All posts by rocco

Tenable Launches Suite of New Product Features to Deliver Full Lifecycle Cloud-Native Security

Read Time:3 Minute, 0 Second

Our newest Tenable.cs product features are designed to enable organizations to stay agile while reducing risk.

A suite of upgrades to Tenable.cs, our cloud-native application protection platform, are designed to enable organizations to secure cloud resources, container images and cloud assets to provide end-to-end security from code to cloud to workload.

Even as organizations are adopting the cloud at exponential rates, they continue to face the challenges of protecting and securing resources and workloads in the public cloud. And, as the responsibilities of modern security teams continue to evolve and increase in complexity, the pressure to meet workload demands while minimizing security risks continues to mount. Implementing a new framework, one that allows organizations to remain agile while strengthening security is key. Enter Tenable.cs.

Tenable.cs delivers full lifecycle cloud-native security to address cyber risks from build to runtime. It enables organizations to programmatically detect and fix cloud infrastructure misconfigurations in the design, build and runtime phases of the Software Development Lifecycle (SDLC) to prevent unresolved insecure configuration or exploitable vulnerabilities from reaching production.

Tenable.cs secures infrastructure as code (IaC) before deployment, maintains a secure posture in runtime and controls drift by synchronizing configuration between runtime and IaC. It enables IaC to remain the single source of truth, eliminating the need for complex and manual processes.

Newest capabilities in Tenable.cs

Tenable.cs offers continuous visibility to assess cloud hosts and container images for vulnerabilities without the need to manage scan schedules, credentials, or agents. It provides Frictionless Assessment and Nessus Vulnerability Assessment for cloud workloads as well as Tenable.io container Security.

With Tenable.cs, all cloud assets —including ephemeral assets —- are continuously reassessed as new vulnerability detections are added and as new assets are deployed. This always-on approach allows organizations to spend more time focusing on the highest priority vulnerabilities and less time on managing scans and software.

Tenable.cs now also supports Tenable.ep

Tenable.cs further expands the scope of Tenable’s comprehensive cyber exposure management platform. Now, with the addition of Tenable.cs to Tenable.ep, organizations can determine the cyber risks of their cloud resources alongside other assets, such as IT assets, web apps, containers and operational technology (OT) devices.

With Tenable.cs, Tenable now delivers an integrated, end-to-end cloud security solution and a complete picture of cyber risks across the modern attack surface with unified visibility into code, configurations, assets and workloads.

Accessing the new features

Tenable.cs gives DevSecOps teams pragmatic, cloud native security solutions to continue the mission of helping organizations innovate in the cloud with confidence.

It is available as both a standalone solution and as a part of Tenable.ep. Additionally, Tenable has further expanded Tenable.ep, adding Tenable.ad for Active Directory environments to its platform’s single and flexible asset-based license for simple procurement and deployment. Tenable.ad will also continue to be sold as a separate solution and will be available Feb. 2

Schedule your free consultation and demo

If you’re not already a Tenable customer, please schedule a free consultation and demo to discuss how we can help you improve your security program and results.

For more information about Tenable.cs, visit tenable.com/products/tenable-cs or join us on March 2nd at 2:00 p.m. EST for a webinar on Introducing Tenable.cs: Cloud-Native Security From Code to Cloud.

Learn more

Visit the Tenable.cs product page
View the Tenable.cs press release
Attend the webinar, Introducing Tenable.cs: Cloud-Native Security From Code to Cloud

Read More

Multiple Vulnerabilities in Google Chrome Could Allow for Arbitrary Code Execution

Read Time:31 Second

Multiple vulnerabilities have been discovered in Google Chrome, the most severe of which could allow for arbitrary code execution. Google Chrome is a web browser used to access the Internet. Successful exploitation of the most severe of these vulnerabilities could allow an attacker to execute arbitrary code in the context of the browser. Depending on the privileges associated with the application, an attacker could view, change, or delete data. If this application has been configured to have fewer user rights on the system, exploitation of the most severe of these vulnerabilities could have less impact than if it was configured with administrative rights.

Read More

A Vulnerability in Samba Could Allow for Arbitrary Code Execution

Read Time:22 Second

A vulnerability has been discovered in Samba which could allow for arbitrary code execution. Samba is the standard Windows interoperability suite of programs for Linux and Unix. Successful exploitation of this vulnerability could result in arbitrary code execution as root on affected Samba installations that use the VFS module vfs_fruit. Depending on the permission associated with the application running the exploit, an attacker could then install programs; view, change, or delete data.

Read More

What Is IaC and Why Does It Matter to the CISO?

Read Time:6 Minute, 44 Second

Many vendors and security companies are buying or building Infrastructure as Code (IaC) security into their portfolios, and this trend is only expected to continue. Here’s what you need to know.

Infrastructure as code (IaC) is a relatively new phenomenon that is revolutionizing the way organizations manage their infrastructure.

IaC offers many benefits to security leaders, including speed, consistency, accountability, scalability, reduced costs and more, which is why it is emerging as such an integral part of building on the modern cloud.

It’s important for CISOs and DevOps teams to see IaC as the connected link between cloud computing and DevOps success, as it enables businesses to innovate with confidence and strengthens infrastructure management processes.

Understanding how IaC works, its best practices and benefits are all crucial to leveling up your security programs and boosting agile software development. By leveraging IaC as both a strategy and a solution, CISOs and DevOps teams can align security with business goals.

Investing in an IaC strategy boosts the overall productivity of a business while maintaining security posture. This prevents misconfigurations, non-compliance policy violations and other cloud security risks, giving development teams more time to develop, deploy and scale with greater speed, visibility and flexibility. As a vital DevOps practice, IaC is still emerging and evolving within the cloud security realm.

What is Infrastructure as Code (IaC)?

According to Tech Target, infrastructure as code is “an IT practice that codifies and manages underlying IT infrastructure.”

Infrastructure as code emerged as a strategic approach for development teams looking to manage and maintain their infrastructure without the hassle of manually provisioning.

How does IaC work and what problems does it solve?

Managing IT infrastructure is an arduous process. It requires people to physically put the servers in place, configure them and then deploy the application. This time-consuming manual process often results in numerous discrepancies, impedes agility and, ultimately, proves costly for businesses. Corporations are forced to spend a fortune annually on building and maintaining huge data centers and hiring a plethora of engineers and other employees to manually provision the infrastructure.

To combat this, cloud computing was introduced, providing enterprises with a new approach that offered flexibility and scalability. Today, cloud computing is a booming industry, helping organizations accelerate innovation and scale at large.

Given the shift to remote work in light of the COVID-19 pandemic, more and more businesses have chosen to adopt the cloud. Currently, more than 90% of businesses use cloud computing. As a critical solution, it has rapidly changed the way people do business. Infrastructures can now be managed over networks, offering more flexibility and faster deployment for businesses. Additionally, with cloud systems, development teams can improve security, speed and software testing, increase productivity and efficiency, reduce costs and improve delivery.

Providing a myriad of benefits for businesses and cloud users alike, cloud computing continues to be an essential pillar of digital transformation. However, it does pose some serious security risks.

Cybercriminals looking to steal sensitive data and other pertinent information could potentially breach the cloud server, wreaking havoc on businesses and their customers. In 2021, more than 40 billion records were exposed, as a result of cloud-based data breaches. Just last year, social media giant Facebook had 533 million records exposed from users in 106 countries, according to Business Insider.

Additionally, infrastructure misconfigurations caused by human error can provide pathways for cybercriminals to launch attacks. Misconfigurations can expose networks and cause configuration drifts.

Therefore, a solution is needed which allows developers to manage their infrastructure through automation, while minimizing potential new security risks. This is where infrastructure as code comes in.

IaC involves using software tools to automate specific tasks through a version control system. This means that your infrastructure can be written and described in code, and this code can be executed to make changes to your infrastructure. In IaC, there are two approaches to writing the code:

Declarative approach. This is often the preferred approach of the two because of the flexibility it offers, this approach involves users only defining the end or “desired” state. Meanwhile, the tool or platform being used takes care of the steps needed to achieve the end result.

Imperative approach. This approach involves users specifying the specific commands needed to achieve the end or “desired” state. In this approach, the platform or tools do not deviate from those specific commands.

By adopting an IaC approach, organizations can accelerate innovation and build products that efficiently meet their customers’ needs in a timely and seamless manner. However, the speed at which development teams are rapidly pushing out new products and features is outpacing security. Therefore, it is critical that the security pace keeps up. More specifically, CISOs, who are responsible for the security of an enterprise, need a security solution that enables DevOps teams to continue production while applying security practices to reduce cyber risks and misconfigurations. And IaC provides the mechanism to do it.

Five benefits of IaC

Leveraging IaC as both a strategy and solution can help you achieve your security goals, as it provides several benefits for your business, including speed, scalability, consistency, accountability and reduced costs.

Speed. The most important benefit of IaC is speed. One of the CISO’s primary responsibilities is to protect the enterprise while simultaneously driving growth. By adopting an IaC security solution, productivity can get a boost, allowing for quick turnarounds, enabling businesses to meet customer’s requests and needs. Instead of spending time manually provisioning and increasing the likelihood of misconfigurations due to human error, development teams can quickly provision and configure infrastructure, speeding up the entire software development lifecycle, all while minimizing security risks by adopting IaC security.
Scalability. When demand for products or services increases, businesses need to be able to scale quickly and efficiently. The same applies to security. As businesses continue to grow and evolve, so, too, must their security processes evolve. New security tools and technologies will be used to accelerate innovation and CISOs are responsible for evaluating and consolidating these tools. By employing IaC tools, development teams can build environments to test new applications and get products or new features to the market faster with security embedded throughout the entire process.
Consistency. Generally, CISOs are responsible for ensuring security policies are being met. Therefore, they must ensure that documentation is up to date as outlined in the policies. By adopting IaC, CISOs can eliminate the documentation process because all the infrastructure is defined as code. IaC increases consistency and significantly reduces errors that often happen because of manual misconfigurations. It minimizes the potential for configuration drift and reduces the risk of cyberattacks that might occur because of manual provisioning.
Accountability. IaC enables CISOs to track any changes that have been made to any source code file. You no longer have to guess which person made a change and when they made that change throughout the software development lifecycle. Thus, making it easier for CISOs and security leaders to hold DevOps teams accountable for changes.
Reduced costs. IaC significantly reduces the cost of infrastructure management. Businesses can save money on hardware and equipment and the costs of hiring people to operate the hardware and equipment and building or renting the physical space to store it. Additionally, by employing cloud computing with IaC, businesses can reduce security risks, which, in turn, can save a fortune on “recovery costs” from a data breach or other form of cyberattack.

Conclusion

At Tenable, we recognize the value of embracing IaC as a way for organizations to innovate in the cloud with confidence. We deliver an integrated, end-to-end security solution to help organizations better protect their cloud environments. It provides a complete picture of cyber risks across the modern attack surface, with unified visibility into code, configurations, assets and workloads. Learn more about Tenable.cs and how our platform enables DevSecOps with integrated controls for development and runtime workflows, focused on IaC.

Learn More

Read the blog: Introducing Tenable.cs: Full Lifecycle, Cloud Native Security

Download the whitepaper: Using Auto Remediation to Achieve DevSecOps

Read More

[R1] Nessus 10.1.0 Fixes One Third-Party Vulnerability

Read Time:24 Second
Nessus leverages third-party software to help provide underlying functionality. One of the third-party components (Underscore.js) was found to contain a vulnerability, and an updated version has been made available by the provider.

Out of caution and in line with good practice, Tenable has opted to upgrade the Underscore.js component to address the potential impact of the issue. Nessus 10.1.0 updates Underscore.js to version 1.13.1 to address the identified vulnerability.

Read More

Securing Critical Infrastructure: The Essential Role of Public-Private Partnerships

Read Time:4 Minute, 30 Second

Government collaboration with industry can help drive strategic planning and tactical operations to address cyberthreats.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) states, “Public-private partnerships are the foundation for effective critical infrastructure security and resilience strategies, and timely, trusted information sharing among stakeholders is essential to the security of the nation’s critical infrastructure.” We couldn’t agree more.

Critical infrastructure is highly susceptible to cyberattacks, as seen with the SolarWinds attack in late 2020, which impacted global governments and critical infrastructure providers, and in the ransomware attacks on Colonial Pipeline and JBS Meat last year. However, with the proper IT infrastructure security in place, organizations can mitigate the risk of cyberattacks and protect their vulnerable data.

We believe it’s imperative for global governments to leverage the combined resources and expertise of government, industry and other stakeholders to enhance cybersecurity. Public-private partnerships play a critical role in establishing the strategic frameworks and tactical operational mechanisms necessary to secure data and IT infrastructure.

In the U.S., there are many federal agencies involved in public-private partnerships. For example, CISA and other government agencies are partnering with the information technology and communications industries to identify and to develop strategies to help address supply chain risk management challenges. Additionally, the National Cybersecurity Center of Excellence (NCCoE) leverages expertise from both the public and private sectors to develop cybersecurity guidance and solutions, aligned with international standards and the National Institute of Standards and Technology (NIST) Cybersecurity Framework, to address real-world sector-specific and cross-sector cybersecurity challenges. For example, the NCCoE has announced a project on Implementing a Zero Trust Architecture, which will develop “how-to” guides and example approaches to help organizations on their journey to adopt zero trust strategies.

The President’s National Security Telecommunications Advisory Committee (NSTAC) and the Joint Cyber Defense Collaborative (JCDC) are critical public-private partnerships that should be further advanced over the next year. The NSTAC and JDCD allow for agencies to join efforts on combating cyberthreats through strategic planning and proactive defense measures.

How NSTAC supports public-private cybersecurity initiatives

NSTAC aims to assist agencies dealing with telecommunications that affect national security and emergency preparedness. The NSTAC brings together IT and communications sector industry leaders and executives from many of our country’s largest and most influential companies, as well as cybersecurity experts from the White House, CISA and other government agencies to provide advice on securing telecommunications and digital technologies to protect the nation. I have the privilege of supporting Tenable co-founder Jack Huffard, who serves as a member of the NSTAC.

The NSTAC is currently working on a multi-phase project for improving internet resilience. Under the initial phase of this project, the NSTAC released a report to the President on Software Assurance in the Information and Communications Technology and Services Supply Chain. For the second phase, the NSTAC is currently developing a report on recommendations for adopting zero trust architectures. In the next couple of months, NSTAC will launch the third phase of this project, focused on addressing cybersecurity challenges associated with the convergence of Information Technology and Operational Technology, which is vital to further protect industrial control systems and other critical infrastructure from cyberattacks.

How the JCDC supports public-private cybersecurity initiatives

The JCDC was established by CISA to create a collaborative environment for federal agencies and the companies involved to prevent cyber intrusions and implement national cyber defense plans. The JCDC joins forces with federal agencies, state and local governments, and private-sector companies to protect our nation’s critical infrastructure. CISA Director Jen Easterly noted that the JCDC allows for “a shared situational awareness of the threat environment, so that we understand it better to develop whole-of-nation comprehensive cyber defense plans to deal with the most significant threats to the nation to include significant threats to our critical infrastructure.”

Tenable was recently named as an Alliance Partner for the JCDC, meaning we will be collaborating with CISA across a range of cybersecurity issues and challenges, to provide strategic insights and operational response acumen. Managing vulnerabilities is essential to secure critical IT infrastructure and the work done by JCDC and CISA promotes the prioritization of network security. Federal agencies across the nation need to adopt initiatives put forth by the JCDC to ensure their networks are protected from vulnerabilities, like the recent Apache Log4J flaw, which has impacted billions of devices worldwide. The JCDC and CISA have been quick to respond and help protect the nation’s infrastructure from this vulnerability, a vital effort, especially given that recent research from Tenable shows that nearly 30% of organizations hadn’t begun scanning for Log4J as of late December.

Conclusion

As cyberattacks become more sophisticated, building collaborative communities between the public and private sectors is crucial to synchronize operations and take preventative measures as a unified front to critical infrastructure threats.

In order to complete many large-scale projects, the expertise and technology from private-sector entities, as well as the resource support and convening power of global governments, are what permit public-sector proposals to come to fruition.

Learn More

Log4Shell: 5 Steps The OT Community Should Take Right Now
CISA’s Binding Operational Directive on Managing Unacceptable Risk Vulnerabilities in Federal Enterprises Is Key to Stopping Federal Cyberattacks
Unpacking the U.S. National Security Memorandum on Improving Cybersecurity for Critical Infrastructure

Read More

Multiple Vulnerabilities in Apple Products Could Allow for Arbitrary Code Execution.

Read Time:36 Second

Multiple vulnerabilities have been discovered in Apple Products, the most severe of which could allow for arbitrary code execution.

iOS is a mobile operating system for mobile devices, including the iPhone, iPad, and iPod touch.
iPadOS is the successor to iOS 12 and is a mobile operating system for iPads.
macOS Monterey is the 18th and current major release of macOS.
macOS Big Sur is the 17th release of macOS.
macOS Catalina is the 16th major release of macOS
watchOS is the mobile operating system for Apple Watch and is based on the iOS operating system.
tvOS is an operating system for fourth-generation Apple TV digital media player.
Safari is a graphical web browser developed by Apple.

Read More

Critical VMware vCenter Server vulnerability (CVE-2021-22005) being exploited in the wild

Read Time:1 Minute, 29 Second

FortiGuard Labs is aware that VMware disclosed a critical vulnerability (CVE-2021-22005) on September 21st, 2021 that affects vCenter Server versions 6.7 and 7.0. A malicious attacker with network access to port 443 on vCenter Server can exploit the vulnerability and can execute code on vCenter Server upon successful exploitation. The VMware advisory was updated on September 24th that the vulnerability is being exploited in the wild. In addition, exploit code is publicly available.Why is this Significant?VMware has one of the highest market shares in the server virtualization market so the vulnerability can have widespread affect. Also, some public reports indicate that CVE-2021-22005 is being exploited in the wild. With exploit code being publicly available, more attackers are expected to leverage the security bug. Because of the potential impact the vulnerability has in the field, CISA released an advisory on September 24th, 2021.What are the Details of the Vulnerability?Details of the vulnerability have not been disclosed by VMware.Has VMware Released an Advisory for CVE-2021-22005?Yes, the vendor released a cumulative advisory on September 21st, 2021. See the Appendix for a link to VMSA-2021-0020.1. The vendor also released a supplemental blog post and an advisory. See the Appendix to a link to “VMSA-2021-0020: What You Need to Know” and “VMSA-2021-0020: Questions & Answers”.Has the Vendor Released a Patch?Yes. VMware released a patch on September 21st, 2021.Any Mitigation and or Workarounds?VMware provided workarounds in a blog. See the Appendix to a link to “Workaround Instructions for CVE-2021-22005 (85717)”.What is The Status of Coverage?FortiGuard Labs is investigating for IPS protection. This Threat Signal will be updated with protection information as it becomes available.

Read More