In October 2023, Red Hat Product Security announced the publishing of Vulnerability Exploitability eXchange (VEX) files, in beta form, for every single CVE ID that is recorded in the Red Hat CVE Database. Since then, we have actively collected feedback…
Category: Red Hat Security
Security vulnerability reporting: Who can you trust?
Good cyber security practices depend on trustworthy information sources about security vulnerabilities. This article offers guidance around who to trust for this information.In 1999, MITRE Corporation, a US Government-funded research and development company, realized the world needed a uniform standard…
Embracing automated policy as code in financial services
In the ever-evolving world of financial services, staying compliant, secure and efficient is paramount. Financial institutions are under constant pressure to manage risks, adhere to regulatory requirements and ensure operational consistency. With the advent of new technologies, the complexity of…
Post-quantum cryptography: Code-based cryptography
If you want to know what post-quantum cryptography is or why any one will care, see part 1 of my series.On August 24, 2023 the National Institute of Standards and Technology (NIST) published its first draft of post-quantum algorithms. The…
API security: The importance of rate limiting policies in safeguarding your APIs
In today’s networked digital world, application programming interface (API) security is a crucial component in safeguarding private information and strengthening the integrity of online transactions. The potential for attack has increased dramatically as a result of the growing use of…
The State of Kubernetes Security in 2024
The State of Kubernetes Security for 2024 report shows us that as the popularity of Kubernetes grows, the more important security planning and tooling becomes. Our annual report examines some of the most common cloud-native security challenges and business impacts…
Customize your Red Hat OpenShift nodes and keep them updated
Today we’re excited to announce a new mechanism for admins to safely and easily customize an operating system deployment with highly refined needs while taking full advantage of the automation and power provided by Red Hat OpenShift. This means you…
Passkey is the Future, and the Future is Now with Red Hat Enterprise Linux
Red Hat Enterprise Linux 9.4 introduces the ability for centrally managed users to authenticate through passwordless authentication with a passkey, meaning it’s an enterprise Linux distribution with Fast Identity Online 2 (FIDO2) authentication for centrally managed users! This is all…
The Marvin Attack
The Marvin Attack is a new side-channel attack on cryptographic implementations of RSA in which the attacker decrypts previously captured ciphertext by measuring, over a network, server response times to specially crafted messages. The attacker also may forge signatures with…
Reducing the significant risk of known exploitable vulnerabilities in Red Hat software
In a previous Red Hat article, VP of Red Hat Product Security, Vincent Danen, discussed the question “Do all vulnerabilities really matter?” He emphasized that “a software vulnerability has the potential to be exploited by miscreants to harm its user.”…
Security and safety of AI systems
It is hard to imagine any modern computer system that hasn’t been improved by the power of artificial intelligence (AI). For example, when you take a picture with your smartphone camera, on average more than twenty deep learning (DL) models…
ANSSI-BP-028 security recommendations updated to version 2.0
ANSSI, the National Cybersecurity Agency of France (Agence nationale de la sécurité des systèmes d’information), provides a configuration guide for GNU/Linux systems. It’s identified as ANSSI-BP-028 (formerly known as ANSSI DAT NT-028). Recently, ANSSI published an update of its ANSSI-BP-028…
Automating secrets management with HashiCorp Vault and Red Hat Ansible Automation Platform
A lot of organizations use Red Hat Ansible Automation Platform to orchestrate their infrastructure and Hashicorp Vault to manage their secrets. But how do they work together?HashiCorp Vault is a powerful tool for managing secrets, providing a centralized platform for…
Creating a Web Application Firewall in Red Hat OpenShift
In the last few years, several Red Hat customers have asked how to add a Web Application Firewall (WAF) to the OpenShift ingress to protect all externally facing applications.A WAF is a Layer 7 capability that protects applications against some…
Easily integrate Secrets Management System with Ansible Automation Platform to update systems passwords
Changing systems passwords is a common task that all systems administrators must do to keep up with all the latest security policies. Now with secrets being managed by the secrets management system, we need a way to integrate with that…
Exploring security by design and loosening guides
The concept of security by design, which includes the concept of security by default, is not new. In fact, secure by design is considered one of the fundamental principles of secure development. In general, we say there is security by…
Kentik for Ansible Automation Platform now certified with Red Hat
The Kentik Collection is now Red Hat Ansible Certified Content, and is available on Ansible automation hub. The highlight of this is Event-Driven Ansible, an event source plugin from Kentik to accept alert notification JSON. This works in conjunction with…
Automated Policy-as-Code. Start Small. Think Big.
How to get started with automated policy as code: Start small but think BIG.A policy enforcement feature is coming to future versions of Red Hat Ansible Automation Platform. This blog provides more detail around where we’re heading with this exciting…
Veeam Ransomware Protection with Red Hat Enterprise Linux as the Immutable Repository
Veeam Backup and Replication is a backup, recovery and data management platform that modernizes data protection for cloud, physical and virtual environments. In this post we’re going to look at using Veeam as part of a strategy to guard against…
Getting started with Red Hat Insights and FedRAMP
Recently we announced that Red Hat Insights along with Red Hat OpenShift on AWS GovCloud has achieved Federal Risk and Authorization Management Program (FedRAMP®) Agency Authority to Operate (ATO) at the High Impact Level.We delved down a bit further into…