Stay Ahead With Linux Security Features
threat detection scalability Building a SIEM is easier than scaling one. Most open-source deployments start as a simple "all-in-one" server. It is easy to set up, but that design rarely survives the transition from a lab to a production workload. . A SIEM watching 20 endpoints is not doing the same job as one watching 500. More endpoints mean more logs; more logs require more storage; more storage makes search heavier. Eventually, the very architecture that made your lab easy to deploy becomes the reason your production...
Jun 04, 2026
security advisory apache A newly disclosed attack technique called HTTP/2 Bomb is drawing attention because it targets the software that sits at the front of much of the Linux internet. Apache HTTP Server, NGINX, Envoy, and the ingress layers that many Kubernetes environments depend on can be forced into consuming disproportionate amounts of memory using relatively small amounts of attacker traffic. . For Linux administrators, the concern is not the HTTP/2 protocol itself. It is the possibility that a single...
Jun 04, 2026
security advisory important The compromise of Nx Console shows how much infrastructure now sits behind a single developer account. GitHub repositories, CI/CD pipelines, container build systems, Terraform projects, Kubernetes deployments. None of those systems was the initial target. The workstation was. . Attackers did not need a Linux privilege escalation bug or a remote code execution chain. They needed developers to trust a tool they were already using. For many organizations, that was enough. What Happened? Federal...
Jun 03, 2026
security advisory open-source You remove the malware. You rotate the compromised credentials. You patch the original vulnerability and close the ticket. Two weeks later, the attacker is back. . What happened? You didn't lose the battle at the exploit; you lost it at the cleanup. In many modern Linux intrusions, the malware you found wasn't the main problem—it was the fallback mechanisms left behind. These hooks quietly restore attacker access the moment you look away. If you clean a host but miss these persistence layers,...
Jun 02, 2026
security advisory Red Hat Researchers investigating a campaign now tracked as Miasma found that more than 30 packages in Red Hat's @redhat-cloud-services npm namespace had been altered to deliver credential-stealing malware. . The packages weren't being used to deploy ransomware or sabotage systems. From what has been reported so far, the objective appears to have been much simpler: collect credentials from developer environments and use that access elsewhere. GitHub tokens, cloud credentials, SSH keys, and other...
Jun 02, 2026
Refine features
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security features
We found 1 articles for you...
102
security advisoryvulnerability managementcontainer securitySecuring Kubernetes and Cloud-Native Environments through DevSecOps
As Kubernetes and cloud-native technologies become increasingly integral to IT infrastructures, we Linux security admins must adapt to a rapidly changing environment where agility and security converge. A recent CNCF survey highlights a significant uptick in Kubernetes deployment, with most organizations using container technology as a backbone for their applications. . This transformation urges security professionals to integrate new strategies that account for the shift towards DevSecOps and containerized environments. By combining role-based access controls, automated vulnerability scanning, and secure CI/CD pipelines, we can fortify our systems against emerging threats while maintaining the agility of cloud-native technologies. In this dynamic ecosystem, we must foster closer collaborations with development teams, ensuring that secure coding practices and robust container management become second nature across the organization. This means embracing tools and practices that enhance visibility and automate repetitive security tasks, freeing resources for proactive threat hunting and response. As Kubernetes and DevOps practices drive this new wave of cloud-native development, integrating security into every layer is no longer optional—it's imperative! This article explores the foundational strategies we can employ to effectively secure our cloud-native Linux environments. The Rise of Kubernetes and Cloud-Native Practices For organizations looking to accelerate application deployment and management, Kubernetes has quickly become a cornerstone. According to a CNCF's recent survey, Kubernetes deployments have surged, becoming an essential element in modern IT environments and increasingly being seen with DevSecOps (an approach that merges development and security operations). DevSecOps attempts to integrate security as part of the software development life cycle rather than as an afterthought. Adopting Kubernetes and other cloud-native practices requires an in-depth knowledgeof its technology stack and any vulnerabilities it might introduce. Containers offer advantages in terms of scalability and efficiency, but present unique security challenges. We, Linux security administrators, must become adept at using new tools and practices to safeguard these dynamic, distributed systems. Integrating DevSecOps in Containerized Environments DevSecOps is key to modern application security. This approach integrates security practices directly into the continuous integration and delivery pipeline, guaranteeing automatic and constant protection. For us, Linux security administrators, this means working closely with developers from the outset on secure code creation using automated testing and vulnerability scanning systems to detect vulnerabilities before they reach production environments. Building DevOps Security (DevSecOps) into the pipeline helps teams catch issues earlier and keep security aligned with the speed of modern software delivery. Automation is key for effective DevSecOps implementation. Tools automatically scanning container images or enforcing security policies at runtime are vital and should be integrated early into the development process to facilitate quick feedback loops so developers can address potential vulnerabilities without significant delays. Role-Based Access Controls: The First Line of Defense A key aspect of protecting Kubernetes environments involves effectively managing access. Implementing robust role-based access controls (RBAC) is an indispensable way of protecting accounts from being breached or used for malicious reasons, limiting damage caused by compromised accounts, and protecting users. RBAC should be tailored to organizational needs while upholding least privilege practices, ensuring roles and permissions fit organizational priorities while giving individuals equal privilege. This means establishing clear policies regarding who can deploy, manage, or access specific resources within a cluster. This ensures users only possesspermissions necessary for their roles, thereby decreasing risks related to accidental or malicious alterations to system configurations. Automating Vulnerability Scanning and Monitoring Given today's ever-changing containerized environment , continuous scanning for vulnerabilities is essential. Security admins should implement automated tools that regularly search container images and their respective infrastructure for new vulnerabilities while providing real-time alerts to quickly respond to threats identified as being present. Monitoring should go beyond vulnerability management and encompass runtime security as well. Anomaly detection and behavioral monitoring detect threats in real time and mitigate them immediately. Through advanced monitoring solutions, security teams gain deep visibility into Kubernetes environments, enabling them to detect suspicious activities more easily while responding proactively. Securing the CI/CD Pipeline Organizations looking to foster agility and innovation have increasingly adopted continuous integration and continuous deployment (CI/CD) pipelines to ensure rapid software updates. However, these pipelines could become vulnerable if they're not secured properly. Securing the CI/CD pipeline requires more than simply adding automated security checks. It demands a cultural shift where security considerations are considered at every step in the development process. This may involve performing thorough code reviews, using secure coding practices , and keeping dependencies up-to-date. Bridging the Gap Between Security and Development Admins wishing to successfully incorporate security measures in cloud environments must often adopt a collaborative approach in their security-development partnerships. When successfully incorporating security into cloud applications and environments, administrators must adopt an approach where both teams collaborate closely to integrate it as part of the application creation and deployment processes. To facilitatesuccessful security integration into these environments, however, both teams need to work as partners on embedding it throughout application creation and deployment processes. This may include regular cross-functional meetings to review security findings and create joint action plans, along with training or upskilling initiatives designed to better enable developers and security professionals to comprehend each other's perspectives and constraints, leading to more comprehensive security strategies. The Importance of Regular Security Audits and Compliance Compliance is an indispensable aspect of any security strategy. Regular audits ensure that an organization abides by relevant regulations and internal security policies. Kubernetes environments should undergo auditing regularly, from infrastructure configuration to application-level security, to ensure that an audit program upholds the highest standard of protection possible. Audits allow administrators to identify gaps in security policies and implementation, enabling them to progressively tighten defenses over time. They also keep administrators abreast of regulatory changes and industry best practices, essential elements in maintaining a strong security posture that guarantees both compliance with security obligations and resilience against cyber threats. Our Final Thoughts: Cloud-Native Security is the Path Forward for Linux Admins We, Linux security administrators, play a pivotal role in safeguarding cloud-native technologies and upholding robust security practices. By employing a proactive security approach that integrates security throughout development lifecycle processes, we enable ourselves and our organizations to achieve strong Kubernetes, container, and cloud-native security. Although we face formidable challenges, when equipped with the proper tools, practices, and mindset, we can successfully and safely lead our organizations into a cloud-driven future. This will protect networks and help businesses grow moreinnovatively while harnessing tech's potential without jeopardizing safety. . New strategies are essential for securing Kubernetes and cloud-native technologies in DevSecOps environments.. kubernetes, cloud-native, technologies, become, increasingly, integral, infrastructures. . Brittany Day
Apr 14, 2025
•
102
security testingvulnerability managementruntime protectionEffective Docker Security Techniques: Manage, Test, and Automate
In the dynamic landscape of contemporary software development, Docker containerization has emerged as a cornerstone, facilitating the efficient deployment and scaling of applications. However, fortifying their security measures becomes paramount as organizations increasingly embrace Docker containers. . This necessitates a comprehensive approach to Docker Container Security Vulnerability Management and Testing, incorporating industry best practices. Since security is not a universal concept, container security best practices offer a comprehensive framework that spans the entire software development lifecycle, from creating secure container images to runtime protection. Below is a complete guide on Docker container security vulnerability management and testing. Container Security and The Importance of Integrating Security Testing and Automated Deployment Container security refers to measures to secure the entire containerized application development and deployment process. This includes securing the container runtime, orchestration tools, and images. Integrating security testing and automated deployment into the container lifecycle is crucial to identify and mitigate vulnerabilities early in development. Security testing involves assessing the security posture of containerized applications through vulnerability scanning, penetration testing, and static code analysis. Automated deployment ensures a streamlined and consistent process for deploying containerized applications across different environments. Understanding Container Security Testing and Deployment Automation Container orchestrators, exemplified by prominent platforms such as Kubernetes, play a pivotal role in shaping the security landscape of containerized environments. These orchestrators are the backbone, providing a robust framework for managing, scaling, and orchestrating containerized applications. In the security realm, container orchestrators contribute significantly by offering advanced features and tools that bolster theoverall protection of containerized ecosystems. One fundamental security feature container orchestrators provide is Role-Based Access Control (RBAC). Kubernetes, for instance, offers a sophisticated RBAC system that enables organizations to define fine-grained access policies. By implementing RBAC best practices, organizations can ensure that users and processes within the container orchestration platform adhere to the principle of least privilege. This not only enhances security but also fosters a structured and controlled environment. Container orchestrators also offer comprehensive hardening guides and security checklists. Kubernetes, for instance, provides a detailed hardening guide that outlines best practices for securing various components of the orchestrator. This includes securing the control plane, worker nodes, and associated components. Security checklists offered by orchestrators act as practical guides for administrators, helping them configure and manage the environment with security in mind. In addition to RBAC, container orchestrators implement network policies to enhance security. These policies dictate communication rules between containers, ensuring only authorized interactions occur. By segmenting the network, orchestrators reduce the attack surface, limiting the potential impact of security breaches. Container orchestrators are designed with security in mind, providing an array of features to safeguard the deployment and runtime of containerized applications. They facilitate the implementation of security standards and best practices, guiding organizations in fortifying their container environments against potential threats. As container orchestrators manage the deployment and scaling of applications, they inherently contribute to security testing and deployment automation. Integration with CI/CD pipelines ensures that security testing becomes integral to the application delivery process. Security checks can be automated at different stages, from the creation of containerimages to their deployment in a production environment. What Is The Role of Container Orchestrator in Security Testing and Deployment Automation? Container orchestrators play a crucial role in managing and scaling containerized applications. These orchestrators also contribute to security testing and deployment automation by providing features that enhance the overall security posture of containerized environments. One key security feature provided by container orchestrators is network segmentation. By isolating containers into separate network segments, orchestrators prevent unauthorized container communication, reducing the attack surface. Additionally, orchestrators often include features for secrets management, allowing developers to securely store and manage sensitive information, such as API keys and passwords. This helps prevent security breaches arising from the exposure of sensitive data within containerized applications. Linux Container Vulnerability Management Linux container vulnerability management is a critical aspect of securing containerized environments. As containers share the host operating system's kernel, keeping the underlying Linux system secure is paramount. Regularly updating the host operating system and its components is fundamental to mitigating known vulnerabilities and maintaining a robust security posture. Vulnerability management tools , including OpenSCAP and Nessus, scan the Linux host for potential security risks. Proactive measures involve monitoring security advisories, subscribing to relevant mailing lists, and staying informed about the latest patches. By addressing vulnerabilities at the operating system level, organizations bolster the overall security of their containerized applications, creating a foundation for a resilient and protected container environment. Docker Container Security Testing Docker, a widely used containerization platform, requires specific attention to security testing. Docker container security testing involves examiningvarious aspects of the Docker ecosystem, including the Docker daemon, container images, and the Docker API. One crucial aspect of Docker security testing is ensuring the integrity of container images. Developers should verify the authenticity and origin of container images to prevent the deployment of compromised or malicious images. Implementing image signing and verification mechanisms, such as Docker Content Trust (DCT), adds more security to container images. In addition to image integrity, Docker security testing should focus on securing the Docker daemon. Access controls, network policies, and secure configuration settings are essential to prevent unauthorized access and potential exploitation of vulnerabilities in the Docker daemon. What Is The Role of Automation in Container Security? Automation is integral to adequate container security, allowing organizations to scale security processes, reduce human error, and respond swiftly to emerging threats. Automated security processes can be incorporated at various stages of the container lifecycle, from image build to deployment and runtime monitoring. Automated vulnerability scanning ensures that container images are regularly scanned for known vulnerabilities, and security teams receive immediate feedback on potential risks. This proactive approach enables developers to address vulnerabilities early in development, minimizing the exposure window. Access control and permission management automation help enforce the principle of least privilege, reducing the risk of unauthorized access and potential security breaches. Role-based access control (RBAC) mechanisms provided by container orchestration platforms enable fine-grained control over user permissions. Continuous monitoring and automated threat detection contribute to runtime security. Tools that monitor container behavior and detect anomalous activities help organizations identify and respond to security incidents in real-time. Practical Approaches to Integrate Security Testingand Automate Deployment Integrating security testing and automating deployment requires a strategic and collaborative approach within development and operations teams. Here are practical approaches to seamlessly embed security into the container development and deployment lifecycle: Incorporate security into CI/CD pipelines: Integrate security testing tools into CI/CD pipelines to automatically scan container images for vulnerabilities during the build process. This ensures that security checks are part of the automated deployment workflow. Automate compliance checks: Implement automated tools to check and enforce compliance with security policies and industry regulations. This includes scanning container images for compliance with security benchmarks and standards. Implement infrastructure as code (IaC): Use IaC tools like Terraform or Ansible to define and provision infrastructure in a repeatable and consistent manner. This ensures that security configurations are applied consistently across different environments. Security training for development teams: Provide security training to development teams to raise awareness about secure coding practices and potential security risks in containerized environments. Empowering developers with security knowledge enhances their ability to write secure code from the outset. Use secure base images: Start with secure images with minimal attack surfaces. Regularly update these base images to include the latest security patches. Tools like Docker Bench for Security can be used to check the security configuration of Docker hosts. Implement image scanning in registries: Utilize container image registries that support image scanning for vulnerabilities. This adds an extra layer of security by automatically scanning images before they are deployed, preventing the use of compromised images. Container runtime security: Implement runtime security measures, such as container network policies and runtime monitoring, to detect andrespond to security incidents during the execution of containerized applications . Collaborate across teams: Foster collaboration between development, operations, and security teams to ensure a holistic approach to container security. Regular communication and knowledge sharing help address security concerns at every stage of development. Future Trends in Container Security Testing and Deployment Automation As technology evolves, so do the challenges and solutions in container security. Several trends are likely to shape the future of container security testing and deployment automation: Shift left security: The trend of shifting security left in the development lifecycle will continue to gain prominence. Embedding security testing early in the development process allows for identifying and remedying vulnerabilities before they reach production. Enhanced orchestration security: Container orchestrators will continue to enhance their built-in security features, providing more robust tools for network segmentation , access controls, and secrets management. This will contribute to a more secure and manageable container environment. Integration of artificial intelligence (AI) and machine learning (ML): AI and ML technologies will significantly improve threat detection and response in containerized environments. Automated anomaly detection and intelligent security analytics will become crucial for identifying sophisticated attacks. DevSecOps adoption: The DevSecOps paradigm integrates security into the DevOps workflow and will become more mainstream. Collaboration between development, operations, and security teams will be further strengthened to ensure a holistic and continuous approach to security. Immutable infrastructure: The concept of immutable infrastructure, which is treated as code and cannot be modified after deployment, will continue gaining traction. This approach reduces the attack surface and ensures consistency in the environment. Zero trustsecurity model: Adopting a Zero Trust security model, where no entity, whether inside or outside the network, is trusted by default, will become more prevalent. This model aligns with the dynamic and distributed nature of containerized applications. Compliance as code: Compliance requirements will be increasingly addressed through code, using tools and frameworks that enable organizations to define, enforce, and audit compliance as part of their automated workflows. Container-native security solutions: Security solutions designed explicitly for containerized environments will continue to emerge. These solutions will provide specialized features to address containers' unique security challenges. Final Thoughts on the Importance of Docker Container Security Testing In an era where software development is becoming faster and more dynamic, the importance of robust security measures cannot be overstated. Docker container security testing is not merely a compliance checkbox but a critical aspect of building and deploying resilient applications. By integrating security testing and automation into the container development lifecycle, organizations can identify and remediate vulnerabilities early, reducing the risk of security breaches. The collaboration between development, operations, and security teams is pivotal in establishing a culture of security that permeates every stage of the containerized application lifecycle. As container technologies evolve, staying informed about emerging security trends and adopting best practices will be essential for organizations aiming to build and maintain secure container environments . The future of container security lies in proactive, automated, and collaborative approaches that prioritize the protection of applications and data in an increasingly complex digital landscape. . Uncover vital security tactics for Docker to protect against threats and guarantee safe application rollout.. Docker Security, Container Vulnerability Management, AutomatedDeployment, Security Testing Framework, Container Orchestration. . Duane Dunston
Dec 12, 2023
•
102
network securitydata breachcybersecurity threatsImproving Enterprise Security Posture With ManageEngine Tools
Enterprise vulnerability management is vital to having a robust, proactive endpoint security strategy that enables organizations to identify and address data and network security issues before they lead to an attack or cloud security breach. This cyclical process involves identifying IT assets and correlating them with a continually updated vulnerability database to identify network security threats, misconfigurations, and bugs. Such management prioritizes the urgency and impact of each issue so your company can respond to critical cybersecurity vulnerabilities swiftly prior to exploitation. . Despite the value of establishing and maintaining vulnerability management tools to strengthen and improve security posture, too many organizations still fall short in obtaining such a service due to various challenges and roadblocks. Unfortunately, more businesses fall victim to breaches than ever before; in fact, global cyberattacks increased by 38% in 2022. In order to protect against cybersecurity vulnerabilities, enterprises need an end-to-end vulnerability management and compliance solution that provides 360-degree visibility into their security risk exposure and offers built-in remediation. In this article, we will discuss the obstacles businesses face when setting up their enterprise vulnerability management, the benefits of having this effective service, and how it can help defend against damaging cybersecurity threats and vulnerabilities. Why Are Vulnerability Management & Compliance Critical Challenges for the Enterprise? Despite the central role that vulnerability management holds in an effective endpoint security strategy, there are common roadblocks that organizations face that impede their ability to reliably identify and fix security risks and shortcomings. In most organizations, there are simply too many cybersecurity vulnerabilities across thousands of heterogeneous assets in distributed networks to be tracked manually, and not all of them pose an equal risk. With the window between networksecurity threats and hackers shrinking, organizations must be swift in their detection and remediation of such cybersecurity weaknesses. It is unrealistic for organizations to move forward without the assistance of an automated enterprise vulnerability management and compliance solution, as so few companies have the time, resources, and knowledge to be able to combat network security issues effectively on their own. Anandraj Paul, Head of Development and Endpoint Security at ManageEngine, states, “Many vulnerability management tools on the market offer patching through a third-party integration, but juggling multiple tools for vulnerability assessment and patch management results in a fragmented and inefficient workflow. Moreover, if an adversary does use a vulnerability to gain access to the network, they will exploit overlooked misconfigurations to laterally move and compromise other machines within the network. To prevent this, every loophole and software vulnerability must be addressed to minimize the attack surface and strengthen security." Linux Security expert and LinuxSecurity.com Founder Dave Wreski adds, “ While issuing vendor-published patches to affected machines is the ideal remediation option, having a fail-safe plan to fall back on in the case of unpatchable circumstances like end-of-life software and zero-day vulnerabilities is essential to preventing attacks and breaches.” Security Spotlight: How ManageEngine Vulnerability Manager Plus Meets Our Criteria for an Effective Vulnerability Management Solution ManageEngine Vulnerability Manager Plus is a multi-OS vulnerability management and compliance solution we love since it is an effective and efficient solution. It is an end-to-end vulnerability management tool delivering comprehensive coverage, continual visibility, rigorous assessment, and built-in remediation of cybersecurity threats and vulnerabilities, all from a single console, wherever your endpoints are located. Let’s take a closer look at what makes ManageEngineVulnerability Manager Plus a great option for organizations looking to improve security posture without sacrificing convenience. Cybersecurity Vulnerability Assessment With the plethora of network security issues that exist in OSes, third-party software, programs, and applications today, organizations need to be able to identify and prioritize real data and network security threats, as new vulnerabilities are identified every 90 minutes. ManageEngine Vulnerability Manager Plus enables organizations to assess and prioritize cybersecurity vulnerabilities based on exploitability, severity, age, affected system count, and the availability of the fix. ManageEngine’s cybersecurity vulnerability assessment tool regularly scans your network for weaknesses, delivers insights into risk, and helps close the vulnerability management loop instantly with direct remediation from the console. With ManageEngine, organizations can: Eliminate blind spots and keep track of assets. Gain extensive vulnerability coverage. Catch online and web application security vulnerabilities as they appear using continuous monitoring logs. Assess vulnerability risk and prioritize response. Enable cybersecurity vulnerability management to see critical network security issues at a glimpse with dashboard widgets (pictured below). Leverage built-in security patching to ensure swift and accurate remediation. Compliance Modern IT’s dynamic nature causes inevitable security gaps, as IT teams are forced to make constant changes to configurations, which can lead to newer systems and software being overlooked, leaving them with insecure setups. Poorly configured systems pave the way for malicious hackers and pose significant compliance risks by incurring hefty fines from regulatory bodies. The Center for Internet Security (CIS) benchmarks provide prescriptive guidance for establishing a secure baseline configuration for assets. However, the requirements are challenging to meet, monitor, and maintain without the helpof a solution like ManageEngine Vulnerability Manager Plus. ManageEngine’s CIS compliance feature helps accomplish and maintain data and network security as well as audit objectives, as over 75 CIS benchmarks regularly monitor your endpoints for all applicable CIS benchmarks, instantly detecting violations and suggesting detailed, corrective actions. The feature allows organizations to easily: Group policies. Map targets and schedule audits. Audit and improve compliance. Patch Management Once your cybersecurity vulnerabilities get identified and assessed, the next step is to utilize security patching to protect your company against damaging exploits in cybersecurity. In order to be effective, efficient, and secure, patch management must be carefully planned and orchestrated. If not, it can potentially cause more harm than the vulnerabilities it is supposed to address. ManageEngine Vulnerability Manager Plus has a built-in patching module that helps you customize, orchestrate, and automate complete patching so that the process is to your liking. The module gives organizations the ability to: Seamlessly patch a heterogeneous, multi-platform IT infrastructure. Test, approve, and decline patches. Automate patch deployment. Customize the patch management process with flexible deployment policies Security Configuration Management Zero-day cybersecurity vulnerabilities are inevitable. Without ensuring you have established and maintained ideal data and network security configurations in your endpoints, a single vulnerability could shake your organization to the core. Effective security configuration management tools involve continually detecting configuration drifts and misconfigurations across various components in your endpoints so you can focus on bringing them back into alignment. ManageEngine Vulnerability Manager Plus facilitates the entire cycle of security configuration management from a single interface, including detecting misconfigurations, categorizing andprofiling them, resolving them with built-in remediation, and reporting the final configuration posture. The solution’s capabilities verify that the data and network security of systems is enforced with complex passwords, least privileges, memory protection, and CIS and STIG security guideline compliance. Web Server Hardening Web servers are the point of contact between a business and its customers. Servers deliver web pages to clients upon request and host websites and web-based applications. Since a web server is an Internet-facing device, it can provide an entry point for attackers if not configured properly. In order to keep pace with industry demands, enterprises must constantly make changes to their server configurations, but making these changes manually often results in dangerous configuration drifts. ManageEngine Vulnerability Manager Plus continuously monitors your web servers for default and insecure configurations so it can display them in the console. With a vulnerability management tool, administrators and IT teams can identify servers whose communications are not secured via a Secure Sockets Layer (SSL) certificate. SSL certificates are valuable for ensuring data encryption and decryption to protect companies from unauthorized interception. ManageEngine Vulnerability Manager Plus provides a detailed description of the cause, impact, and remediation of each server misconfiguration. These critical insights can be used to help set up a secure server that is protected against attacks in network security, including URL manipulation attacks, input validation attacks, Denial of Service attacks, brute-force attacks, session hijacking, clickjacking, and source code disclosure, among other network security threats. High-Risk Software Audit The proliferation of different devices and software in recent years, especially post-pandemic, has inevitably put enterprises at risk of unsupported and unauthorized software, including end-of-life software, peer-to-peer software, and remote desktopsharing software. This software can compromise a corporate server with network security threats like information disclosure, malicious code injection, and unauthorized access, all of which can damage an organization's data network security and reputation. It is of critical importance to audit such high-risk software installed in network systems without administrators’ knowledge. With ManageEngine Vulnerability Manager Plus at your disposal, you can: Monitor your network endpoints continuously and detect end-of-life software, peer-to-peer software, and remote sharing tools present in them. Get details on the expiry date and the number of days before software in your network faces end-of-life. Obtain real-time information on the number of machines that are affected by this software. Eliminate this software with just a click of a button from the console. Zero-Day Vulnerability Mitigation Though we would all love to put an end to cybersecurity vulnerabilities once and for all with security patching, such a solution is not always realistic. In some cases, patches aren't available to fix flaws, mainly when they are zero-day vulnerabilities and other publicly disclosed network security threats. Luckily, ManageEngine Vulnerability Manager Plus can help organizations harden their systems and software against network security issues that have no patching options. This vulnerability management tool allows enterprises to: Leverage a dedicated view for zero-days. Deploy mitigation scripts. Stay up-to-date with the latest security patching opportunities. Get notified about zero-day patches. Keep track of OS and application end of life. With ManageEngine Vulnerability Manager Plus, you can stop waiting around for patches and deploy pre-built, tested scripts to secure your network with zero-day mitigation solutions. Beyond the Capabilities of Traditional Vulnerability Management Tools ManageEngine Vulnerability Manager Plus exceeds the capabilities of traditional vulnerabilitymanagement and compliance solutions in the following critical areas to provide stronger, more reliable protection against cybersecurity vulnerabilities: Executive reports : Review and improve security posture to make informed decisions with holistic reports. Antivirus Audits : Gain insight on antivirus protection across your network systems. Deployment Policies : Decide when to patch, what to patch, and how to patch. Role-Based Administration : Define roles and delegate tasks to technicians based on enterprise needs. Final Thoughts on Securing Your Organization Against Cybersecurity Vulnerabilities With the increase in cybercrime and the growing complexity of the modern IT infrastructure, a comprehensive, automated vulnerability management tool and strategy has never been more important for your enterprise. ManageEngine Vulnerability Manager Plus exceeds the capabilities of traditional vulnerability management solutions to improve security posture, increase visibility, and help businesses meet compliance standards. Anandraj Paul, Head of Development, Endpoint Security, ManageEngine, explains, "There's no silver bullet solution that renders your network impenetrable to cyber exploits. But by constantly reevaluating and strengthening the security stance of your network with Vulnerability Manager Plus, you stand a much better chance against detecting and thwarting cyber trespassers in your network." Ready to improve your vulnerability management and compliance strategy to ward off cyberattacks in network security and cloud security breaches? We encourage you to download ManageEngine Vulnerability Manager Plus and see for yourself why we recommend it so strongly! . Evaluating organizational vulnerability management strategies is vital for strengthening endpoint security and reducing the risk of data breaches effectively. Enterprise Security Management, Cyber Threat Mitigation, IT Compliance Strategies, Risk Assessment Tools, Endpoint Vulnerability Solutions. . Brittany Day
Mar 20, 2023
•
102
security measuressecurity riskvulnerability managementExploring Open-Source Security Risks And Improving Software Safety
While allowing public access to the sensitive behind-the-scenes operation of a program sounds risky, open-source software actually has the potential to be even more secure than a program with hidden code. However, as with any type of software, vulnerabilities still exist and can present a serious security risk if they remain unidentified and unpatched. . Open-source is software with publicly accessible code that anyone can view and contribute to, and forms the foundation of the Internet we use today. The popularity of open-source code is rising–not only are more programs using open-source code but a larger portion of the average software comes from open-source resources than ever. Today, open-source code can be found in virtually every application we use online, and open-source development is the focus of many of the world’s largest companies. In order to ensure our data online is secure, we must first make sure that the technology that provides this capability is secure. This article will explore the security risks that bugs in open-source software pose and measures that are being taken to secure open-source software against vulnerabilities and exploits. A Brief History of Open-Source Software Open Source first became mainstream in the 1990s thanks to the creation of Linux and the publication of the source code of the Netscape Communicator Internet suite. While the development of software has always been collaborative, the spread of open-source software represented a new step in the collaboration that is necessary for large scale software development. By allowing anyone to view, modify, and borrow from their code, developers can let anyone improve and contribute to their ideas. Security-wise, open source code means that bugs and security flaws no longer sit unnoticed until they are exploited—anyone can find, report, or fix mistakes. Vulnerabilities in Open-Source Software Pose a Great Security Risk As open source software and libraries become a bigger part of the code used for theinfrastructure of the technology that society relies upon, it is essential that open source code is properly checked for security issues. While most exploits are patched before they are taken advantage of, there have been attacks on open-source software in the past, such as the event-stream attack, in which a programmer purposely added malware to the popular event-stream Node.js library. One recent example of a major bug in open-source software is an exploit found in Log4j , an open-source library used by countless programs to log the actions that they perform. The exploit, known as Log4Shell, made it possible for attackers to execute malicious code in software that used Log4j. Because so many programs use the Log4j library, the potential for damage using the exploit was more widespread than if every program had its own unique logging code. Even though open-source software is not inherently more secure and is susceptible to larger scale attacks because of its widespread use, it has a great potential to be infinitely more secure than closed source programs because it allows anyone to contribute to its code and for users to fix bugs that they find. Because libraries like Log4j are so heavily reliant on unpaid volunteers to maintain, they often do not get enough attention relative to their importance. It has been recognized by security experts for some time that the widespread use of outdated open-source software is becoming a national security risk; however, due to Log4Shell, more people are becoming aware of the flaws of open source and the importance of only using up to date and secure open source projects. Since the log4j incident, developers and security researchers have been emphasizing the need for greater security in open-source software more than ever. Measures Are Being Taken to Improve the Security of Open-Source Software One way that open source-security is being promoted is through bug bounties . Bug bounties are a system in which organizations offer incentives forreporting bugs in their software. Bug bounties are not simply a lazy way for companies to test their code for bugs; as the scale of software grows and code gets more complex over time, bug bounties allow smaller teams to make bigger programs without sacrificing security. Additionally, it allows users to report bugs before they are taken advantage of. One bug bounty program is Open Bug Bounty, a website created in 2014 as a way to allow users to submit bugs they find using non-intrusive methods, which are then reported to the company. Over 800,000 vulnerabilities have been patched thanks to Open Bug Bounty. Another way open source is becoming more secure is sponsorship. According to Kent Walker, the President of Global Affairs at Google and Alphabet, one of the biggest flaws of open-source software is that there is “no official resource allocation and few formal requirements or standards” for its maintenance. Because open-source software is a fundamental part of so many companies– some estimates say that almost all commercial programs use open source code– organizations have begun to sponsor open-source development as a way to support the development and maintenance of the open-source code that they use. Dozens of companies recently committed $30 million dollars to fund The Open Source Software Security Mobilization Plan’s 10 step plan to improve the security of open-source software. Additionally, programs like GitHub Sponsors allow users to pay developers of open-source projects hosted on GitHub, one of the largest resources for open-source code. In addition to the measures being taken to check open source code for bugs, steps are being taken to better prevent errors. Organizations like OpenSSF, the Open Source Security Foundation, are attempting to rectify the lack of standards for open-source maintenance. In addition to hosting courses that teach secure development, OSSFs goal is to enhance the security of open-source projects by creating standards and training foropen-source software. After the Log4j incident, the government has also increased their role in the security of open-source software. The White House recently held a summit to discuss ways to improve the security of open source software, and President Biden signed an executive order recommending the writing of software bills of materials, or SBOMs. SBOMs are documents that list everything that a program uses as part of its supply chain in order to make the program easier to keep secure. For example, an SBOM might list what version of a programming language a software is written in, what libraries it uses, and what open source code it borrows from. This way, if an exploit is found in any of those individual components that could compromise the software, the software can be quickly updated. Some resources for staying up to date on software security include: LinuxSecurity Advisories NIST National Vulnerability Database CISA Known Exploited Vulnerabilities Catalog CERT Vulnerability Notes Database Final Thoughts As Open Source becomes a bigger part of software development, measures should be taken in order to improve the security of open-source projects. Software scanning tools can help analyze code for exploits and bugs in open source components that it uses. Additionally, average users can help keep open-source projects secure by contributing to code or bug bounties. It is also important to stay up to date on the latest exploits, something made easier with an SBOM. Ultimately, while open-source software has had security issues, it can be even more secure than closed source code when properly reviewed, and the growth of open-source software means greater potential for secure software. . Explore the journey of open-source software security, the challenges encountered, and tactics to protect both users and developers.. Open-Source Software Security, Security Measures, Vulnerability Management, Bug Bounty Programs, Software Development. . Yosef Davidowitz
May 31, 2022
•
102
open sourcesoftware developmentsecurity testingBenefits and Operations of Bug Bounty Programs for Open Source Security
Ethical hacking might sound contradictory, but leveraging the skills of the ‘white hat’ hacker community has done a great deal for safety and security on the internet. Nowhere does this show more than through so-called bug bounty programs created to tackle different issues within the code. Many bug bounty programs focus on identifying issues within software or applications. However, others focus on server or website vulnerabilities . . The Benefits of Open Source (and Its Primary Challenge) With the rapid development and sustainable iterations, open-source software (OSS) libraries and frameworks have been in massive demand. There are few traditional proprietary software that can match the fast-track development cycle using OSS. Additionally, it helps to pull down costs and reduce the time-to-market cycle by cutting down on time needed for custom coding. Instead, it mines existing OSS, which can be quickly shared, modified, and copied. While proprietary coding is far from dead, OSS now plays a huge role in the market. According to statistics: Both LAMP (Linux, Apache, MySQL, and PHP) and MEAN (MongoDB, Express.js, AngularJS, and Node.js) development stacks have become hugely popular, Android, one of the most popular Linux kernel operating systems on the market, runs on 85% of the world’s smartphones, Linux also powered three quarters of the public cloud workload over the pandemic. Statistics on the use of OpenSource suggest up to 70% of the world’s code databases are drawing on OpenSource. That’s impressive, but that means any risk related to OSS use has become critical to tackle. Open source has never been more important in the software community. The time when a vulnerability could come to light a few years later and be tackled then is long past. A fast, responsive debugging is our critical priority. What Are Bug Bounties & How Do They Work? So, how do we incentivize an unpaid, sharing space that brings the coders no revenue to produce results quickly? Cybercriminals are not going to come forward, after all. While many Linux and Open-Source developers take pride in their development and offer fixes as soon as possible, we can’t expect miracles from a product offered for free and often created in the developer’s spare time. How Do Bug Bounties Work? Bug bounty programs have stepped into this role. You’ll find them throughout the ‘Big Tech’ space, including those from Google, Microsoft, Facebook, and Apple, as well as smaller firms. Bug bounties are programs which pay out to interested parties who find and fix vulnerabilities in open-source code before impacting the platforms using them, adding an additional layer of security to software developed with OSS. Types of Bug Bounty Programs Bug Bounties fall into two categories - Private and Public. Public programs allow anyone who is interested to participate. While some may have specific restrictions based on the participants existing track rec ord or skill level, mostly anyone can report a potential exploit (and fix) to them within the bounty’s guidelines. Some are even offered off of the specific platform, focusing instead on the general body of OS code. Private programs work differently. They’re invite-only programs, choosing hand-picked ethical hackers based on their skill level and existing stats. Typically, invitees have already demonstrated great skill in testing the kind of applications the program is focusing on. While some will evolve to a public-style bug bounty later on, some remain private for their entire lifecycle. Many private programs are also specifically focused on critical coding sections of the platform, intending to boost security and limit vulnerabilities in their product offerings. What Are the Benefits of Bug Bounties? So, the primary benefit of bug bounties is easy to see. They offer a way to financially incentivize researchers to analyze code, report vulnerabilities, and close them before they become an issue. Critically, they also don’t ‘break’the primary value of OSS code - it stays free, shareable, and accessible to any party who needs it. What else do they do? Public Disclosure A more hidden side of the business is incentivizing these white-hat hackers to not publicly disclose what they find until the matter is fixed. This means cybercriminals don’t get an advanced warning of the issue until it’s too late to do anything with that information. Pay for Results Bug bounty programs only pay out when a specific chain of reporting and fixing has been followed. This means they don’t incentivize the wrong people to ‘milk the market’ by creating these issues, nor reward bad behavior - only the ethical hacker who closes, rather than exploits, the vulnerability. Discretion In some private bug bounty programs, you can even hand-pick who you want to invite to ‘hack’ your product, providing greater control and discretion to the market. Of course, a public program can get results faster, but it can also be overwhelmingly difficult to manage for smaller security teams. Continual Testing We’ve emphasized this already, but it bears repeating. Use of a bug bounty program allows programmers and software companies to keep a fresh and vigilant taskforce on the job, meaning that bug loopholes don’t only get identified in Beta, but continuously come to light. This becomes especially helpful as updates and new innovations to older software go live. Vast Body of Testers Even the largest companies cannot employ thousands of testers in-house. They can, however, access them through bug bounty programs. They give access to a huge body of willing testers, continually working to better the software and close dangerous loopholes. Diversity Working in tandem with our previous point, you also remove almost all bias when you run a bug bounty program. Testers come from wildly different backgrounds, skill sets, and walks of life, across all geographical boundaries. This allows a phenomenal testing pool. Scalability Bug bounty programscan be scaled up or down to suit the company. Smaller entities can start gently, but expand their testing if their product gains marketplace traction. You can onboard more expertise at critical times, such as during new updates or product launches, and scale it back when there’s less demand. Expense Despite the need to pay out on successful presentation of a solution, bug bounties typically work out cheaper in the long run than in-house testing. They certainly are cheaper than the loss to reputation and customer trust that can come when a critical vulnerability remains live, too. Skilled Labor It’s worth mentioning that you’re not paying for unskilled eyes, either. Private bug bounty programs get to hand-pick who they’re working with. Even public programs are working with skilled testers who have to demonstrate that they can close, not just identify, loopholes. So you’re always using the right people for the job. Control This also places a great deal of control in the hands of the company running a bug bounty. You set the rules, and the ethical hackers engaging with your product come to you with the solutions. You can choose how long the program runs, what sort of bugs are being tested for, what you pay out for, and a lot more. One single bug bounty program- the Internet Bug Bounty- has managed to uncover over a thousand defects in existing open-source programs, paying out a combined total of $750,000 to the hackers that came forward. On average, each bounty netted $500-$750, although some high-end bounties have capped at $25,000 for particularly lucrative loopholes. They’ve even used a ‘bragging rights’ billboard as extra incentive. Closing the Door on Open Source Loopholes with Bug Bounties Fortunately, Open Source software has the support of a very robust and engaged programming community. They’re already engag ed in making open source solutions faster, more effective, efficient, and secure. Bug bounties, however, offer an additional bonus for achieving results fast.They’re also a great way for an app, API, or other software to ensure it’s offering its customers only the best security in robustly examined and policed software, eliminating one of the biggest concerns with using OSS in the first place. What Are Some Notable Vulnerabilities that Were Fixed as a Result of a Bug Bounty? Part of the allure of an effective bug bounty program is that we never hear exactly what was fixed. Or, if we do, we only hear about it years after the exploit was live. While the results of ethical hackers’ hard work go live almost daily, part of the idea is that we never know quite what the original exploit was. However, one key bug bounty-created solution was the recent vulnerability patch released by Microsoft surrounding the CVE-2022-26904, which was uncovered as part of joint information shared by CrowdStrike and the US National Security Agency. This particular fix tackled a privilege escalation issue that allowed a ‘win a race condition to fall over into exploitation. In fact, a high number of the fixes now being released by Microsoft as part of their ‘Patch Tuesdays’ updates have been found through Microsoft-specific bug bounty programs. Multiply that by the many software and API updates going live daily, and you have a great idea of how important a solid bug bounty program can be to both companies and their end users. What Is Coordinated Vulnerability Disclosure? Coordinated vulnerability disclosure (CVD), formerly known as responsible disclosure, is a system for disclosure of vulnerabilities or flaws to the public after patches or remedies have been issued. This coordination distinguishes the CVD model from the "full disclosure" model. Because software developers often require time and resources to repair their mistakes, ethical hackers find these vulnerabilities. Hackers and cybersecurity experts consider it their social responsibility to make vulnerabilities public knowledge as hiding problems could cause a feeling of false security. To avoid this, thoseinvolved arrange a specific amount of time to repair the vulnerability. The time needed for an emergency fix or workaround depends on the potential impact of the vulnerability, ranging from a few days to several months. The market for bug bounties has developed over recent years, sparking heavy debate over the ethics of monetizing vulnerability reports. Some security experts have the expectation of compensation while others view this as extortion. How Do I Get Started with a Bug Bounty? What Skills Do I Need? Wondering how to get started with bug bounties? Obviously, participating in a bug bounty program needs a wealth of specialist knowledge. Participants need a solid grounding in computer networking, web technologies and protocol, and security mechanisms. This includes a solid grounding in security practices (and their hacking bypasses), common vulnerabilities in applications and the web, and how to find them. You will also need the skill set to patch and prevent these vulnerabilities, so most bug bounty program participants are either coders themselves, or the so-called ‘ethical hackers’ who test their coding boundaries with the aim to help resolve, rather than exploit, them. Remember that these are ever-evolving skill sets, and you will need to stay up-to-date on current industry trends and changes. If you’re starting from scratch, there are bug bounties for beginners resources you can use to start honing your skills. From there, most potential program participants will start in public bug bounty programs to build and polish their skills. Bug bounties lists are pretty easy to find. There’s even a bug bounties Reddit sub to explore! So it’s less a case of where to find bug bounties, and more. Focus on companies with bug bounties for software you feel most confident in. Earning a reputation in public programs is often the key first step to being invited to private programs. Is There Training on How to Get Into Bug Bounties? Yes, there are! If you’re brand new to the idea,but keen to get started, there are some quality resources you can use to help you get going. Books & e-Books Believe it or not, there’s a wealth of traditional book and e-book resources that can break you into the basics of ethical hacking. Kevin Mitnick’s Ghost In The Wires: My Adventures as the World’s Most Wanted Hacker, The Web Application Hacker’s Handbook: Finding and Exploiting Security Flaws, and Peter Yarworski’s Web Hacking 101: How to Make Money Hacking Ethically are three great places to get started if you like this learning format. There’s plenty more. Training Courses Many sites also offer training on ethical hacking, especially now that bug bounties have taken off. Of course, you’ll want to do your due diligence and make sure you aren’t forking over cash without vetting the true credentials of the learning portal. Here’s some tuition providers with the experience to back their claims: Bug Bounty Hunting on YouTube 100 Bug Bounty Training Lessons Portswigger’s Web Security Academy SANS Cybersecurity Roadmap from the SANS Institute [Would you like to be listed here? Send us a note at
May 26, 2022
•
102
patchingcomplianceautomationEnterprise Linux Compliance: Insights on Patching and Resource Management
The Linux vulnerability landscape is becoming increasingly complex, in part due to a seemingly never-ending number of new vulnerabilities that are constantly surfacing. . Even when Linux-based operating systems are used at a small scale, it is challenging to patch vulnerabilities consistently. At an enterprise scale, the task of managing hundreds of vulnerabilities over fleets of thousands of servers is not simple at all. Yes, there are a variety of tools that can help – but awareness of tools such as automated patching and live patching varies, and these tools are used inconsistently. With the management of vulnerability assessment and patching varying so much from one organization to another, TuxCare set out to investigate how enterprises approach this challenging task. Our survey, State of Enterprise Vulnerability Detection and Patch Management, revealed several interesting insights into how organizations handle vulnerability and patch management at an enterprise scale. The survey explores how these tools are used and examines the restrictions faced by organizations in their ongoing fight against threat actors. Vulnerability Management Is a Compliance Priority One of the reasons that TuxCare initiated a survey into the enterprise vulnerability and patching environment is that, for large organizations, vulnerability management and patching is a compliance issue. Over and above the obvious security concerns surrounding vulnerabilities, enterprise Linux users also need to meet compliance obligations. In other words, there are laws and regulations in place that demand that large organizations meet minimum requirements around the remediation of vulnerabilities. Where organizations covered by these regulations fail to meet minimum requirements it can lead to stiff penalties. The rules that apply to companies operating in a specific industry vary, with organizations that deal with personal data – finance and healthcare firms, for example – under much stricter supervision. We mentioncompliance because it has a direct effect on how large organizations approach vulnerability management and patching. Some enterprise Linux users must respond much faster to emerging vulnerabilities than others. The results we gathered in our survey clearly highlight how compliance requirements affect day-to-day vulnerability operations. The TuxCare Enterprise Vulnerability and Patch Management Survey TuxCare started surveying key IT security personnel across enterprise organizations at the start of 2021. We wanted to take a close look at three key aspects of vulnerability and patch management: deployment practice, maintenance windows, as well as the broader level of security awareness in an organization. We published the initial results, but the survey is still actively running and you are welcome to contribute . Initial responses have already revealed several interesting observations. From the start, we noted that the geographic location of the respondent had a negligible effect on the response we received. In other words, there was no correlation between the location of a respondent, and the answers returned by that respondent. That indicates that vulnerability and patch management practices are roughly the same across the globe. However, our survey revealed significant differences between industries. The sector in which an organization operates clearly has an impact on the way that an organization manages vulnerabilities and patching. Taking a First Look at the Results A few points jumped out at us. For example, we noted that automated patching is commonly used by organizations around the globe, as 76% of our respondents said that they apply automated patching across their workloads. We also noted that live patching, a step up from automated patching, is in use at many organizations, as about half of our respondents reported that they relied on live patching to fix vulnerabilities. It makes sense that, at the enterprise scale, teams would rely on automated and live patching because of thesheer number of vulnerabilities that require patching. Given today’s pervasive cybersecurity threats, it is no surprise that automation is a commonly used tool, so we found it interesting to note that manually researching vulnerabilities via online resources is in fact the most commonly used tool in our respondents’ vulnerability management arsenal. Even though automation of vulnerability management is commonplace, comprehensive vulnerability management still requires a few manual steps. Another interesting fact emerged: 73% of our respondents suggested that their server fleets rely on a single Linux OS. In other words, rather than utilizing a specific Linux distribution for each different server role, most respondents reported that they picked a single OS – in most cases, it was CentOS or a fork of CentOS. Organizations are probably choosing to do so because using a single distribution makes maintaining server fleets so much easier – whereas a mix of distributions increases the time spent on server maintenance and addressing vulnerabilities. Vulnerability and Patch Management Practices Vary by Industry Looking more closely at what our respondents said, we noticed that vulnerability and patch management procedures and practices varied significantly from one industry to another. For example, when compared to the banking and financial services sector, respondents in the tech sector reported spending three times as much time in any given week on vulnerability monitoring. It’s possible that tech sector respondents are simply much more aware of cybersecurity threats than those working in banking and finance. Another observation we made is that the tolerance or indeed the need for patching-related downtime varied significantly from one industry to another. In transports and logistics, our respondents reported that their organizations experienced around 15 hours a week of patching-related downtime. In contrast, respondents working for healthcare enterprises reported downtime of only about anhour a week. The staff resources dedicated to monitoring for vulnerabilities also appear to be allocated very differently depending on the industry the respondent works in. In public and social services, respondents suggested that a large proportion of staff hours are spent on monitoring tasks – whereas respondents in the industrial sector said that very little time is spent on monitoring for vulnerabilities. Resources Remain a Restriction In the last section, we pointed to the allocation of staff resources when it comes to vulnerability management. Staff hours are a limited resource, and we found a few interesting trends in the responses we received. First, when it comes to documenting patching efforts, our respondents reported that documentation takes up very little time when compared to the other efforts made around patching. In fact, we found that respondents suggested that trying to settle on a maintenance window that keeps everyone happy takes up a significant amount of staff time. We suspect this may be because of the many stakeholders involved in settling on an acceptable maintenance window – after all, maintenance windows cause significant disruption. Resourcing is without a doubt a restriction, as 38% of our respondents said that they wanted to increase their IT security headcount in an effort to improve how effective their patching regime is. In further supporting evidence, 29% of respondents suggested that on at least one occasion patch installation was delayed because of a lack of resources. That’s probably why 54.5% of our respondents said that the staff resources at their disposal are not sufficient to meet the patching workload. A further 27.2% indicated they have active plans to hire more staff to cope with the growing vulnerability and patch management workload. The Tools that Support IT Security Staff We also asked our respondents to give us some insight into the tools used to support the human efforts behind vulnerability and patch management. We found that there wereseveral key tools that respondents suggested would help them make better use of the resources at their disposal. In response to our survey, respondents pointed to several features that they would like to see in a patch management tool. First, enterprise Linux users wanted quick responses to new CVEs to ensure new vulnerabilities are rapidly covered. Live patching was also top of the list, while respondents wanted to see more comprehensive automated reporting. We left the question open-ended. One respondent suggested that vulnerability tools should offer better logging capabilities than they currently do. That may be because many tools simply do not offer a lot of transparency into the functionality of the tool, or how the tool modifies systems as it manages vulnerabilities. Our respondents requested a few other features, including phased rollouts to manage patching in a more controlled manner in order to prevent disruption. The Implications for Enterprise Linux Users Just like any other major operating system, Linux-based operating systems are subject to new exploits on a weekly - if not daily - basis. The number of exploits keeps growing and one of the reasons for this is that threat actors rely on automation to f ind vulnerabilities. Battling a cybersecurity threat that’s underpinned by automation won’t be easy and using automation in security efforts is really the only way forward. This includes patching automation, already used by many of our respondents. Similarly, automated vulnerability management tools that have just the right feature set will prove equally valuable. It is heartening to see that so many of our respondents are engaging with automated and live patching, but neither of these tools has full penetration and there is little doubt that automation is the best way forward. Win a Course for Kubernetes We stated earlier that the survey is still running. Even though we’ve collated some of the initial responses, we’re still eager to hear from respondents working in theenterprise Linux environment. For this reason, we’re offering ten free CKA (Certified Kubernetes Administrator) certification courses run by the Linux Foundation. You stand the chance of winning one of ten courses from us simply by completing our survey on this link . By completing the survey, you also help us to gauge how vulnerability and patch management is handled by enterprise Linux users. Don’t forget – you can download the full report covering the initial results of our survey, State of Enterprise Vulnerability Detection and Patch Management, state of enterprise vulnerability detection and patch management report . Thank you to CloudLinux for contributing this article. . Handling weaknesses in corporate Linux systems poses challenges; delve into observations regarding regulatory standards, software solutions, and best practices within the sector.. Enterprise Security, Patch Management, Vulnerability Tools, Cybersecurity Insights, Linux Compliance. . Brittany Day
Jul 13, 2021
•
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!
Discover faster search, smarter navigation, and deeper Linux security insights. Read More