2022-03-15: OpenSSL CVE-2022-0778 Fixed

OpenSSL publishes fix for CVE-2022-0778 impacting versions 1.0.2 – 1.0.2zc, 1.1.1 – 1.1.1m, and 3.0.0 – 3.0.1.

If you have missed the news lately, cybersecurity is one of the most discussed topics nowadays. From supply chain exploits to data leaks to business email compromise (BEC) there is no break – especially during the pandemic. Many (if not all) start with an account compromise. And if you ask any cybersecurity expert, they will […]

December 13, 2021December 14, 2021toddysm

To 404 or Not to 404 – Using HTTP Response Codes to Provide User-Friendly Error Messages in Microservices Implementation

How often the following happens to you? You write your client code, you call an API, and receive a 404 Not found response. You start investigating the issue in your code; change a line here or there; spend hours troubleshooting just to find out that the issue is on the server-side, and you can’t do […]

September 7, 2021January 9, 2022toddysm

Signatures, Key Management, and Trust in Software Supply Chains – Part 1: Identities, Signatures and Attestation

For the past few months, I’ve been working on a project for a secure software supply chain, and one topic that seems to always start passionate discussions is the software signatures. The President’s Executive Order on Improving the Nation’s Cybersecurity (EO) is a pivotal point for the industry. One of the requirements is for vendors […]

January 9, 2022January 9, 2022toddysm

Implementing Cybersecurity Research Sandbox Environment in the Cloud

For a while, I’ve been planning to build a cybersecurity research environment in the cloud that I can use to experiment with and research malicious cyber activities. Well, yesterday I received the following message on my cell phone: Hello mate, your FEDEX package with tracking code GB-6412-GH83 is waiting for you to set delivery preferences: […]

January 23, 2020February 23, 2021toddysm

What is a Container Image Quarantine Flag and How to Use it?

In my last post, Implementing Quarantine Pattern for Container Images, I wrote about how to implement a quarantine pattern for container images and how to use policies to prevent the deployment of an image that doesn’t meet certain criteria. In that post, I also mentioned that the quarantine flag (not to be confused with the […]

September 22, 2022September 22, 2022toddysm

Embed the Origin Dockerfiles into Your Docker Container Images Using Labels

With the recent Solorigate incident, a lot of emphasis is put on determining the origin of the software running in an enterprise. For Docker container images, this will mean to embed in the image the Dockerfile the image was built from. However, tracking down the software origin is not so trivial to do. For closed-source […]

February 24, 2021February 24, 2021toddysm

2022-03-08: python:3.10.2-bullseye Released