Unfortunately, the supply chain attacks against OSS packages "in your application" are not the only ones we need to worry about. We know that attacks can (and do !) happen against: - build components: OSS CI components such as Jenkins plugins, github actions, circleci orbs, etc... - infrastructure (as-code) components: helm charts, terraform modules/providers, etc... Attacking such components is akin to poisoning the kitchenware, as opposed to poisoning the food ingredients - anything that is 'built' with a vulnerable component may be vulnerable itself to an XZ style attack... At boostsecurity, we have been researching these types of weaknesses for a while, and have helped numerous companies fix exploitable build pipelines. However, there is only so much we can do via independent research and vulnerability disclosures. As part of our effort to help the industry solve these issues at scale, we are releasing https://lnkd.in/evMR2ZNX - a fast, efficient, security scanner for build pipelines (today Github & Gitlab, with more to come) https://lnkd.in/eCCXqS-F
boostsecurity.io
Software Development
Montreal, Quebec 1,816 followers
Security done right. #startleft. #coderight.
About us
DevSecOps Automation Platform to Secure your Software Supply Chain
- Website
-
https://www.boostsecurity.io/
External link for boostsecurity.io
- Industry
- Software Development
- Company size
- 11-50 employees
- Headquarters
- Montreal, Quebec
- Type
- Privately Held
- Founded
- 2020
Locations
-
Primary
Get directions
Montreal, Quebec, CA
-
Get directions
Cupertino, CA, US
Employees at boostsecurity.io
Updates
-
Over the past year, we have helped companies secure vulnerable parts of their CI/CD pipelines. The article below details some recent work we did for AWS...
🚀 Just blogged about a responsible disclosure on an AWS OSS project and discussing the complexity of mitigating Insider Threats in large Open Source projects. 🛡️ Practical GitHub Actions hardening tips that companies should adopt to combat Insider Threats effectively. #supplychain #opensource #insiderthreats #aws #githubactions https://lnkd.in/eHdZzYYH
Opening Pandora’s box - Supply Chain Insider Threats in Open Source projects
boostsecurity.io
-
Securing the software supply chain is hard, for everyone... Our security research team helped uncover a supply chain weakness in a very important project that we use ourselves. Furthermore, we are announcing the "Living Off the Pipeline (LOTP)" project - to share the know how in protecting supply chains.. https://lnkd.in/etC6y7K5
Just published "The tale of a Supply Chain near-miss incident" article about a responsible disclosure my team boostsecurity.io made as well as announcing the Living Off The Pipeline (LOTP) project. https://lnkd.in/gnWvUS3A
The tale of a Supply Chain near-miss incident
medium.com
-
Software build infrastructures continue to be an attractive target for sophisticated attackers... https://lnkd.in/gftsHm4p
Echoes of SolarWinds: JetBrains TeamCity servers under attack by Russia-backed hackers
scmagazine.com