De plus en plus nous constatons des commits non pas pour corrigés mais pour inclure volontairement des failles de sécurité. Cela avait conduit Linus Torvald à refuser dans le noyau toutes les contributions de l'université du Minnesota https://linux.developpez.com/actu/314666/La-Fondation-Linux-veut-des-details-sur-toutes-les-contributions-au-noyau-Linux-faites-par-l-universite-du-Minnesota-avant-qu-elle-ne-soit-autorisee-a-contribuer-a-nouveau-au-noyau/ Il y avait aussi eu l'affaire node-ipc https://www.lemondeinformatique.fr/actualites/lire-avec-le-sabotage-de-node-ipc-la-protestation-dans-l-open-source-inquiete-86188.html Il y a encore peu de temps nous considérions systématiquement un système à jour comme plus fiable qu'un système pas à jour. Cela n’est pas forcément vrai à présent. La simplicité, le coût et la portée considérable d’une attaque de la chaîne d'approvisionnement laisse à penser que ce genre d’attaque va encore s’accroitre.

Code

https://fr.wikipedia.org/wiki/Seccomp

https://github.com/seccomp/libseccomp-golang

Open Source Supply chain - OpenSSF Scorecard:

Pishing

Le PHISHING : sachez le reconnaître en un coup d'œil

client-side scanning (CSS)

Cell-Site Simulators

Notes techniques

~/.mysql_history

Howto

http://www.funix.org/fr/linux/intrusions.htm

Audit sécurité

Vérif toutes les urls si setup.php etc….

Spectre / Meltdown / Retbleed \ Side Channel Attack\ Voir Software Guard Extensions (SGX)

dmesg | grep 'Kernel/User page tables isolation'

Voir :

script : https://raw.githubusercontent.com/speed47/spectre-meltdown-checker/master/spectre-meltdown-checker.sh

Patch : https://docs.ovh.com/fr/dedicated/meltdown-spectre-kernel-update-per-operating-system/

Autres

URLs à bloquer / WAF reverse proxy / firewall applicatif

Passer à bloquer les URLs suivantes :

*/nohup.out

Frameworks

Template	Description
CIS CSC v8.1	Center for Internet Security Controls v8.1 framework covering foundational, foundational, and organizational security controls.
CSA CCM v4	Cloud Security Alliance Cloud Controls Matrix v4 framework for cloud security assurance.
Cyber Essentials	UK government-backed Cyber Essentials scheme covering five key technical controls.
DORA	Digital Operational Resilience Act framework for financial sector ICT risk management.
FedRAMP High	Federal Risk and Authorization Management Program High baseline for US federal cloud services.
FedRAMP Low	Federal Risk and Authorization Management Program Low baseline for US federal cloud services.
FedRAMP Moderate	Federal Risk and Authorization Management Program Moderate baseline for US federal cloud services.
IRAP Official	Australian Information Security Registered Assessors Program Official classification framework.
IRAP Protected	Australian Information Security Registered Assessors Program Protected classification framework.
IRAP Secret	Australian Information Security Registered Assessors Program Secret classification framework.
IRAP Top Secret	Australian Information Security Registered Assessors Program Top Secret classification framework.
ISMAP	Japanese Information System Security Management and Assessment Program framework.
ISO 27001:2022	International standard for information security management systems.
NIS 2	EU Network and Information Security Directive 2 framework for critical infrastructure.
NIST 800-171 Rev. 3 CMMC	NIST SP 800-171 Revision 3 Cybersecurity Maturity Model Certification framework.
NIST SP 800-218	NIST Secure Software Development Framework (SSDF) v1.1.
NIST 800-53 Revision 5	NIST SP 800-53 Rev. 5 security and privacy controls for information systems.
SOC 2	System and Organization Controls 2 framework with requirements mapped to COSO principles, covering vulnerability scanning, access controls, and change management.
TISAX	Trusted Information Security Assessment Exchange framework for automotive industry information security requirements

Source : https://docs.gitlab.com/user/compliance/compliance_frameworks/