2022-06-02: python:3.10.4-bullseye Released

Python publishes python:3.10.4-bullseye container image that includes a fix for CVE-2022-1292.

While working on a process of improving the container secure supply chain, I often need to go over the current challenges of patching container vulnerabilities. With the introduction of Automatic VM Patching, having those conversations are even more challenging because there is always the question: “Why can’t we patch containers the same way we patch […]

August 23, 2022August 22, 2022toddysm

Signatures, Key Management, and Trust in Software Supply Chains – Part 2: Exploiting Signatures

In Part 1 of the series Signatures, Key Management, and Trust in Software Supply Chains, I wrote about the basic concepts of identities, signatures, and attestation. In this one, I will expand on the house buying scenario, that I hinted about in Part 1, and will describe a few ways to exploit it in the […]

February 8, 2022February 13, 2022toddysm

To 404 or Not to 404 – Using HTTP Response Codes to Provide User-Friendly Error Messages in Microservices Implementation

How often the following happens to you? You write your client code, you call an API, and receive a 404 Not found response. You start investigating the issue in your code; change a line here or there; spend hours troubleshooting just to find out that the issue is on the server-side, and you can’t do […]

September 7, 2021January 9, 2022toddysm

Implementing Quarantine Pattern for Container Images

One important step in securing the supply chain for containers is preventing the use of “bad” images. I intentionally use the word “bad” here. For one enterprise, “bad” may mean “vulnerable”; for another, it may mean containing software with an unapproved license; for a third, it may be an image with a questionable signature; possibilities […]

August 30, 2022August 30, 2022toddysm

Why Multi-Factor Authentication (2FA/MFA) Usage Numbers Will Not Improve Any Time Soon?

If you have missed the news lately, cybersecurity is one of the most discussed topics nowadays. From supply chain exploits to data leaks to business email compromise (BEC) there is no break – especially during the pandemic. Many (if not all) start with an account compromise. And if you ask any cybersecurity expert, they will […]

December 13, 2021December 14, 2021toddysm

What is a Container Image Quarantine Flag and How to Use it?

In my last post, Implementing Quarantine Pattern for Container Images, I wrote about how to implement a quarantine pattern for container images and how to use policies to prevent the deployment of an image that doesn’t meet certain criteria. In that post, I also mentioned that the quarantine flag (not to be confused with the […]

September 22, 2022September 22, 2022toddysm

2022-05-27: debian:bullseye-20220527 Released