This week on the Application Security News, Mike Shema, Matt Alderman and John Kinsella cover the following news stories: Policy and Disclosure: 2020 Edition, A look back & forward for bug bounties over the past decade, 4 Ring Employees Fired For Spying on Customers, Exploit Fully Breaks SHA-1, Lowers the Attack Bar, The Open Source Licence Debate: Comprehension Consternations & Stipulation Frustrations, Synopsys Buys Tinfoil, and Rotate Your Amazon RDS, Aurora, and Amazon DocumentDB (with MongoDB compatibility) Certificates.
Visit https://www.securityweekly.com/asw for all the latest episodes!
To learn more about our sponsors visit: The Security Weekly Sponsor’s Page
Featured Flaws & Big Breaches
- Policy and Disclosure: 2020 Edition — Positive changes to drive consistency, implementation of effective patches, and adoption of patched software.
- A look back & forward for bug bounties over the past decade, a thread from Katie Moussouris.
Cloud, Code & Controls
- 4 Ring Employees Fired For Spying on Customers reminds us that insider threats must be part of our product security threat models. It’s also a callback to the “end-to-end security — lifecycle protection” principle of privacy by design; enforce access controls and monitor and audit access to collected data.
Learning & Tools
- Exploit Fully Breaks SHA-1, Lowers the Attack Bar because SHA-1 is a Shambles. Not that you shouldn’t have already moved on from SHA-1 before these attacks became more practical and cheaper.
- The open source licence debate: comprehension consternations & stipulation frustrations
Food for Thought
- Synopsys Buys Tinfoil
- Rotate Your Amazon RDS, Aurora, and Amazon DocumentDB (with MongoDB compatibility) Certificates and then review how you manage the cert rotation process for your own systems. And here’s a tip: schedule your cert expirations for a Tuesday during business hours to minimize the scramble needed to deal with forgotten expirations.
- Our next webcast is January 15th with Cecilia Marinier, RSAC Program Director, Innovation & Scholars where we will discuss RSAC Sandbox, RSAC Innovation Sandbox, RSAC Launch Pad, RSAC Security Scholar and their “How to” Seminar for Innovators and Entrepreneurs! Register for our upcoming webcasts by visiting securityweekly.com, selecting the webcast drop down from the top menu bar and clicking registration.
- Join us at InfoSecWorld 2020 – March 30 – April 1, 2020 at the Disney Contemporary Resort! Security Weekly listeners save 15% off the InfoSec World Main Conference or World Pass! Visit securityweekly.com/ISW2020 and click the register button to register with our discount code!
- Attend RSA Conference 2020, February 24-28 and join thousands of security professionals, forward-thinking innovators and solution providers for five days of actionable learning, inspiring conversation and breakthrough ideas. Register before January 24 and save $900 on a Full Conference Pass. Save an extra $150 by going to securityweekly.com/rsac2020 and using our code to register!