Nginx is a critical part of the infrastructure of many organizations. It is used as a web server, a load balancer, a (reverse) proxy server, a port forwarder, and as a video streaming platform, among its many uses. Standalone or as part of a software stack, it supports a non-negligible share of the overall internet infrastructure we rely upon.
So when a new CVE affects nginx, the team at TuxCare pays special attention.
Continue reading “Patching of nginx CVE-2021-23017 for EOL systems is being deployed”
As a part of TuxCare, we make sure that any and all new vulnerabilities are analyzed and tested against all the distributions and products we support. Today, two new vulnerabilities were disclosed that affect the curl/libcurl code, and because this is something we cover with our Extended Lifecycle Support, we ran our tests on this library.
Continue reading “TuxCare – Testing all vulnerabilities so that you don’t have to”
Security research is an important aspect of cybersecurity, but it is not particularly easy to carry out cybersecurity research or to do so scientifically. It is not entirely surprising then that a research team may consider trying “novel” tactics to carry out research.
However, this April, a security research team at the University of Minnesota got into hot water for methods that were pushing ethical boundaries.
In this article we’ll explain why we need open-source security research so much, why cybersecurity research requires a scientific basis, and how the team at the University of Minnesota got it wrong.
Continue reading “On the Ethics of Open Source Security Research”
Reliable, efficient IT depends on repeatable processes that run like clockwork – it doesn’t make sense to change practices all the time, but key policies still need to be refreshed every now and again to keep up with changes in the technology – and the cybersecurity landscape.
Kernel patching is one of these processes – and often organizations will decide not to mess with a patching policy that looks like it works. Worse, sometimes kernel patching is seen as an arcane sysadmin job – never given much thought by anyone outside of the Linux geeks in the company.
Continue reading “The 2021 Deep Dive to Linux Kernel Updates”
Perceptions around the inherent security of open-source code and open-source software vary – but these perceptions matter.
On the one hand, some view open-source code as less secure. After all, there are fewer commercial incentives to secure open-source code, compared to code written by a for-profit vendor with a reputation on the line.
Continue reading “Open-source code is public, but are the right people looking at it?”
Today’s technology world moves rapidly, with continuous updates to the software companies depend on. This is true for operating systems too – vendors regularly release new version of an operating system (OS) which means an OS that has just been put in use can rapidly become outdated.
Continue reading “The Risks of Running an End Of Life OS – And How To Manage It”
Security operations is a critical element of the enterprise technology environment – but it can sometimes be left behind as organizations focus on adopting the latest technology solutions.
In a year like 2020 where there is so much change in the way work is performed and technology is delivered, security operations (or SecOps) can simply be left to the side – not getting the investment it needs.
Continue reading “Why improving SecOps can save you money”
The KernelCare Team is proud to announce the latest update to ePortal, its centralized management interface for KernelCare clients. It’s now at version 1.22-1, and it has some new features, namely the easier deployment of the KernelCare client, and some bug fixes.
Continue reading “KernelCare ePortal 1.22-1 released”
Cyberattacks come in all shapes in sizes. At times, the attacker’s express intent is to disrupt, or to steal something valuable. At other times, an attacker is trying to achieve a goal that is not necessarily intended to cause your organization any harm.
Sometimes malware simply sits on your computing infrastructure, quietly performing its job without immediately causing obvious damage – but it still drains your resources, essentially acting as a black hole. This type of malware will cost you a ton of money, but it also risks significant reputational damage.
In this article we will cover cryptojacking which involves a sneaky bit of malware that you might never notice is there – but that’s going to cost you anyway. Worse, this malware is hiding in one of the most unlikely locations: your SQL database.
Continue reading “PostgreSQL Database: A Black Hole for You, A Goldmine for Someone Else”
Organizations rely more and more on open source code solutions, even if they are not aware of it. But is open source code security handled reliably? Large organizations rightly place a strong focus on utilizing dependable, secure software solutions. Oftentimes the most capable and indeed the most secure software solutions are free, open-source software.
Continue reading “Open Source: Enterprise-Grade Security with Open Code?”