ref: https://medium.com/devopscurry/securing-your-ci-cd-pipelines-with-devsecops-in-2021-1a6a6e34f2e7

本篇文章作者想要探討的是如何透過 DevSecOps 的概念來強化你的 CI/CD 流程。

文章開頭探討了些關於 DevOps 文化以及對團隊帶來的改變，如何將 Dev, Ops 的工作流程給帶入到一個不同的領域，這部分想必大家都熟識了，所以這邊就不敘述太多。

接者作者開始思考，CI/CD 這種自動化的過程中，如果我們想要檢查資安與安全性相關，那到底有什麼樣的資訊市值得我們去檢查與研究的?

假設今天採用的是市面上 SaaS 服務的所提供的 Pipeline 平台，這些平台本身的資安問題並不是使用者可以去處理的，這方面只能仰賴這些服務提供商能夠有效且安全的去防護系統。因此作者認為我們應該要將注意力放在我們自行設計的 pipeline 過程中。

作者接者列舉了幾個議題，譬如

1. Source Code Vulnerabilities
這個議題要檢查的是軟體本身是否有相關的漏洞

2. OSS Library Vulnerabilities
所有使用到的 OSS Library 也都可能有漏洞需要注意，所以平常也要多注意 CVE 相關的資訊，有任何可以修復的機會時，團隊一定要評估是需要升級相關的 OSS

3. OSS Version
OSS 的社群也是會不停的開發與迭代，某些版本可能多年後就不被該社群團隊給維護，所以如果目前使用的 OSS 版本已經被標示為 deprecated，那意味就算有任何漏洞可能都不會有相關維護者去補修。因此團隊也要審慎評估是否要趕緊升級到一個有被維護的版本

4. Identifying Compromising Credentials
CI/CD 系統中不免都會有一些跟機密資訊有關的資料，這些資料是有可能當初處理時沒有被妥善管理，譬如不小心被 commit 到 source code 之類的，這部分的錯誤也都要避免。

檢查方面，作者提出不同的方式來檢查，譬如
1. Static Application System Testing(SAT)
程式編譯前的靜態掃描，該方法會嘗試分析程式碼本身是否有安全性漏洞，也是俗稱的白箱測試。

2. Active and Passive penetration t est (Dynamic Analysis)
3. Infrastructure Analysis
該方法包含了檢查環境中用到的設定檔案，伺服器狀態等，透過這些資訊來了解當前是否有什麼潛在的問題

最後，作者列舉出一些相關的工具，譬如
1. Checkmarx
2. IMMUNIO
3. Aqua Security
4. OWASP Zed Attack Proxy
5. Twistlock
6. CyberArk
7. WhiteSource
8. CHef InSpec
9. Fortify Webinspect

It was my turn to lead a community Drama workshop this Sunday morning!

Just as much as I shared skills of storytelling, I equally learned from the participants’ narratives-- experiences that are dug up, discussed, questioned and celebrated.

I shared how important the mind is in the practice of Dramatic Arts—from having focus, to “being present,” to listening, reacting, and thinking of subtext. The discussion then spontaneously moved to our perceptions of ourselves, the power we have to change our thoughts, and in the process, navigate through the tougher terrains of conflict, discrimination, anxiety, self-doubt.

I learned about new scams that prey on vulnerabilities of migrant women (that will be for another day, cause the thought makes me angry), but I also learned about the efforts they have taken upon themselves to build community—to listen to each other, and manage the anxieties that have heightened due to the pressures of the pandemic.

Theatre has always been a means for empowerment. To see our stories being enacted in front of us allows us to question the structures we have made ourselves accustomed to. More than that, however, it allows us the chance to change them—first in thought, then in practice.

A special thanks to Lakshmi and Pranisha, our student leaders who inspired these workshops through the @Kids4Kids Action for a Cause project. Because of the discussions today, they asked me, “Where does Racism come from? Is it taught to us as we grow?”

That was a tough discussion. I’ll save that for another day.

NT 370 特價中

學習格式化字串漏洞的正確方法，破解 CTF 和最難的認證考試

從這 1.5 小時的課程，你會學到

✅ 學習針對 x64 處理器的實用格式字串漏洞概念
✅ 學習如何在 x64 處理器的 Linux 上利用格式字串漏洞洩露記憶體地址
✅ 學習如何在 Linux 上繞過x64處理器的堆疊金絲雀
✅ 學習先進的 Linux 二進位制漏洞概念
✅ 學習如何使用 pwntools 二進位制開發框架

https://softnshare.com/format-string-vulnerabilities/

ทันไอที : อัปเดตข่าวกระชับ ครบ จบที่เดียว

: 00:06 DxOMark คะแนนทดสอบกล้อง Galaxy S20 Ultra ทำคะแนนได้เพียงที่ 5 เท่านั้น (อ่านข่าวเต็ม :https://www.dxomark.com/samsung-galaxy-s20-ultra-camera-review/?fbclid=IwAR1m8G2qyfr7iuL7O6W7jUbA2MXDA1DXn-YuG-MNEJwGEq3z09aQZGPJTn8 )

: 03:46 พบช่องโหว่ในแอปเมลของ iOS ที่แฮคเกอร์เจาะเข้ามาดูได้ด้วย!! (อ่านข่าวเต็ม : https://blog.zecops.com/vulnerabilities/youve-got-0-click-mail/ )

: 05:49 Nintendo เตรียมเร่งการผลิต Switch เพิ่ม 20% ภายในปีนี้ (อ่านข่าวเต็ม : https://www.businessinsider.com/nintendo-switch-production-increasing-animal-crossing-2020-4 )

: 07:20 Messenger Kids ให้ผู้ปกครองดูแลการใช้งานของเด็กได้ พร้อมดาวน์โหลดในไทยแล้ว (อ่านข่าวเต็ม : https://about.fb.com/news/2020/04/expanding-messenger-kids/ )




8 โมงเช้า จ.-ศ. กับ Kengkawiz

#IT #tech #update #news

Kim Huat looks at factors that affect Singapore's egg situation, exploring the four pillars of food security: availability, access, utilization, and stability.

What does Singapore do, moving forward? How does the domestic politics of Malaysia impact the self-sufficiency of our tiny island nation and the availability of pomfret for Chinese New Year reunion dinners? What are the threats to our egg supply and how do we bear the yolk of our vulnerabilities?

This, and other deep academic thoughts, by Kim Huat, Singapore’s foremost expert in being hungry all the time.

a production of https://mrbrown.com

Yes, this is a cover! It may seem a little out of the blue for a lot of ya'll but fun fact - my channel actually started out with covers! They've since been set to private so you'll have no luck finding them, but music has always been such a big part of my life. Making music and singing throughout my upper sec days was pretty much the most effective (and at times, the only) way to cope with my anxiety, because it forces me to breathe.

I knowwwww, can't tell right? It goes to show how much more we need to be open and comfortable with mental health and self-care!

I'll pick this up in another video, but I'm at the point in my life where I have accepted that, like everyone else, my brain is wired a certain way, and have grown comfortable enough in my own skin to be able to acknowledge, address and manage it. It took a while, but I'm very proud to say that I'm doing the best I ever have, and I've never felt this calm, confident and happy for so long in my entire life.

I've always, always wanted to address "touchy" issues like mental health (amongst others), but the stigma and the pity and whatever else comes along with revealing our vulnerabilities has always made me think twice. Also, ngl, I've been busy and prioritising other (i.e. the more fun) videos. But it's 2018 and I'm way past my teenage insecurities. I have many important things I want to share and discuss with you guys, so that's exactly what I'm going to do! I don't know how often I will be able to make these videos considering I usually can only afford to make one per week, but do you remember the think tank videos we've discussed about before (I think it was one of the GRWMs)? I've had topics and talking points all planned out over 2017, but never actually got around to them. It's happening this year. (Let me know if you guys have anything on your minds you'd like to talk about in the comments below btw!)

Anyway, what prompted my decision was this - since my return, I've been feeling very suffocated by my possessions. Moving back with all of my things from New York into my already overflowing room (because I also moved back from staying on campus before I left) was just too much. I started feeling my anxiety creep back every time I look at my piles of stuff, so I've taken the time to clean, pack, declutter and reinvent my entire room for a fresh start. It. Felt. AWESOME. My room has always been my sanctuary + bubble + fun workspace and I'm so happy that it's not only restored, but improved and streamlined into an organised conglomerate of my favourite things. It's also led to the revival of my past hobbies, like knitting, music, painting etc. I feel so energised and inspired now! This incited an insatiable itch to pick everything back up and just do them for the heck of it. I don't care so much if they're productive, or "useful" or not, because time you enjoy wasting is not wasted time.

Till next time, keep that heart full ya'll xoxoxoxoxoxoxoluvuforeva

Instrumental: https://www.youtube.com/watch?v=gL56gd07gFk

-

Hey, how's it going? I'm Brenda. Born and raised Singaporean, very artsy, a lil fartsy, kinda weird but in general very chill and happy.

I make a crap ton of videos on anything and everything - fashion, beauty, skincare, vlogs, storytimes etc. If you like my videos and want to see more, hit the subscribe button to catch my videos hot off the press! You have no idea how much your support means to me. If you've got any requests or questions, please leave them down below and I'll get back to ya. Thanks again for watching my videos, and go kick ass!


» DON'T BE A STRANGER
☞ Blog - http://wordweed.blogspot.sg
☞ Instagram - http://instagram.com/wordweed
☞ Twitter - http://twitter.com/wordweed
☞ Facebook - fb.me/thewordweed
☞ Snapchat - wtfisair
☞ Ask.fm - http://ask.fm/wtfisair

» BUSINESS INQUIRIES/OPPORTUNITIES
✎ wordweed@gmail.com

▻ FAQs ◅

What do you do?
- I'm a student (Theatre in NUS, Film in NYU)

What camera do you use?
- Samsung NX500. It's pretty decent but I wouldn't actually recommend it.

What do you use to edit?
- Either Final Cut Pro X or Adobe Premiere Pro, depending on what I feel like using that day.