Warning: Undefined variable $comments_html in /home/u319666691/domains/cybersecurityboard.com/public_html/_template.php on line 527

Repository for Software Attestation and Artifacts Now Live

Software producers who partner with the federal government can now upload their Secure Software Development Attestation Forms to CISA's Repository for Software Attestation and Artifacts.
Software producers that provide the government software can fill out the form to attest to implementation of specific security practices.
CISA and the Office of Management and Budget released the form on March 11, 2024, following extensive stakeholder and industry engagement.
See the recent blog post from Federal CISO and Deputy National Cyber Director Chris DeRusha and CISA Executive Assistant Director for Cybersecurity Eric Goldstein for additional information.
This product is provided subject to this Notification and this Privacy & Use policy.

This Cyber News was published on www.cisa.gov. Publication date: Mon, 18 Mar 2024 15:43:05 +0000

Cyber News related to Repository for Software Attestation and Artifacts Now Live

CISA Publishes Repository for Software Attestation and Artifacts - WASHINGTON - The Cybersecurity and Infrastructure Security Agency announces today the availability of the Repository for Software Attestation and Artifacts that software producers who partner with the federal government can use to upload software ...
1 year ago Cisa.gov

Feds seek attestation on secure software - The US federal government has released a software attestation form intended to ensure that software producers partnering with the government leverage minimum secure development techniques and tool sets. The form was announced March 11 by the ...
1 year ago Infoworld.com

San Francisco Police's Live Surveillance Yields Almost 200 Hours of Spying-Including of Music Festivals - A new report reveals that in just three months, from July 1 to September 30, 2023, the San Francisco Police Department racked up 193 hours and 19 minutes of live access to non-city surveillance cameras. That means for the equivalent of 8 days, police ...
1 year ago Eff.org

How to Build a SOAR Playbook: Start with the Artifacts - Security Boulevard - Artifacts are data elements relevant to your security incidents, such as device IDs, user IDs, IP addresses, file hashes, and process names. By focusing on commands that interact with your key artifacts, you streamline your playbook, making it more ...
11 months ago Securityboulevard.com

Repository for Software Attestation and Artifacts Now Live - Software producers who partner with the federal government can now upload their Secure Software Development Attestation Forms to CISA's Repository for Software Attestation and Artifacts. Software producers that provide the government software can ...
1 year ago Cisa.gov

The Limitations of Google Play Integrity API - This overview outlines the history and use of Google Play Integrity API and highlights some limitations. We also compare and contrast Google Play Integrity API with the comprehensive mobile security offered by Approov. Google provides app attestation ...
1 year ago Securityboulevard.com

Warning: Undefined array key "host" in /home/u319666691/domains/cybersecurityboard.com/public_html/_template.php on line 364

Warning: Undefined variable $domain_html in /home/u319666691/domains/cybersecurityboard.com/public_html/_template.php on line 466

CVE-2024-23332 - The Notary Project is a set of specifications and tools intended to provide a cross-industry standard for securing software supply chains by using authentic container images and other OCI artifacts. An external actor with control of a compromised ...
1 year ago

CVE-2025-24362 - In some circumstances, debug artifacts uploaded by the CodeQL Action after a failed code scanning workflow run may contain the environment variables from the workflow run, including any secrets that were exposed as environment variables to the ...
7 months ago Tenable.com

Fake Ledger Live app in Microsoft Store steals $768,000 in crypto - Microsoft has recently removed from its store a fraudulent Ledger Live app for cryptocurrency management after multiple users lost at least $768,000 worth of cryptocurrency assets. Published with the name Ledger Live Web3, the fake application ...
1 year ago Bleepingcomputer.com

CVE-2022-35929 - cosign is a container signing and verification utility. In versions prior to 1.10.1 cosign can report a false positive if any attestation exists. `cosign verify-attestation` used with the `--type` flag will report a false positive verification when ...
3 years ago

What Is Software Piracy? - Software piracy has become a worldwide issue, with China, the United States and India being the top three offenders. In 2022, 6.2% of people worldwide visited software piracy websites. Software piracy doesn't require a hacker or skilled coder. Any ...
1 year ago Pandasecurity.com

Industrials at Cisco Live 2024 - Network with thought leaders and gain forward-thinking insights driving your sector forward. Get started with a full list of industry sessions and activities. Join the leading minds in IT and learn about cutting-edge practices driving innovation in ...
1 year ago Feedpress.me

CVE-2021-32724 - check-spelling is a github action which provides CI spell checking. In affected versions and for a repository with the [check-spelling action](https://github.com/marketplace/actions/check-spelling) enabled that triggers on `pull_request_target` (or ...
3 years ago

Windows Incident Response: ...and the question is... - The is a massive oversimplification of the nature and value of each of these artifacts, in addition to just being an extremely poor analytic process; that is, viewing single artifacts in isolation to establish a finding. First, let me say, I get ...
1 year ago Windowsir.blogspot.com

Reflections from Cisco Live Melbourne: Innovation, Sustainability, and Connections - As I reflect on the whirlwind of excitement and innovation that was Cisco Live Melbourne, I am inspired by the sheer passion and engagement that filled every corner of the event. Being there, live and in person, was a reminder of the power of human ...
1 year ago Feedpress.me

Join Customer Experience for Cisco Live EMEA Demos - In her blog, Countdown to Cisco Live EMEA, Adele Trombetta, SVP, Cisco Customer Experience EMEA, mentioned how excited she is for Cisco Live EMEA in just a little more than a week, and I agree. I want to go a little deeper and give you some more ...
1 year ago Feedpress.me

CVE-2024-35873 - In the Linux kernel, the following vulnerability has been resolved: ...
1 year ago

What's Coming to Cisco Live Europe 2024 for the Data Center Developer? - In just a week or so, Cisco Live EMEA, 2024 will be ready to sizzle at the RAI Amsterdam. From a Cisco Cloud Networking standpoint, Cisco Nexus Dashboard, Cisco ACI, and Nexus 9000 Series switches are showing up in a big way. Read on to learn what ...
1 year ago Feedpress.me

CVE-2024-36115 - Reposilite is an open source, lightweight and easy-to-use repository manager for Maven based artifacts in JVM ecosystem. As a Maven repository manager, Reposilite provides the ability to view the artifacts content in the browser, as well as perform ...
1 year ago

CVE-2025-25204 - `gh` is GitHub’s official command line tool. Starting in version 2.49.0 and prior to version 2.67.0, under certain conditions, a bug in GitHub's Artifact Attestation cli tool `gh attestation verify` causes it to return a zero exit status when no ...
6 months ago Tenable.com

Data Insights Exposes Ledger's Granular Tracking: Is Privacy at Stake? - An investigation by Rekt Builder has raised concerns about the extent of data collection by Ledger Live, the official software for managing Ledger hardware wallets. The developer claims that Ledger Live tracks every move users make, including the ...
1 year ago Cysecurity.news

CVE-2022-37866 - When Apache Ivy downloads artifacts from a repository it stores them in the local file system based on a user-supplied "pattern" that may include placeholders for artifacts coordinates like the organisation, module or version. If said ...
2 years ago

The Crucial Need for a Secure Software Development Lifecycle in Today's Digital Landscape - In today's increasingly digital world, software is the backbone of business operations, from customer-facing applications to internal processes. The rapid growth of software development has also made organizations more vulnerable to security threats. ...
1 year ago Cyberdefensemagazine.com

GitHub Artifact Attestions now generally available - GitHub's Artfact Attestations, for guaranteeing the integrity of artifacts built inside the GitHub Actions CI/CD platform, is now generally available. By using Artifact Attestations in GitHub Actions workflows, developers can improve security and ...
1 year ago Infoworld.com

Understanding SBOMs - In recent years, the adoption of open-source software in development has surged, now comprising up to 90% of what's built. There is a crucial aspect to consider when integrating open-source software components. To make sure their software is safe, ...
1 year ago Securityboulevard.com