ehyiBydH Try it out, and feel free to reach out directly if you want more info!
GitHub Security Audit | GitGuardian
gitguardian.com
-
?? 1 in 10 authors exposed a secret in 2022 on #GitHub, making organizations & software prone to hacking?? Check out this guide by Nitin Naidu to enable #SecretScanning in popular #Git platforms to avoid accidentally exposing crucial passwords?? https://lnkd.in/gJjQENdW #itsecurity
How to Prevent Secret Leaks in Your Repositories
infracloud.io
-
Do you have a solution in place that’s continuously scans your repose for malicious codes? Come talk to me about a solution!
Critical Infrastructure , Health Sector Cyber Security Leader at Health & Human Services-ASPR
Given that GitHub hosts over 100M developers building across over 420M repositories, this a very concerning! https://lnkd.in/ec7F4Euh
Millions of GitHub Repos Found Infected with Malicious Code
https://gbhackers.com
-
Co-Founder @ CISO Platform (Exclusive community of CISOs & 50,000+ Security Influencers) and Co-Founder@ FireCompass | Automated Penetration Testing & Red Teaming & Attack Surface Management
GitHub reconnaissance is an important aspect of attack surface management, particularly for organizations and individuals who rely heavily on software development and open-source code. You might find teh GitHub dork list useful: https://lnkd.in/gbudptGZ
Importance of GitHub Reconnaissance in CASM & CART
firecompass.com
-
Principal leader in AI , Data and Scaling| Pytorch, Python, NLP, Robotics | Manage ML teams to build incremental ROI
In a recent post of my predictions, I talked about poison attacks on AI service from competition to make competetors look bad. This scenario will just do that if undetected. This is not the end to this scenario.
??GitHub Copilot vulnerability - “Invisible Ghost”?? Imagine your Copilot secretly spread?malicious instructions throughout your codebase, jumping between files, while damaging the organization’s repository, and the integrity of your projects - that’s exactly what the Apex Research Team found??? By leveraging hidden instructions, we made GitHub Copilot receive, accept, and act according to malicious prompts, bypassing its internal defense mechanisms, yielding false/malicious suggestions. By exploiting “Invisible Ghost” we were able to manipulate Copilot behavior, leading to: -> False suggestions and broken code outputs -> Malicious or vulnerable suggestions -> Deployment of an invisible backdoor (see our Bazinga example!) -> Due to its stealthiness, the exploit can propagate between users and across repos! Those can damage your code quality and security,?disrupt your organization development velocity and safety, ultimately leading to?a complete GitHub Copilot DOS for the organization. Don’t let your org’s security be compromised by invisible threats, check out the full report - by Fufu Shpigelman, Omer Katz, and Oren Saban - for details and mitigation strategies: https://lnkd.in/dyP9Ukk8 #AISecurityRisks #GitHubCopilot P.S. GitHub's stance? “It’s the user’s responsibility.” What’s your view on this????
-
-
Couple of thoughts: first, please be careful who you share GitHub access tokens with. Powerful stuff. Second, let's not call a bug / flaw in your API an "attack" by default. I understand why you want to deflect blame, but owning your mistakes is the first step to rebuilding trust.
Mintlify says customer GitHub tokens exposed in data breach | TechCrunch
https://techcrunch.com
-
GitHub personal access tokens (PAT) are valuable loot. Use Gato-X to enumerate token permissions and identify potential lateral movement opportunities when you find a GitHub PAT. You might be surprised by the access you can gain within an organization. https://lnkd.in/dfyuXrWz
GitHub - AdnaneKhan/Gato-X: GitHub Attack Toolkit - Extreme Edition
github.com
-
The Legit research team recently published The State of GitHub Actions Security report. This report highlights our findings and conclusions after analyzing 2,500,000 GitHub Actions workflow files belonging to 553,000 organizations and personal users. Ultimately, we found the state of GitHub Actions security concerning. The lack of dependency pinning is especially alarming. Dependency pinning specifies which package or library an Action can rely on. A famous example of the danger of using third-party software without dependency pinning is the CodeCov breach where attackers were able to modify the CodeCov CI script to exfiltrate the CI runner environment variable. Get more details on our analysis in our blog post: https://hubs.ly/Q02JcRgw0 #GitHub #ASPM #ApplicationSecurity #LegitSecurity
-
