devsecops
4 stories
Connecting the Dots: Securing the Overlooked Corners of the Software Development Lifecycle (SDLC) Supply Chain
Attackers are increasingly targeting the software development lifecycle (SDLC) supply chain by compromising developer tools, CI/CD pipelines, and open-source packages. Recent attacks like the ChainDrop npm worm demonstrate sophisticated methods to steal credentials, backdoor developer environments, and propagate malware. Securing the SDLC requires a shift from reactive code scanning to strict execution control and continuous visibility across developer endpoints, build pipelines, and cloud runtimes.
GitLab 19.3 helps enterprises scale agentic development securely
GitLab's latest update, version 19.3, enhances security and control for enterprises scaling agentic software development. Key features include running GitLab Duo Agent Platform within dedicated single-tenant environments, allowing custom model integration, and keeping AI data within existing security boundaries. The release also introduces improved secrets management, bulk SAST false positive detection, and a Flow Creator Agent for simplified automation.
The security signal log tailing can't see: tracking npm cooldown removals with Elastic Agent
A new method using Elastic Agent's Common Expression Language (CEL) has been developed to monitor the npm package manager's "min-release-age" setting. This setting helps prevent the installation of recently compromised packages by introducing a delay. The CEL integration periodically snapshots .npmrc files, allowing for the detection of when this crucial security setting is removed, a scenario that traditional log tailing methods cannot identify.
The GitHub Actions Attack Pattern Your CI Security Scanners Miss
ActiveState detailed a GitHub Actions attack pattern that often bypasses traditional CI security scanners. The analysis explains how these attack chains evade detection and how to better govern CI/CD pipelines.