Reducing Security Risks in Open Source Software at Scale: Scorecards Launches V4

Posted by Laurent Simon and Azeem Shaikh, Google Open Source Security Team (GOSST) 

Since our July announcement of Scorecards V2, the Scorecards project—an automated security tool to flag risky supply chain practices in open source projects—has grown steadily to over 40 unique contributors and 18 implemented security checks. Today we are proud to announce the V4 release of Scorecards, with larger scaling, a new security check, and a new Scorecards GitHub Action for easier security automation.

The Scorecards Action is released in partnership with GitHub and is available from GitHub’s Marketplace. The Action makes using Scorecards easier than ever: it runs automatically on repository changes to alert developers about risky supply-chain practices. Maintainers can view the alerts on GitHub’s code scanning dashboard, which is available for free to public repositories on GitHub.com and via GitHub Advanced Security for private repositories.

Additionally, we have scaled our weekly Scorecards scans to over one million GitHub repositories, and have partnered with the Open Source Insights website for easy user access to the data.

For more details about the release, including the new Dangerous-Workflow security check, visit the OpenSSF’s official blog post here.

/by

DoNot Go! Do not respawn!

ESET researchers take a deep look into recent attacks carried out by Donot Team throughout 2020 and 2021, targeting government and military entities in several South Asian countries

The post DoNot Go! Do not respawn! appeared first on WeLiveSecurity

/by

Social media in the workplace: Cybersecurity dos and don’ts for employees

Do you often take to social media to broadcast details about your job, employer or coworkers? Think before you share – less may be more.

The post Social media in the workplace: Cybersecurity dos and don’ts for employees appeared first on WeLiveSecurity

/by

Week in security with Tony Anscombe

How malware exploits security flaws in kernel drivers – Watch out for cryptocurrency scams – Why loyalty accounts are a target for criminals

The post Week in security with Tony Anscombe appeared first on WeLiveSecurity

/by

Making loyalty pay: How to keep your loyalty rewards safe from scammers

Is loyalty fraud on your radar? Here’s why your hard-earned reward points and air miles may be easy pickings for cybercriminals.

The post Making loyalty pay: How to keep your loyalty rewards safe from scammers appeared first on WeLiveSecurity

/by

Cryptocurrency scams: What to know and how to protect yourself

As you attempt to strike it rich in the digital gold rush, make sure you know how to recognize various schemes that want to part you from your digital coins

The post Cryptocurrency scams: What to know and how to protect yourself appeared first on WeLiveSecurity

/by

CES 2022: Wireless power for all

We don’t need no stinkin’ wall power as CES shows off the power and promise of usable long-range wireless charging

The post CES 2022: Wireless power for all appeared first on WeLiveSecurity

/by

Signed kernel drivers – Unguarded gateway to Windows’ core

ESET researchers look at malware that abuses vulnerabilities in kernel drivers and outline mitigation techniques against this type of exploitation

The post Signed kernel drivers – Unguarded gateway to Windows’ core appeared first on WeLiveSecurity

/by

CES 2022 – the “anyone can make an electric car” edition

But as we learned in mashing up other technologies, the security devil is in the details

The post CES 2022 – the “anyone can make an electric car” edition appeared first on WeLiveSecurity

/by

Week in security with Tony Anscombe

CES gives us a glimpse of our connected future – 10 bad cybersecurity habits to break this year – How hackers steal passwords

The post Week in security with Tony Anscombe appeared first on WeLiveSecurity

/by