Isovalent’s Post

Move-It customers patch NOW. Otherwise another unauthenticated attacker can steal your data... Exploit Attempts Recorded Against New MOVEit Transfer Vulnerability. The vulnerability, tracked as CVE-2024-5806 (CVSS score: 9.1), concerns an authentication bypass that impacts the following versions - From 2023.0.0 before 2023.0.11 From 2023.1.0 before 2023.1.6, and From 2024.0.0 before 2024.0.2 https://lnkd.in/gb46Zmv9 Thanks for the tip Critical Insight

📣 We're excited to announce a new analyzer that will help you keep your secrets! 🤫 The DryRun Security Secrets Analyzer uses our Contextual Security Analysis framework to identify and address secrets within Pull Requests (PRs) before they merge into the main codebase. ❓ How does it work? ➡ It analyzes incoming PRs for secrets ranging from API keys, tokens, and credentials, to other sensitive data. ➡ If a secret is detected, it alerts you. ⏱ All in a matter of seconds ➡ So you can take immediate action 💪 Learn more about how the Secrets Analyzer can integrate seamlessly with your current workflow to give you a more robust security posture at https://bit.ly/4aPVQmm 🙌 Follow us here to stay up to date with our latest news. #secrets #context #sast

The theme of #RSAC2024 is "The Art of Possible," with the description highlighting that "we must go beyond ones and zeroes." Ones and zeroes, an allusion to binary or on/off states, is an excellent metaphor for some of the challenges we face in application security, and the shift in issue prioritization we are seeing emerge in an operating space where there are too few hands on both the development and security side to address the number of issues our scanners are throwing off. No longer can the answer be "the CVE (common vulnerabilities and exposure) score is this," or "the scanner found this signature." Issues require risk-based context: Is the vulnerability reachable or exploitable? Is it being exploited, or is the code where it is present even used? Is the vulnerability exposed to the public networks? Answers to these and a host of other questions allow teams stretched thin to know where to allocate their time. At RSA, I will be paying close attention to application security solutions that have adjusted to this new usability requirement and have a coherent story around prioritization that goes beyond "a public database says this." Ref: https://lnkd.in/eEr5ZyQu

MDRs need a simplified and cost-effective way to ingest security data at scale into a single centralized repository with analytical capabilities. Sound familiar? Here's the answer. https://bit.ly/4f5RFpd

I've just finished the course “Web Security: OAuth and OpenID Connect” by Keith Casey!Strongly recommend if you'd like to know the right usecases for each one of the authentication flows. 

Just finished the course “Web Security: OAuth and OpenID Connect” by Keith Casey! Check it out: https://lnkd.in/e6JtXbhm #oauth #openidconnect.

Just finished the course “Web Security: OAuth and OpenID Connect” by Keith Casey! Check it out: https://lnkd.in/ebNHyhT3 #oauth #openidconnect.

Just finished the course “Web Security: OAuth and OpenID Connect (2019)” by Keith Casey! Check it out: https://lnkd.in/dW_Em_9k #secureauthentication.

Just finished the course “Web Security: OAuth and OpenID Connect” by Keith Casey! Check it out: https://lnkd.in/ddAcfVSm #oauth #openidconnect.