3 ms·
There could be many vectors including the compromise of the build server. That Jenkins plugin you haven't updated in years. Or that maven package no one knows
by gauravphoenix 6y ago
There could be many vectors including the compromise of the build server.
That Jenkins plugin you haven't updated in years.
Or that maven package no one knows about.
Third party risk management is unfortunately not well funded cyber security vertical.
- drevil-v2 6y agoSolarwinds is not your average software company. Look at their customer list. They would have had ISO certifications and independent 3rd party audits done a billion times. Those type of companies don't even speak to you if you don't have those credentials. You think you are supplying software to all the armed forces branches and "forgot" to update a Jenkins plugin?
- X-Istence 6y agoYes, absolutely. Oh, the amount of outdated software that your average corp runs is mind blowing. Not only that, but if you have a tight IT department, the amount of shadow IT that happens because of the too onerous processes put in place by IT will leave so much infrastructure that is critical but not managed correctly. As a security professional, getting people to upgrade simple software is difficult enough, upgrading critical infrastructure used 24/7 by the development team... forget about it.
- tmuxtux 6y agoCorporation probably doesn’t even know, IT management is all outsourced
- tmuxtux 6y agoOne conclusion is that process and certification is a waste of time and get you stuck with the same crappy software forever.
- gauravphoenix 6y ago>You think you are supplying software to all the armed forces branches and "forgot" to update a Jenkins plugin? yeah. Just now I am reading that their FTP servers had such a weak password that it allowed the pentester to upload/replace any binary back in 2019