Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-3769PUBLISHED: 2021-11-30
# Vulnerability in `pygmalion`, `pygmalion-virtualenv` and `refined` themes **Description**: these themes use `print -P` on user-supplied strings to print them to the terminal. All of them do that on git information, particularly the branch name, so if the branch has a specially-crafted name the vul...
CVE-2021-3725PUBLISHED: 2021-11-30
Vulnerability in dirhistory plugin Description: the widgets that go back and forward in the directory history, triggered by pressing Alt-Left and Alt-Right, use functions that unsafely execute eval on directory names. If you cd into a directory with a carefully-crafted name, then press Alt-Left, the...
CVE-2021-3726PUBLISHED: 2021-11-30
# Vulnerability in `title` function **Description**: the `title` function defined in `lib/termsupport.zsh` uses `print` to set the terminal title to a user-supplied string. In Oh My Zsh, this function is always used securely, but custom user code could use the `title` function in a way that is unsaf...
CVE-2021-3727PUBLISHED: 2021-11-30
# Vulnerability in `rand-quote` and `hitokoto` plugins **Description**: the `rand-quote` and `hitokoto` fetch quotes from quotationspage.com and hitokoto.cn respectively, do some process on them and then use `print -P` to print them. If these quotes contained the proper symbols, they could trigger c...
CVE-2021-43790PUBLISHED: 2021-11-30
Lucet is a native WebAssembly compiler and runtime. There is a bug in the main branch of `lucet-runtime` affecting all versions published to crates.io that allows a use-after-free in an Instance object that could result in memory corruption, data race, or other related issues. This bug was introduce...
How Data Breaches Affect the EnterpriseData breaches continue to cause negative outcomes for companies worldwide. However, many organizations report that major impacts have declined significantly compared with a year ago, suggesting that many have gotten better at containing breach fallout. Download Dark Reading's Report "How Data Breaches Affect the Enterprise" to delve more into this timely topic.
Incident Readiness and Building Response Playbook
In this special report, learn the Xs and Os of any good security incident readiness and response playbook.
Tweet This
0 Comments
User Rank: Author
12/9/2015 | 10:48:17 AM
Beyond making risk-based choices, it's time the enterprise begin to realise that the authentication and authorization paradigms that have been with us since the dawn of corporate security history are all but dead. What does an authentication session mean anyway these days? All fraud cases in online banking come from authenticated sessions. All hacks come from authenticated nodes.
The same applies to authorization. Take RBAC - a fundumental principal in security. Josh is a CTO, so he has access to this-and-that. Unless Josh changes his role, or unless that role needs an updated access scheme, that's basically it. But in today's reality, it's totally rubish. Yes, Josh is entitled to access this-and-that, but only if I think it's really Josh, and he really needs that access right now. If there are signs of foul play, I may change my mind. And if I have an ability to dynamically change my mind about authorization, and make sure people get access based on the risk for this specific activity, I'm far better off.
The same goes for my smart home app, the one I'm using to control my smart home. Once I authenticated, I have full access to everything. That's history. Future is different: far more agile and adaptive. The more it looks like me, and the lowest the risk with my current actions, the greater control I should have. And think of IOT appliances as well - they also have authentication and authorization controls that are totally black and white, and without giving it shades and adaptiveness - we'll be screwed a few years from now.
The enterprise security paradigms need some heavy shaking, become far more dynamic, adaptive and risk-based, so real time decisions can be made instantly for every activity.