Aquasec · Blogs

Blogs listings from Aquasec on TechiSeek. 420 public listings.

• Establishing a Resilient DevSecOps Action Plan (Aquasec)
  Dev Sec Ops is an easy term to toss around. What actually goes into an effective Dev Sec Ops strategy?
• Threat Alert: Anatomy of Silentbob’s Cloud Attack (Aquasec)
  Aqua Nautilus researchers identified an infrastructure of a potentially massive campaign against cloud native environments.
• Software Supply Chain Security vs. SCA: What's the Difference? (Aquasec)
  As reliance on software increases in both personal and professional contexts, security of the software supply chain has become a critical c…
• Using LSM Hooks with Tracee to Overcome Gaps with Syscall Tracing (Aquasec)
  Tracee is an open source runtime security and forensics tool for Linux, built to address common Linux security issues.
• New Zero-day RCE Vulnerability Spring4Shell - Aquasec (Aquasec)
  A new critical zero-day vulnerability has been discovered in Spring, a popular open source framework widely used in modern Java application…
• Hadooken Malware Targets Weblogic Applications (Aquasec)
  Aqua Nautilus researchers identified a new Linux malware targeting Weblogic servers. The main payload calls itself Hadooken which we think…
• Introducing KBOM (Aquasec)
  Introducing the Kubernetes Bill of Materials, or KBOM.
• Trivy Now Scans Amazon Machine Images (AMIs) (Aquasec)
  While more and more companies are moving to a cloud native technologies to manage their workloads and infrastructure, Virtual Machines (VMs…
• Automating Configuration Auditing with Starboard Operator (Aquasec)
  Starboard operator supports configuration auditing using Polaris, with automated checks for weaknesses in the K8s configuration and vulnera…
• Unlimited Container Image Scanning in Docker Desktop with Trivy (Aquasec)
  We show you how the Trivy extension for Docker Desktop allows for unlimited container image scanning for vulnerabilities through the Docker…
• Shift Security Left, Then Shift Up (Aquasec)
  As we move into cloud native, the focus of security continues to change. It's time to start adopting the shift left and shift up approaches…
• Threat Alert: Exploiting Open Docker Daemons for DDoS Attacks (Aquasec)
  Aqua’s research team identified attacks that exploited misconfigured open Docker daemons to hijack environments in order to launch targeted…
• Securing Containers on OpenShift (Aquasec)
  Red Hat OpenShift has many built-in security features, and Aqua provides an additional layer of security, protecting containerized applicat…
• Understanding the Importance of Runtime Security in Cloud Native Environments (Aquasec)
  Understanding the importance of runtime security in cloud native environments is essential to detect, prevent and mitigate threats.
• Aqua Nautilus Discovers Redigo (Aquasec)
  Aqua Nautilus discovered new Go-based malware that targets Redis servers. The attack was executed against one of our deliberately vulnerabl…
• Taking Advantage of Object Labels while Controlling the Human Factor (Aquasec)
  Using Docker object labels for metadata in images, containers, and more can be leveraged for security concerning the assurance & protection…
• CVE-2022-0811: CRI-O Vulnerability Could Allow Container Escape (Aquasec)
  A newly discovered vulnerability in the container runtime tool CRI-O could allow for attackers who are able to create pods in a Kubernetes…
• Introducing Scalock - Hello There Container World! (Aquasec)
  Scalock is officially new to the container security scene. Amir Jerbi and I (Dror Davidoff) set up Scalock to provide a solution for the ma…
• Aqua CyberCenter: Elevating Vulnerability Scanning Beyond the NVD (Aquasec)
  Aqua CyberCenter is a comprehensive & reliable source of cloud native security risk information, including public CVEs, vendor security adv…
• Kubernetes Security Deep-Dive - Aquasec (Aquasec)
  Aqua 3.0 is the most comprehensive enterprise-grade solution for securing Kubernetes, covering the entire lifecycle of cloud native applica…
• Detecting eBPF Malware with Tracee (Aquasec)
  BPF is a popular and powerful technology embedded in the Linux kernel and can potentially be used by threat actors as part of their malicio…
• Tomcat Under Attack: Exploring Mirai Malware and Beyond (Aquasec)
  Tomcat Vulnerability explore some of the techniques used by the Mirai botnet to exploit a single attack directed at one of our Apache Tomca…
• Hunting Rootkits with eBPF: Detecting Linux Syscall Hooking (Aquasec)
  Today, cloud native platforms are increasingly using eBPF-based security technology. It enables the monitoring and analysis of applications…
• Accenture and Aqua Partner to Empower Cloud Security (Aquasec)
  Discover how Accenture and Aqua harmonize efforts to navigate complexity to deliver effective cloud security solutions.
• 2022 Cloud Native Threat Report: Key Trends in Cyber Attacks (Aquasec)
  As companies continue to adopt cloud native technologies at a rapid pace, an increasing number of cyber threats are targeting the cloud nat…
• Top 10 Kubernetes Application Security Hardening Techniques (Aquasec)
  One of the main challenges developers face is how to manage security risks when deploying applications to Kubernetes clusters.
• What To Know: A Summary of the Compliance Guide to SSDF (Aquasec)
  NIST has recently researched, defined, and released an entirely new standard for incorporating security into the software development lifec…
• CVE-2024-3094: Newly Discovered Backdoor in XZ tools (Aquasec)
  The xz-utils backdoor, discovered on March 29, 2024, exposes systems to potential backdoor access and remote code execution.
• Detect and Prevent Exploits in Runtime with Vulnerability Shielding (Aquasec)
  The volume of vulnerabilities in container environments makes manual remediation impossible to manage at scale.
• Find Image Vulnerabilities Using GitHub and Trivy Action (Aquasec)
  Modern-day CI/CD pipelines enable new security approaches and transform the Dev Ops landscape to accommodate a variety of safety nets into…
• Aqua Enterprise vs Aqua Trivy: What’s Best for You? (Aquasec)
  Anyone looking to improve the security posture of their cloud native applications knows that a vulnerability scanner is an important tool t…
• Discover Security Risks with Starboard Extension for Lens Kubernetes IDE (Aquasec)
  When the Mirantis team announced the Lens Extensions API back in November 2020, we were excited to experiment with it and build an extensio…
• Aqua: Leading the Charge in Container Security Innovation (Aquasec)
  Aqua's positioning on the GigaOm Radar emphasizes our commitment to delivering a comprehensive solution that addresses the evolving securit…
• Kube-Bench: An Open Source Tool for Running Kubernetes CIS Benchmark Tests (Aquasec)
  The CIS has recently published a benchmark for Kubernetes, and now we’re pleased to introduce our new open source implementation of these t…
• Istio: Canary Deployments, Dynamic Routing & Tracing (Aquasec)
  The Istio service mesh design facilitates a number of traffic control and observability features that help us operate distributed systems m…
• CVE-2021-3156 sudo Vulnerability Allows Root Privileges (Aquasec)
  A severe heap overflow vulnerability in sudo allows an unprivileged user to to elevate privileges to root without authentication.
• Trivy’s Journey: From Personal Project to Open Source Scanner of Choice (Aquasec)
  Trivy is the most popular open source scanner adopted by many leading cloud native platforms & software providers incl.
• Tracee Runtime Security Series: Easy Installation on Kubernetes (Aquasec)
  Despite best efforts to harden Kubernetes environments, prevention will never be enough and attackers are finding ways to evade shift-left…
• The Evolving Landscape of Cloud Security: Our Predictions for 2024 (Aquasec)
  As the year closes, we took some time to reflect on how cybersecurity has evolved and what that means for the year to come.
• Detecting Malicious Activity in CI/CD Pipeline with Tracee (Aquasec)
  With the growing popularity of CI platforms to build software, bad actors are increasingly looking to exploit these environments to target…
• 5 Essential Docker Storage Tools (Aquasec)
  Storage is one key challenge for organizations adopting container technology. We'll present 5 tools that aim to solve this problem without…
• Integrate OSS Container Vulnerability Data with Aqua and Sonatype Nexus (Aquasec)
  The rise in software supply chain attacks presents a profound challenge to the cornerstone of Dev Ops practices: the heavy use and reuse of…
• Uncover Malware Payload Executions Automatically with Tracee (Aquasec)
  In addition to tracing system calls using eBPF tracee captures any file write in the system (incl.
• Boosting Container Security with Rootless Containers (Aquasec)
  Rootless containers are a big step forward in container security making it easier and improving the overall security posture.
• Kubernetes RBAC: How to Avoid Privilege Escalation (Aquasec)
  Kubernetes RBAC users can escalate their privileges in a cluster via certificate signing of CSR API; here’s how it works and how to detect…
• Why You Shouldn’t Use Config Maps to Store Sensitive Data in K8s (Aquasec)
  One of the challenges of managing containerized environments is how to store sensitive information that’s needed for the operation of the a…
• Elevating Cloud Security Response with Cloud-to-Code Tracing (Aquasec)
  Aqua’s Cloud-to-Code Tracing enables teams to view risk in production and trace it back to the code repository and developer responsible.
• Aqua Operator: Automating Security for Kubernetes (Aquasec)
  Aqua has a Kubernetes operator certified for Red Hat OpenShift that automates deployment and scaling of security controls for your Kubernet…
• Recent Verdict Against Uber CISO is a Game Changer (Aquasec)
  In early October, the US Department of Justice announced that a verdict had been reached in the case against former Uber CISO Joe Sullivan,…
• Threat Alert: Massive Cryptomining Campaign Abusing GitHub, Docker Hub, Travis CI & Circle CI (Aquasec)
  Aqua’s Team Nautilus detected an impressive campaign that set out to hijack resources to enable cryptocurrency mining.