Is this you? As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.
Claim your profile
Articles by Nadav Noy
7 CSPM Tools to Secure Your Cloud Infrastructure
Cloud security covers a wide range of tools and frameworks, which makes it hard to implement. Cloud security posture management (CSPM) organizes the process. CPSM identifies and addresses misconfigurations that leave cloud environments vulnerable to threats. But manual oversight isn’t enough to manage all environments. CSPM tools automate the process, continuously monitoring cloud services to help organizations protect critical data and avoid costly breaches.
Azure Devops Zero-Click CI/CD Vulnerability
The Legit Security research team has found and reported a zero-click attack that allowed attackers to submit malicious code and access secrets. The vulnerability does not require any action from the project maintainer, making it a zero-click supply chain vulnerability.
The Risks of Being Blind to AI in Your Own Organization
As artificial intelligence (AI) and large language models (LLMs) like GPT become more entwined with our lives, it is critical to explore the security implications of these tools, especially the challenges arising from a lack of visibility into AI-generated code and LLM embedding in applications. It seems that AI is everywhere these days. One of the most rapidly trending applications of AI is using AI code assistants such as GitHub Copilot.
Emerging Risks with Embedded LLM in Applications
Large Language Models (LLMs) like OpenAI's GPT and Google's Bard have swept the tech landscape with their transformative capabilities for helping organizations overcome resource constraints and accelerate the pace of innovation. But as these AI technologies find their way into various applications, it has become apparent that they come with a new breed of security headaches.
Exploring the Dangers of Self-Hosted Agents
Continuous Integration/Continuous Deployment (CI/CD) pipelines have become crucial to modern software development practices. CI/CD pipelines can significantly improve development efficiency and software quality by automating the process of building, testing, and deploying code.
Remote Code Execution Vulnerability in Azure Pipelines Can Lead To Software Supply Chain Attack
The Legit Security research team has found a vulnerability in Azure Pipelines (CVE-2023-21553) that allows an attacker to execute malicious code in a context of a pipeline workflow, which allows attackers to gain sensitive secrets, move laterally in the organization, and initiate supply chain attacks. Azure Pipelines is a CI/CD framework that allows automating your CI/CD, running tests, and can boost your software delivery.
2023 Predictions for Modern Application Security
Software dominates the world andremains abig and accessible attack surface.In 2022, an estimated $6Bwas invested in Application Security, with that number expected to reach $7.5B in 2023. Within AppSec, software supply chain security entered the spotlight two years ago and represents AppSec’s fastest growing attack category with major headlines of breaches and exploits happening on a regular basis.
How to Continuously Detect Vulnerable Jenkins Plugins to Avoid a Software Supply Chain Attack
Jenkins is an open-source automation and build platform that allows for automated tests, integrations, builds, and much more. However, Jenkins also has vulnerabilities that make it susceptible to software supply chain attacks. See how attackers used compromised Jenkins plugins to launch cyberattacks and how to detect vulnerable Jenkins plugins at scale. Part 1: The Threat Almost every software pipeline has an integrated build system to enable CI/CD.
Vulnerable Jenkins Plugins
Jenkins is an open-source automation and build platform that allows for automated tests, integrations, builds, and much more. However, Jenkins also has vulnerabilities that make it susceptible to software supply chain attacks. See how attackers used compromised Jenkins plugins to launch cyberattacks and how to detect vulnerable Jenkins plugins at scale. Part 1: The Threat Almost every software pipeline has an integrated build system to enable CI/CD.
Introducing Legitify: A Better Way To Secure GitHub
GitHub can be considered the “operating system” of many organization's development operation, and a single misuse can lead to critical incidents, data breaches and software supply chain attacks. It’s not about a lack of security features. GitHub can be configured to be fairly robust against a wide range of attacks. It has a wide range of security features and settings that enhance the safety of its users and organizations.
Show More
loading
Actions
Is this you?
As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.Get in touch with Nadav
Contact Nadav, search articles and posts on X, monitor coverage, and track replies from one place.
Learn more about Muck Rack