Cloudsmith Extends Policies and Controls to Secure Application Binaries

Sicherheitsmeldung mit Schweregrad noch nicht bewertet. Technische Details im Tab „Originaltext“; empfohlene Schritte in der Checkliste.

Originaltext der Quelle (nicht übersetzt) – die deutsche Zusammenfassung findest du im Tab „Kurzfassung".

Cloudsmith this week revealed it has expanded the policy management and continuous risk detection capabilities it makes available within its software artifact management platform to now include policy templates, cooldown policies, and expanded evaluation triggers. Alison Sickelka, vice president of product for Cloudsmith, said these additions to the platform will make it simpler to prevent malicious packages from inadvertently being incorporated into the binaries that DevOps teams deploy in production environments. For example, policy templates written in the Rego programming language can now be used to provide a set of baseline controls that are consistently implemented across a DevOps workflow. Additionally, DevOps teams can now implement a set of cooldown policies that prevent any recently made available software package from being indexed. That capability ensures that only versions of a validated package are exposed to application developers, noted Sickelka. That’s crucial because many of those packages have been created by maintainers of open source software projects that are targeted by adversaries that have no shortage of time, patience and financial resources. Finally, the expanded evaluation triggers now consider when a policy was created or updated as part of the metrics used alongside threat intelligence feeds to generate an alert. That capability helps ensure that policies are updated as the application development environment continues to evolve, said Sickelka.

Rather than trying to secure software supply chains by focusing mainly on the source code used to …

Vollständiger Originalartikel ↗

• Betroffenheit im eigenen Stack prüfen: Versionen/Komponenten abgleichen.
• Originalquelle / Hersteller-Advisory lesen: https://devops.com/cloudsmith-extends-policies-and-controls-to-secure-application-binaries/
• Verfügbaren Patch oder Workaround einspielen und dokumentieren.