#security - June 2023

🚨 If you are using an iPhone, be sure to lock it down (watch the whole video for background on why this is important). This is countering an active threat that will ruin more than just your day if you fall victim. Additional mitigation includes using 1Password rather than iCloud Keychain for access to accounts.

We've launched a #compliance channel to discuss topics like FedRAMP, HIPAA, SOC2, PCI/DSS, HITRUST, etc.

@Jonathan Eunice https://trufflesecurity.com/blog/running-trufflehog-in-a-github-action/

@Jonathan Eunice has joined the channel

Dang it Gigabyte. https://www.wired.com/story/gigabyte-motherboard-firmware-backdoor/

Anyone have experience simplifying a SSO login page which provides multiple ways of logging in by using multiple vanity login domains instead. For example a menu asking user to choose a way to sign in between "microsoft account" and "google account" would be converted into two domains ms.example.com and ga.example.com. What are the negatives to such an approach (besides increase in resources to manage)? Is this against some best practice? Is this somewhat common?

Hey Folks,

I’m thrilled to share our journey towards Continuous Security Audits at Dgraph Labs Inc. In our blog post, we delve into how we detect and remediate potential Security Issues within our offerings. Our new setup integrates a selection of toolsets and aids in “Improved Visibility” and “Faster Security Issue Resolution” for our organization (and our esteemed customers). Within a concise timeframe (~3 months), we’ve successfully addressed over 2k+ security issues with this, significantly bolstering our SOC2 compliance endeavors. Learn more about our Security Landscape, Layers, Tools in our blog post. https://www.sudhishkr.com/posts/20230609_how-we-fixed-2kplus-security-issues/

#DevSecOps #SecurityAudit #DgraphLabs #ContinuousSecurity #OpenSource #DevOps #CVEs #Linters #GitHubActions #SecureCoding