## 1. Project Overview & Quickstart (intuitem/LICENSE) # LICENSE Open-source repository intuitem/LICENSE ### Repository Details - **Repository:** [intuitem/LICENSE](https://github.com/intuitem/LICENSE) - **Primary Language:** Code *Note: High-volume repository documentation is actively indexed and synchronized by YakaAI.* ## 2. Official Technical Reference & Guides (intuitem/intuitem.github.io) ## File: README.md # 🚀 AstroWind intuitem 🌟 _Most *starred* & *forked* Astro theme in 2022 & 2023_. 🌟 **AstroWind** is a free and open-source template to make your website using **[Astro 4.0](https://astro.build/) + [Tailwind CSS](https://tailwindcss.com/)**. Ready to start a new project and designed taking into account web best practices. - ✅ **Production-ready** scores in **PageSpeed Insights** reports. - ✅ Integration with **Tailwind CSS** supporting **Dark mode** and **_RTL_**. - ✅ **Fast and SEO friendly blog** with automatic **RSS feed**, **MDX** support, **Categories & Tags**, **Social Share**, ... - ✅ **Image Optimization** (using new **Astro Assets** and **Unpic** for Universal image CDN). - ✅ Generation of **project sitemap** based on your routes. - ✅ **Open Graph tags** for social media sharing. - ✅ **Analytics** built-in Google Analytics, and Splitbee integration. [](https://onwidget.com) [](https://github.com/onwidget/astrowind/blob/main/LICENSE.md) [](https://github.com/onwidget) [](https://github.com/onwidget/astrowind#contributing) [](https://snyk.io/test/github/onwidget/astrowind) [](https://github.com/onwidget/astrowind) [](https://github.com/onwidget/astrowind) Table of Contents - [Demo](#demo) - [Getting started](#getting-started) - [Project structure](#project-structure) - [Commands](#commands) - [Configuration](#configuration) - [Deploy](#deploy) - [Frequently Asked Questions](#frequently-asked-questions) - [Related Projects](#related-projects) - [Contributing](#contributing) - [Acknowledgements](#acknowledgements) - [License](#license) ## Demo 📌 [https://astrowind.vercel.app/](https://astrowind.vercel.app/) ## Getting started **AstroWind** tries to give you quick access to creating a website using [Astro 4.0](https://astro.build/) + [Tailwind CSS](https://tailwindcss.com/). It's a free theme which focuses on simplicity, good practices and high performance. Very little vanilla javascript is used only to provide basic functionality so that each developer decides which framework (React, Vue, Svelte, Solid JS...) to use and how to approach their goals.. ### Project structure Inside **AstroWind** template, you'll see the following folders and files: ``` / ├── public/ │ ├── _headers │ └── robots.txt ├── src/ │ ├── assets/ │ │ ├── favicons/ │ │ ├── images/ │ │ └── styles/ │ │ └── tailwind.css │ ├── components/ │ │ ├── blog/ │ │ ├── common/ │ │ ├── ui/ │ │ ├── widgets/ │ │ │ ├── Header.astro │ │ │ └── ... │ │ ├── CustomStyles.astro │ │ ├── Favicons.astro │ │ └── Logo.astro │ ├── content/ │ │ ├── post/ │ │ │ ├── post-slug-1.md │ │ │ ├── post-slug-2.mdx │ │ │ └── ... │ │ └-- config.ts │ ├── layouts/ │ │ ├── Layout.astro │ │ ├── MarkdownLayout.astro │ │ └── PageLayout.astro │ ├── pages/ │ │ ├── [...blog]/ │ │ │ ├── [category]/ │ │ │ ├── [tag]/ │ │ │ ├── [...page].astro │ │ │ └── index.astro │ │ ├── index.astro │ │ ├── 404.astro │ │ ├-- rss.xml.ts │ │ └── ... │ ├── utils/ │ ├── config.yaml │ └── navigation.js ├── package.json ├── astro.config.mjs └── ... ``` Astro looks for `.astro` or `.md` files in the `src/pages/` directory. Each page is exposed as a route based on its file name. There's nothing special about `src/components/`, but that's where we like to put any Astro/React/Vue/Svelte/Preact components. Any static assets, like images, can be placed in the `public/` directory if they do not require any transformation or in the `assets/` directory if they are imported directly. [](https://githubbox.com/onwidget/astrowind/tree/main) [](https://gitpod.io/?on=gitpod#https://github.com/onwidget/astrowind) [](https://stackblitz.com/github/onwidget/astrowind) > 🧑‍🚀 **Seasoned astronaut?** Delete this file `README.md`. Update `src/config.yaml` and contents. Have fun! ### Commands All commands are run from the root of the project, from a terminal: | Command | Action | | :-------------------- | :------------------------------------------------- | | `npm install` | Installs dependencies | | `npm run dev` | Starts local dev server at `localhost:3000` | | `npm run build` | Build your production site to `./dist/` | | `npm run preview` | Preview your build locally, before deploying | | `npm run format` | Format codes with Prettier | | `npm run lint:eslint` | Run Eslint | | `npm run astro ...` | Run CLI commands like `astro add`, `astro preview` | ### Configuration Basic configuration file: `./src/config.yaml` ``` /* Detailed source-code truncated for AI context efficiency. */ ``` ### Deploy #### Deploy to production (manual) You can create an optimized production build with: ```shell npm run build ``` Now, your website is ready to be deployed. All generated files are located at `dist` folder, which you can deploy the folder to any hosting service you prefer. #### Deploy to Netlify Clone this repository on own GitHub account and deploy to Netlify: [](https://app.netlify.com/start/deploy?repository=https://github.com/onwidget/astrowind) #### Deploy to Vercel Clone this repository on own GitHub account and deploy to Vercel: [](https://vercel.com/new/clone?repository-url=https%3A%2F%2Fgithub.com%2Fonwidget%2Fastrowind) ## Frequently Asked Questions - Why? - - ## Related projects - [TailNext](https://tailnext.vercel.app/) - Free template using Next.js 14 and Tailwind CSS with the new App Router. - [Qwind](https://qwind.pages.dev/) - Free template to make your website using Qwik + Tailwind CSS. ## Contributing If you have any idea, suggestions or find any bugs, feel free to open a discussion, an issue or create a pull request. That would be very useful for all of us and we would be happy to listen and take action. ## Acknowledgements Initially created by [onWidget](https://onwidget.com) and maintained by a community of [contributors](https://github.com/onwidget/astrowind/graphs/contributors). ## License **AstroWind** is licensed under the MIT license — see the [LICENSE](./LICENSE.md) file for details. --- ## File: src/content/post/5-mistakes-execs-make-about-cybersecurity.md --- draft: false title: "Five mistakes Executives Are Still doing About Cybersecurity" author: Abderrahmane Smimite publishDate: 2023-09-10T00:00:00Z image: https://images.unsplash.com/photo-1570126646281-5ec88111777f?ixlib=rb-4.0.3&ixid=M3wxMjA3fDB8MHxwaG90by1wYWdlfHx8fGVufDB8fHx8fA%3D%3D&auto=format&fit=crop&w=430&q=80 excerpt: "Five common mistakes that executives keep repeating about cyber security and some actionable insights on how to deal with them" category: Articles tags: - Exec - Management metadata: canonical: https://intuitem.com/5-mistakes-execs-make-about-cybersecurity --- ## Introduction Cybersecurity has become crucial to every organization’s success in today’s digital age. Cyber attacks are becoming increasingly sophisticated and frequent and can have devastating consequences for businesses. However, many executives are dismissing essential aspects of cybersecurity. This blog post will discuss five critical points executives often overlook about cybersecurity and provide actionable insights to address them. It’s important to note that the list could be more comprehensive, but we highlight common topics we frequently discuss with our customers’ executives. ## Prioritizing Compliance Over Remediation Many organizations concentrate only on compliance and assessments to verify that their cybersecurity measures are checking the boxes. Although compliance is crucial, it can give a misleading impression of security. Therefore, organizations should avoid the trap of filling compliance checklists and prioritize actionable remediations to enhance their cybersecurity stance. **Actionable insight:** Build your cyber security program first and then use compliance through continuous controls to make sure it won’t regress. **Bonus point:** We have noticed that the most successful cyber security programs are paired with continuous control teams instead of having compliance managed by legal or isolated GRC teams. ## Focusing On Protection Rather Than Resiliency Another common mistake executives tend to make is focusing solely on protection rather than resiliency. Protection measures such as firewalls, EDR, and IAM are essential, but as with everything, they can be misconfigured, fail, or even worse, be the attack vector. Organizations need to focus on resiliency and have a plan to address incidents when they occur instead of trying too hard to avoid them, i.e., this echoes the « assume-breach » mindset that many cyber security professionals advocate. **Actionable insight:** To improve resiliency, organizations need to focus on incident response planning, backup and recovery measures, and active and realistic testing. Chaos engineering practices can be of value in this context. **Bonus point:** Many organizations overlook the threat posed by insider attacks, which can be just as devastating as external ones, if not more. So, it should be considered for resiliency and protection. ## Considering CyberSec As A Technical Function Cybersecurity is often perceived as a technical function, leading to a disconnect between the cybersecurity team and the rest of the business. Organizations need to view cybersecurity as a business function and involve all « ranks » in the process to improve cybersecurity. This is where a risk-driven approach to building a cyber security program is valuable, and the best ones are business-aligned. Furthermore, organizations must recognize that cybersecurity is not just about implementing tools but also about mindset, processes, and other people-related issues such as social engineering and phishing attacks. **Actionable insight:** Create bridges between all organization functions around risk analysis and management where cyber security teams will provide the tools and processes to handle them. ## Underestimating Third-Party Risk Management Many organizations overlook the risks posed by third-party vendors and suppliers. This covers libraries developers use in their code, a SaaS service, a Cloud Service Provider, and contractors’ cyber security responsibilities. Failure to manage third-party risks can lead to devastating consequences, as seen in several high-profile breaches in recent years. **Actionable insight:** Implement third-party risk management workflows and support them with the right tools. Organizations need to assess all third-party vendors and suppliers, implement appropriate controls to mitigate risks, and understand each party’s responsibility. ## Missing The Business Value Of CyberSec Finally, many executives perceive cybersecurity as a cost center rather than a business enabler. There are so many layers to this discussion. Still, the easy way to look at it is that while cybersecurity can sometimes be expensive, it should be treated as an insurance policy and, even better, can be a competitive advantage. Organizations prioritizing cybersecurity can build trust with customers and partners and differentiate themselves from competitors. If you are still debating whether or not to implement MFA for your end-users, you may need to have the proper discussion. **Actionable insight:** Organizations need to assess the financial impact of cybersecurity through a risk-driven approach and develop a long-term financial plan that incrementally prioritizes cybersecurity investments. A cross-functional discussion involving security experts, product management, and marketing can also be beneficial to expose the business value. ## Summary In conclusion, most organizations have gained enough awareness about the importance of cyber security as a vital function of their businesses. The five points highlighted can trigger a healthy debate to improve the cyber security posture. *In addition to its product activity, intuitem has a consultancy service dedicated to helping companies build optimal cyber security programs that fit their needs instead of pre-packaged ones. You are welcome to reach out to learn more about our services.* --- ## File: src/content/post/7-reasons-agile-is-dying.md --- draft: false title: 7 reasons why "Agile" is dying (and why it's a good thing) category: articles author: Abderrahmane Smimite publishDate: 2022-10-28T11:39:00Z image: https://images.unsplash.com/photo-1552664730-d307ca884978?ixlib=rb-4.0.3&ixid=M3wxMjA3fDB8MHxwaG90by1wYWdlfHx8fGVufDB8fHx8fA%3D%3D&auto=format&fit=crop&w=430&q=80 excerpt: "here is a summary of what I believe is broken about the current state of Agile (yes, the marketing noun with the capital A) that I have tried to illustrate through real-life examples" tags: ["agile", "scaling", "methodology"] --- **B**ased on personal experience, research, and a lot of intense discussions with fellow agilists and people involved in Software Development, here is a summary of what I believe is broken about the current state of Agile (yes, the marketing noun with the capital A) that I have tried to illustrate through real-life examples. I promise that this is not just a microwaved version of Dave Thomas's 2015 talk, which you should definitely check 😊 Let's dive in: 1. It's becoming more about methodologies rather than common sense core values: most likely, when you've read Agile, you were thinking about Scrum, kanban, SAFe, etc., rather than the Manifesto for Agile Software Development, the X over Y pattern, and why it was created. *Anti-pattern: Our team is agile because it does grooming sessions, sprint reviews, sprint planning, and sprint retro.* 2. It's becoming more about tools rather than why we use them. It must be more than just filling some exotic Jira fields that someone who's not even on the project anymore copied from somewhere on the internet. *Anti-pattern: The issue is that we need an extra field to track this on Jira, add more steps to the workflow and buy this plugin to create an adaptive view. Scratch that; what's blocking our agility is that we don't have the right to create a new Jira project.* 3. It's becoming more about packaging software delivery into something controllable and understandable by the exec level: how much does it cost for 5 kilos of Story points? We have been twisting concepts such as commitment and ownership for a while now. *Anti-pattern: The transformation office has noticed that on the last PI, predictability has dramatically decreased, which means that the Teams are not Agile enough.* 4. It has become a well-established industry that has drifted toward collecting (and renewing!) certifications and badges on LinkedIn rather than going through the actual practical iterations. Don't get me started on McKinsey and other big consulting companies. It's ok to make a living out of Agile, I am a consultant myself, but this mayhem and noble concepts distortion have to stop. *Anti-pattern: The performance issue we face is because the design team did not go through SAFe for Architects.* 5. It has become chiefly this weird trend about branding projects and organizations as modern and state-of-the-art without being willing to go all the way to apply the principles across the whole organization, especially with "Agile @Scale." *Anti-pattern: We hired Agile coaches. They are the new managers; accordingly, you must obey them from now on. The company will use sprint metrics to monitor productivity and team efficiency. Also, the project managers are now the scrum masters for department A and the Product Owners for department B.* 6. Agile becomes mostly about speedy, broken MVPs rather than actual working software. Yes, we need to experiment fast but let's call it just that, an experiment, proof of concept, proof of value, or whatever you are comfortable with instead of shipping non-quality in the name of agility. *Anti-pattern: sure, this microservice could break with ten users. We're not sure, it was not tested, but it should be enough for v1 (yes, usually in the passive voice). We need to be Agile to meet Time To Market requirements.* 7. Some teams refuse to adapt to new factors and adjustments in priorities in the name of Agile. Some typical sentences are within the lines of "it doesn't fit with this sprint or this PI, it has to go through sprint grooming and planning sessions, we cannot work on unscored topics, etc." I get the motivation behind that, but the narrative is often wrong and associated with a poor choice of wording. *Anti-pattern: Sorry, security team, we cannot handle the findings of the pentest. We need to ship these almost-done features in the next 4 to 6 months, and we'll have time then to recover this technical debt.* The TL;DR version is that I believe that what companies and teams are perceiving today as "Agile" has drifted away from its core values toward tools, ceremonies, metrics, and prepackaged concepts, which contradict the initial intent. In the grand scheme of things, I believe it is a good thing as all of this is just a big iteration: kanban, scrum, scrumban, SAFe, etc., all are experiments that just happened to last a bit longer than expected. What matters now is where we can take it from this point and shamelessly learn from what didn't work. Here are some random thoughts on how you can "denoise" your workflows: Start by unlearning "Agile" and review the agility values. These values are pretty straightforward, so don't over-engineer it: identify value, build through small incremental steps, make sure that your design choices can evolve in an optimal way, learn from previous attempts, and repeat (aka the late 50's PDCA principle) Context matters: Agility is not a one-size-fits-all recipe, and you need to adapt it to your project/product/organization. There are good things to cheery-pick from the existing frameworks, methodologies, and tools. Agility is the most efficient when understood and adopted across the whole organization. Always keep an open mind for uncertainty and unexpected events to adapt and possibly even thrive. Bonus: if you hear a big company promoting a "packaged" Agile transformation Office or Program, just Run! Some good references: - Agile & Scrum Don't Work | Allen Holub In The Engineering Room Ep. 9 https://www.youtube.com/watch?v=hxXmTnb3mFU - https://medium.com/agileinsider/agile-is-dead-mckinsey-just-killed-it-547df8c6c9df - https://www.youtube.com/watch?v=a-BOSpxYJ9M - https://effectivesoftwaredesign.com/2014/03/17/the-end-of-agile-death-by-over-simplification/ --- ## File: src/content/post/chicken-egg-dilemma-cloud-hsm.md --- draft: false title: Chicken and Egg Dilemma with Cloud HSMs category: articles author: Eric Laubacher publishDate: 2019-04-03T11:39:00Z image: https://images.unsplash.com/photo-1593720213428-28a5b9e94613?&fit=crop&w=430&h=240 excerpt: "" tags: ["cloud", "rewrite", "redirection", "rules"] --- **I** have been asked recently about a design issue with HSMs in Kubernetes infrastructure (and cloud application in general): if an HSM contains all the keys, how can a pod authenticates to the HSM, without having itself a secret or private key? another common one is what's the point of having an HSM in the cloud if we end up trusting the provider for key management? This article aims to shed some light on this issue. ## What are HSMs A Hardware Security Module is a piece of specialized equipment dedicated to the management, storage, and exploitation of cryptographic secrets. The functions of an HSM can be easily performed by standard computers, using common cryptographic libraries like OpenSSL, so functionality is not a driver to use an HSM. performance is not the reason neither, as a mid-range server can perform more cryptographic operations and even faster than most HSMs.  The real added value of an HSM is to fulfill a fundamental security objective: the non-extractability of secret cryptographic material. A cryptographic key is said to be non-extractable if it is technically impossible to get a copy of it. It means that the only option for an attacker to abuse that key is to have physical or network access to the HSM. To achieve non-extractability, HSM manufacturers combine several security mechanisms: - The enclosure of the HSM is tamper-proof, with tight intrusion detection that provokes the erasure of secrets. - The security functions are highly specialized, and the software is thoroughly verified to avoid software vulnerabilities. Most HSMs are designed so that secrets keys never leave a hardware component, thus even a software vulnerability does not enable cloning a key. HSMs also provide secure audit logs of all actions. In the event of an attack, this provides a better view of the extent of the compromise. Let's compare a situation of suspicion of compromise of a signing key:  - A software-stored signing key shall be revoked anyway, for fear that the key has been cloned and will be used later by an attacker. - An HSM-stored signing key cannot be cloned, so there is no risk of that key being used later by an attacker once the breach is fixed. There is still a risk that forged signatures have been issued during the compromise. Fortunately, the audit log provided by the HSM will trace all the signatures that have been issued by the HSM, and thus it is possible to decide the optimal course of action. HSMs can be fitted in a server expansion slot, but most of them are available today in the form of a network appliance, which is very appropriate for data centers. They can be accessed from applications using appropriate libraries provided by the manufacturer, typically with a PKCS#11 interface or in the form of an OpenSSL engine. ## The issue with cryptographic keys in the cloud As noted earlier, there is no difficulty to perform cryptographic functions in a traditional server. Modern CPUs even embed hardware acceleration for AES, the infamous cryptographic algorithm. In many cases, we can process ephemeral keys only in RAM and for the duration of a session. The issue arises when there is a need to manipulate a long-term secret, like a signature key used for authentication for instance.  To benefit from non-extractability, we would like to store such a key in a network HSM, but any machine having access to the HSM could authenticate with that key. How can we control the access to that key so that only legitimate pods are authorized? The access control can be performed either by the network equipment or by the HSM. Let's consider both approaches. ### Access control at the network level The network equipment can filter packets to limit access to specific IP addresses or ports. Practically, the sole criterion to distinguish the applicant is the source IP address. To distinguish which key is requested, the destination port is a good match. But in a Kubernetes environment and most modern cloud architecture, the IP address of the pod is dynamic, so this is not a straightforward solution. ### Access control by the HSM The HSM can perform similar network filtering as the network equipment, but with the same shortcomings. It can also authenticate the client at the session or application level. However, this requires a long-term secret on the client side. But avoiding that situation was the whole point of using an HSM, thus the dilemma. ## Getting out of the loop The naked truth is that we need to trust the Kubernetes cluster to solve this chicken and egg problem. Here are a few possibilities: - Use a secret credential stored in a Kubernetes Secret object. This information is encrypted, and the encryption key will be stored in the etcd servers of the cluster. It is possible to enable data-at-rest encryption of the etcd database, notably with a KMS configuration (see reference [1]). - Use a Container Network Interface module that is able to control egress traffic from pods to the HSM, using the destination port as the key selector. Calico is a good candidate for this approach. A general deny rule shall be set, and then an egress filtering rule shall be established for each key access control (see reference [2]). - Use an access control mechanism provided by the cloud infrastructure. Azure provides an interesting solution with a Managed Service Identity used to control the access to Azure Key Vault, which is an abstract service implemented using HSMs (see reference [3]). ## Is it worth the effort? HSMs are no silver bullet, and the administrators of the Kubernetes cluster and infrastructure still need to be trusted. HSMs facilitate monitoring of sensitive key usage, significantly reduce the pitfalls of manipulating secrets for developers and operators, and help to recover more quickly in case of compromise. So clearly HSM technology makes sense in any cloud infrastructure running sensitive applications, especially for regulated industries. In my personal experience, in most case a software-based solution for secret management such as the infamous Vault (Hashicorp) is largely enough, and where we can focus on securing the master key (using an HSM for instance if required by regulation). **References** - [1] https://kubernetes.io/docs/tasks/administer-cluster/kms-provider/: how to use a KMS for data-at-rest encryption in etcd. - [2] https://docs.projectcalico.org/v3.5/getting-started/kubernetes/tutorials/advanced-policy: how to set a network filtering policy with Calico. - [3] https://lukieb.blogspot.com/2018/06/winning-chicken-and-egg-problem-with.html: an inspiring article that exposes a clever solution for Azure Vault. --- ## File: src/content/post/communique-presse-mira-v3.md --- draft: false title: "Mira v3 : communiqué de presse" category: presse author: Abderrahmane Smimite publishDate: 2023-04-03T07:00:00Z image: https://images.unsplash.com/photo-1627163439134-7a8c47e08208?&fit=crop&w=430&h=240 excerpt: "" tags: ["software", "security", "devsecops", "secdevops"] --- ## intuitem dévoile la version 3 de sa plateforme de gestion des risques cyber "MIRA" lors de la 15ème édition du FIC. > Lille, le 5 avril 2023 : intuitem, une startup innovante dans les services et produits visant à simplifier la cybersécurité, annonce aujourd'hui le lancement officiel de Mira v3. Il s’agit de sa plateforme de gestion de risques cyber particulièrement pensée pour avoir une approche de bout en bout. Disponible en version « SaaS » ou « on-premises », Mira convient aux usages des petites et grandes entreprises et offre des capacités de personnalisation pour s’adapter à leurs besoins spécifiques. Mira v3 se distingue par une interface intuitive retravaillée et des fonctionnalités avancées, permettant aux entreprises de toute taille d'identifier, évaluer et gérer les risques et remédiations liés à leur système d’information. Cette nouvelle version inclut des améliorations significatives, développées en réponse aux retours des utilisateurs, pour offrir une expérience utilisateur optimale et une productivité accrue. Pour en savoir plus sur Mira v3 et profiter d’un essai gratuit, rendez-vous sur : [intuitem.com/mira](https://intuitem.com/mira) Dans la continuité de son engagement sociétal, intuitem propose la solution Mira gratuitement aux organismes de santé, d’éducation et à but non lucratif. A propos d’intuitem : intuitem est une société française spécialisée dans le cloud, la cyber-sécurité, et la transformation numérique. Nous proposons des produits et services pour aider nos clients à mieux gérer la complexité croissante des systèmes d’information grâce à des solutions simples, durables et économiques. Visitez [intuitem.com](https://intuitem.com) pour en savoir plus. --- ## File: src/content/post/nginx-rewrite-rules.md --- draft: false title: Nginx rewrite rules - the easy way category: tutorials author: Abderrahmane Smimite publishDate: 2022-10-19T11:39:00Z image: https://images.unsplash.com/photo-1593720213428-28a5b9e94613?&fit=crop&w=430&h=240 snippet: "" tags: ["nginx", "rewrite", "redirection", "rules"] --- **U**nlike other posts or articles that I'm used to sharing, this is not about Cyber Security, Product Management, Agile practices, or data. It's just something that I've spent some time on recently, and I thought it could save someone some valuable time. Nginx (or Apache) has powerful URL rewrite capabilities that can simplify your migrations. You might want to take a look at it as it could ease it up. As part of website/web app migration, we often have to handle two main challenges: - Updating the main website URL, which primarily consists of DNS changes. As long as you're not dealing with CNAME entries on the APEX domain using a provider that doesn't support DNS flattening, you should be fine. - switching URL schemes to adapt to a new format, for instance, redirecting `/posts?id=123` to `/articles/123` A well-established web server can handle the second aspect. But before diving in, you should consider the effort versus the impact and if it is worth it for your case. Basically, it's about: - Search engine bots previously indexed paged, sending potential 404 errors and degrading your SEO effort. - Users that are used to specific patterns or bookmarks could get confused or lost with this change. If these concerns apply to your case, having Nginx as a proxy can be very handy. The official documentation available here is a good start. If you're in a hurry, here are the five main things to consider: - There are multiple directives; rewrite is the most flexible and comprehensive one. - Rules are scoped to a specific location within a specific server. You could have everything at /, but splitting can be pretty convenient. - Rewrite supports regex in its basic flavor. I usually experiment with Python or regex101 before applying anything. - Nginx processes the rules sequentially, so the order is essential. Be cautious but also use it wisely to simplify complex cases (e.g., having garbage-collector rules after specific ones) The most common patterns are: -  `/section/(.*)/product_(.*) /new/catalog/$2 ;` if the key is part of the URL and you want to redirect /section/health/product_123 to /new/catalog/123 - ` /section/directory(.*) /section/directory/$arg_user? ;` if the key is an argument and you want to redirect /section/directory?user=albert to /section/directory/albert/ ; nginx has built-in `$arg_` variables. And that's it! Fly now and rewrite the world! --- ## File: src/content/post/privacy-policy-update.md --- draft: false title: "Privacy Policy Update" author: "intuitem" category: News excerpt: sept 2023 update to cover CISO Assistant. tags: ["policy", "privacy"] publishDate: 2023-09-01T07:00:00Z image: https://images.unsplash.com/photo-1627163439134-7a8c47e08208?&fit=crop&w=430&h=240 --- ### intuitem Privacy Policy ### Last updated: Sept, 2023 This Privacy Policy describes how intuitem (the "Site", "we", "us", or "our") collects, uses, and discloses your personal information when you visit, use our services, or make a purchase from https://intuitem.com (the "Site") or otherwise communicate with us (collectively, the "Services"). For purposes of this Privacy Policy, "you" and "your" means you as the user of the Services, whether you are a customer, website visitor, or another individual whose information we have collected pursuant to this Privacy Policy. Please read this Privacy Policy carefully. By using and accessing any of the Services, you agree to the collection, use, and disclosure of your information as described in this Privacy Policy. If you do not agree to this Privacy Policy, please do not use or access any of the Services. #### Changes to This Privacy Policy We may update this Privacy Policy from time to time, including to reflect changes to our practices or for other operational, legal, or regulatory reasons. We will post the revised Privacy Policy on the Site, update the "Last updated" date and take any other steps required by applicable law. #### How We Collect and Use Your Personal Information To provide the Services, we collect and have collected over the past 12 months personal information about you from a variety of sources, as set out below. The information that we collect and use varies depending on how you interact with us. In addition to the specific uses set out below, we may use information we collect about you to communicate with you, provide the Services, comply with any applicable legal obligations, enforce any applicable terms of service, and to protect or defend the Services, our rights, and the rights of our users or others. #### What Personal Information We Collect The types of personal information we obtain about you depends on how you interact with our Site and use our Services. When we use the term "personal information", we are referring to information that identifies, relates to, describes or can be associated with you. The following sections describe the categories and specific types of personal information we collect. #### Information We Collect Directly from You Information that you directly submit to us through our Services may include: - Basic contact details including your name, address, phone number, email. - Order information including your name, billing address, payment confirmation, email address, phone number. - Account information including your username, email and password. - Customer support information including the information you choose to include in communications with us, for example, when sending a message through the Services. Some features of the Services may require you to directly provide us with certain information about yourself. You may elect not to provide this information, but doing so may prevent you from using or accessing these features. #### Information We Collect through Cookies We also automatically collect certain information about your interaction with the Services ("Usage Data"). To do this, we may use cookies, pixels and similar technologies ("Cookies"). Usage Data may include information about how you access and use our Site and your account, including device information, browser information, information about your network connection, your IP address and other information regarding your interaction with the Services. We are very sensitive to the data collected and we provide extra caution to make it stick to the bare minimum to operate our services. #### Information We Obtain from Third Parties Finally, we may obtain information about you from third parties, including from vendors and service providers who may collect information on our behalf, such as: - Our payment processors, who collect payment information (e.g., bank account, credit or debit card information, billing address) to process your payment in order to fulfill your orders and provide you with products or services you have requested, in order to perform our contract with you. - When you visit our Site, open or click on emails we send you, or interact with our Services or advertisements, we, or third parties we work with, may automatically collect certain information using online tracking technologies such as pixels, web beacons, software developer kits, third-party libraries, and cookies. Any information we obtain from third parties will be treated in accordance with this Privacy Policy. We are not responsible or liable for the accuracy of the information provided to us by third parties and are not responsible for any third party's policies or practices. For more information, see the section below, Third Party Websites and Links. #### How We Use Your Personal Information - Providing Products and Services. We use your personal information to provide you with the Services in order to perform our contract with you, including to process your payments, fulfill your orders, to send notifications to you related to you account, to create, maintain and otherwise manage your account. - Marketing. We use your personal information for marketing and promotional purposes, such as to send marketing, advertising and promotional communications by email, phone calls or text message, and to show you advertisements for products or services. This may include using your personal information to better tailor the Services and advertising on our Site and other websites. - Security and Fraud Prevention. We use your personal information to detect, investigate or take action regarding possible fraudulent, illegal or malicious activity. If you choose to use the Services and register an account, you are responsible for keeping your account credentials safe. We highly recommend that you do not share your username, password, or other access details with anyone else. If you believe your account has been compromised, please contact us immediately. - Communicating with you. We use your personal information to provide you with customer support and improve our Services. This is in our legitimate interests in order to be responsive to you, to provide effective services to you, and to maintain our business relationship with you. #### Cookies We primarily use the following cookies for the corporate site: - Cloudflare, for website analytics - Hubspot, for mail campaign tracking Our products may use cookies for session management and other technical needs. Most browsers automatically accept Cookies by default, but you can choose to set your browser to remove or reject Cookies through your browser controls. Please keep in mind that removing or blocking Cookies can negatively impact your user experience and may cause some of the Services, including certain features and general functionality, to work incorrectly or no longer be available. Additionally, blocking Cookies may not completely prevent how we share information with third parties such as our advertising partners. #### Third Party Websites and Links Our Site may provide links to websites or other online platforms operated by third parties. If you follow links to sites not affiliated or controlled by us, you should review their privacy and security policies and other terms and conditions. We do not guarantee and are not responsible for the privacy or security of such sites, including the accuracy, completeness, or reliability of information found on these sites. Information you provide on public or semi-public venues, including information you share on third-party social networking platforms may also be viewable by other users of the Services and/or users of those third-party platforms without limitation as to its use by us or by a third party. Our inclusion of such links does not, by itself, imply any endorsement of the content on such platforms or of their owners or operators, except as disclosed on the Services. #### Children's Data The Services are not intended to be used by children, and we do not knowingly collect any personal information about children. If you are the parent or guardian of a child who has provided us with their personal information, you may contact us using the contact details set out below to request that it be deleted. As of the Effective Date of this Privacy Policy, we do not have actual knowledge that we "share" or "sell" (as those terms are defined in applicable law) personal information of individuals under 16 years of age. #### Security and Retention of Your Information Please be aware that no security measures are perfect or impenetrable, and we cannot guarantee "perfect security." In addition, any information you send to us may not be secure while in transit. We recommend that you do not use unsecure channels to communicate sensitive or confidential information to us. How long we retain your personal information depends on different factors, such as whether we need the information to maintain your account, to provide the Services, comply with legal obligations, resolve disputes or enforce other applicable contracts and policies. #### Your Rights and Choices Depending on where you live, you may have some or all of the rights listed below in relation to your personal information. However, these rights are not absolute, may apply only in certain circumstances and, in certain cases, we may decline your request as permitted by law. - Right to Access / Know. You may have a right to request access to personal information that we hold about you, including details relating to the ways in which we use and share your information. - Right to Delete. You may have a right to request that we delete personal information we maintain about you. - Right to Correct. You may have a right to request that we correct inaccurate personal information we maintain about you. - Right of Portability. You may have a right to receive a copy of the personal information we hold about you and to request that we transfer it to a third party, in certain circumstances and with certain exceptions. - Right to Limit and/or Opt out of Use and Disclosure of Sensitive Personal Information. You may have a right to direct us to limit our use and/or disclosure of sensitive personal information to only what is necessary to perform the Services or provide the goods reasonably expected by an average individual. - Restriction of Processing: You may have the right to ask us to stop or restrict our processing of personal information. - Withdrawal of Consent: Where we rely on consent to process your personal information, you may have the right to withdraw this consent. - Appeal: You may have a right to appeal our decision if we decline to process your request. You can do so by replying directly to our denial. - Managing Communication Preferences: We may send you promotional emails, and you may opt out of receiving these at any time by using the unsubscribe option displayed in our emails to you. If you opt out, we may still send you non-promotional emails, such as those about your account or orders that you have made. You may exercise any of these rights where indicated on our Site or by contacting us using the contact details provided below. We will not discriminate against you for exercising any of these rights. We may need to collect information from you to verify your identity, such as your email address or account information, before providing a substantive response to the request. In accordance with applicable laws, You may designate an authorized agent to make requests on your behalf to exercise your rights. Before accepting such a request from an agent, we will require that the agent provide proof you have authorized them to act on your behalf, and we may need you to verify your identity directly with us. We will respond to your request in a timely manner as required under applicable law. #### Complaints If you have complaints about how we process your personal information, please contact us using the contact details provided below. If you are not satisfied with our response to your complaint, depending on where you live you may have the right to appeal our decision by contacting us using the contact details set out below, or lodge your complaint with your local data protection authority. #### International Users Please note that we may transfer, store and process your personal information outside the country you live in, including the United States. Your personal information is also processed by staff and third party service providers and partners in these countries. If we transfer your personal information out of Europe, we will rely on recognized transfer mechanisms like the European Commission's Standard Contractual Clauses, or any equivalent contracts issued by the relevant competent authority of the UK, as relevant, unless the data transfer is to a country that has been determined to provide an adequate level of protection. #### Contact Should you have any questions about our privacy practices or this Privacy Policy, or if you would like to exercise any of the rights available to you, please use the contact form or email us at contact@intuitem.com or contact us at 8 rue des frères caudron, Vélizy, 78140, France. --- ## File: src/content/post/review-managing-cyber-risk-ariel-evans.md --- draft: false title: Review of Managing cyber risk, by Ariel Evans category: reviews author: Eric Laubacher publishDate: 2023-09-04T09:54:00Z image: https://images.routledge.com/common/jackets/amazon/978036717/9780367177744.jpg excerpt: "Ariel Evans is a senior cybersecurity expert, serial entrepreneur, and author. She is Chairperson of Pace Seidenberg Cybersecurity Program. The book has been published by Routledge. It can be downloaded for free on Researchgate." tags: ["cybersecurity", "risk", "management"] --- ## Preface In the preface, the author states that ROLF (reputational, operational, legal and financial) analysis is the primary methodology for risk management. Surprisingly, this acronym is very scarcely used, and generally only in reference to Ariel Evans' book. Another surprise is the criticism of FAIR: >Most of today's cyber risk models, like Factor Analysis of Information Risk (FAIR), use only control maturities, which provide very limited and superficial metrics. Yet, The FAIR model can address quite naturally the reputational, operational, legal and financial aspects, and does not rely only on control maturities. We will consider FAIR in another article. ## Introduction > Managing cyber risk is a new science. This promising introductory sentence implies that while not yet mature, cyber risk management is a scientific approach. Evans asserts that cyber risk management is now recognized as an enterprise risk and not an IT risk, which is very sound. Cyber risk is defined in this way: > It is the risk at the digital asset level - system, process, technology, and data that can have reputational, organizational, legal, and/or financial impacts. Then Evans introduces two measures for cyber risk: the inherent risk >"the risk without controls in place, as if there were zero percent effectiveness of cyber controls. This is raw risk, or what I call cybergeddon risk". the residual risk, the risk with controls in place. > Inherent risk is considered the proper way to determine which assets are the most important to protect, and to calculate cyber insurance needs. Residual risk is considered as the proper way to calculate cyber costs for budgeting and to prioritize remediation work. This definition of inherent risk falls into the classical debate over the concept of having "no controls" (refer to https://www.fairinstitute.org/blog/inherent-risk-vs.-residual-risk-explained-in-90-seconds for more). The scenario of having absolutely no controls in place mirrors the unfortunate outcome experienced by E Corp in the first season of Mr. Robot. Evans introduces the appealing notion that inherent risk is beneficial to determine insurance needs but, regrettably, doesn't explain how to precisely calculate it. ## 1. Cyber risk at the speed of data The first chapter begins with a brief presentation of the history of cybersecurity, and the rise of the cost of breach. It develops the idea that "cyber is a business issue" with convincing arguments. It also provides simple guidelines for the establishment of an effective cyber risk management strategy. Cyber risk quantification provides for the following use cases: - focus on and monitoring of crown jewel assets - proper prioritization of remediation resources based on impacts - proper cyber budgeting, aka putting your money where your mouth is - measuring the effectiveness of cyber tools, aka what are we paying for? - adequately measuring cyber insurance needs, aka cyber risk transference For insurance needs, Evans says that requirements should be based on worst-case scenario analysis. While this seems common sense, it is not exactly realistic given companies' current dependence on their IT. The theoretical worst case scenario would almost certainly lead to the company going out of business, as already illustrated. ## 2. Dissecting cyber risk Evans provides this definition of cyber risk: > Cyber risk means the exposure to the possibility of loss from a cyberattack or incident. Impacts follow the ROLF model (reputational, operational, legal and financial). Financial loss can result from business process interruption, data exfiltration or regulatory fines. The book then presents the cyber risk owners: boards of directors, CISO, DPO, compliance manager, auditors and legal teams. Assets are typically classified as crown jewel, business critical, business crucial. A crown jewel is a system whose failure results in the company going out of business. A business critical system is a system whose failure may result in very high costs for the business. A business-crucial system is a system whose failure has significant impact. Evans says the financial risk is the only metric that has objective measurability, an idea that is shared by FAIR methodology. The book develops the following additional types of cyber risks, which all can amplify financial risk: - reputational risks - operational risks - regulatory risks - vendor (or third-party) risks ## 3. Inherent cyber risk In this chapter, the inherent cyber risk is linked to cyber risk quantification. The case for business interruption costs is relatively straightforward. For data exfiltration costs, Evans proposes to multiply the number of leaked records by the average cost of breach per record determined by the Ponemon institute in the 2017 Cost of Data Breach study, which is $141. This type of gross approximation using an average value is not convincing, it seems much preferable to determine the value of records by estimating the consequences of a leak. Concerning regulatory costs, Evans lists several regulations, and give a quantitative example. What is striking is that the GDPR potential fine of 4% of revenue outweighs largely all other factors. In the given example, it represents 72% of the total estimated cost. Evans also proposes a qualitative analysis for inherent cyber risk as likelihood x impact. CMMI is proposed as an example of scoring system, with a value from 1 (optimized) to 5 (initial). Two questionnaires shall be prepared, one for impact, the other for likelihood. Each question is assigned a weight (based on the understanding of its importance for the organization), and scores are aggregated. Unanswered questions are not included in the aggregated score. Examples of questions are provided. Likelihood is "the probability an attack will cause damage". Evans says that likelihood can be equated to the cybersecurity triad of confidentiality, integrity and accessibility, which is a very unclear statement. As for impact, several factors and corresponding examples of questions are given. The metric is again from 1 to 5 (0 for unanswered). Then qualitative risk analysis is presented in the form of a traditional matrix combining impact score and likelihood score. An interesting approach is that there are 3 different matrices, one for crown jewels, one for business-critical and one for business crucial. The matrices contain the priority level from 1 (highest priority) to 5 (lowest priority). The risk level is defined from 0-1 (low) to 4-5 (critical), but no rule is given on how to calculate it, which is unfortunate. Evans highlights that the qualitative and quantitative analyses can diverge, and that this means it is necessary to "tweak the model", with usually two-three rounds of revision. ## 4. Residual cyber risk The following definition is given: > Residual risk = inherent risk score - (score of findings + vulnerabilities + incidents) Once residual risk score is calculated, it shall be compared to a threshold value depending on the type of asset (crown jewel, critical, crucial). If the threshold is over, then some remediations are required. Cyber control frameworks are a set of standards used for cyber control assessments. They contain requirements with a policy component, a test component and a result component. The results of the tests are called findings. Several frameworks in common use in the US are presented: PCI-DSS, ISO 27001, CIS Critical Security Controls, and NIST CSF. The finding can be expressed as a percentage, 100% being the best score. A possible method for deriving the residual risk score from the inherent risk and the assessment finding is illustrated in an example (table 4.2), but unfortunately the formula is not given. We can infer it is: RR = IR x (1 - findings). Similarly, an example is provided for vulnerability correction (table 4.3), without the formula being explicit. We can infer the following formula: RR = IR x (1 - findings) x (1 + vulnerability). The table 4.4 adds the incident parameter, and ignoring a typo (0,295 instead of 0,0295) and a confusion (incident instead of vulnerability), we infer the following formula: RR = IR x (1 - findings) x (1 + incident). For cost analysis, Evans presents cyber budgeting, and defines: > return on control = (reduction in risk / Cost of the control) x 100. ## 5. Vendor cyber risk The majority of reported breaches are due to third parties, so this chapter presents an approach for third-party risk measurement. It is similar to the previous chapters, with questionnaires to assess impact and likelihood of the risk. ## 6. Future cyber risk This chapter provides some glimpses on the cyber risk linked to IoT, blockchain, AI and quantum computing. ## 7. Cyber risk management toolkit Evans defines 5 levels of cyber security maturity: unaware, tactical, focused, strategic and pervasive. The toolkit program comprises the following items: - organization oversight and leadership program - cyber risk program - cyber policies - assessment, audit, and monitoring programs - resources - risk prioritization - cyber budgeting - incident management plans - education - cybersecurity awareness - cyber insurance - vendor management ## 8. Optimizing cyber risk resiliency Resiliency is defined as goal score divided by the residual risk score. This chapter provides some recommendations to determine correct amount of cyber insurance. It also recommends continuous cyber risk management program, and evokes the case of cyber risk metrics for M&A. The book finishes with a conclusion, abbreviations, and an index. ## Does "Managing cyber risk" provides a scientific approach for risk analysis? While the book contains sound advice, and provides a quantitative and a qualitative method for risk analysis, this method lacks several qualities to be deemed scientific. In particular: - the definitions of the concepts are vague. - the formulas for the method are not clearly defined and justified. The proposed method can be a good starting point for someone discovering cyber security and risk analysis. But as we close the book, we're left hungry for a scientific approach to risk analysis. *In addition to its product activity, intuitem has a consultancy service dedicated to helping companies build optimal cyber security programs that fit their needs instead of pre-packaged ones. You are welcome to reach out to learn more about our services.* --- ## File: src/content/post/software-factory-security.md --- draft: false title: Back to basics - Software Factory security category: articles author: Abderrahmane Smimite publishDate: 2021-07-13T11:39:00Z image: https://images.unsplash.com/photo-1627163439134-7a8c47e08208?&fit=crop&w=430&h=240 snippet: "" tags: ["software", "security", "devsecops", "secdevops"] --- If you have not caught up with the trend of shifting security to the left in software development, you have probably heard of something equivalent: the DevSecOps or SecDevOps practices. It consists of doing as much as possible the security operations (scans, checks, etc.) at the earliest possible stages, and not wait until the end to go through « a validation process ». This is more practical, cost-efficient, scalable, and the most agile-friendly. In this article, we will go through the basic aspects that one should consider for software-factory security. You could, of course, extend it to include more topics, and you probably should. We are just highlighting the most common ones that we had to cover across our interaction with the customers on a variety of domains. In the following, I will only mention free software or one with a community edition. There is of course a lot of nice paid alternatives out there, sometimes even shipped with the CI/CD solution (the case of GitLab enterprise for instance), and it is up to you to choose what suits you better. ## Code security analysis: SAST SAST stands for Static Application Security Testing. This practice consists of detecting anti-patterns that could eventually lead to security issues. Such tools operate at the code level in the same manner as a linter will review your code for typing, formatting, or any compliance rules that we could establish for a coding style standard. Here are some good practices: - Perform SAST scans regularly, either periodically or at the build stage - Most tools have some form of exceptions management, that could be used to skip false positives, for instance using some specific tags like #nosec. Use that wisely and do not abuse it - When possible, establish a security gate, by using the output of the SAST tool to block the upcoming steps of your pipeline Some tools to consider: Snyk, SonarQube, Bandit for Python ## Dependencies management Unless you are reinventing the wheel for every component that you are developing, you are probably using and importing a few external libraries and modules. If it is the case, it is your responsibility to manage these third-party components by: - Importing them using the proper patterns according to your stack (e.g. requirements.txt). Don't copy the library's code unless you are forking a project. Using the standard patterns will allow you to easily use the existing tools for checkups - Using the latest version of dependencies could sound appealing to avoid handling the patch management. For obvious operational reasons such as your build reproducibility, you will need to manage some form of version pinning - Doing regular proper checks on your imports. Many tools are available out there that can be included as well on the pipeline to block the build if needed - Exclusively relying on an allow-list, with only validated and regularly reviewed dependencies (a more extreme yet tight approach) Busting a myth: « Open-source software cannot be vulnerable or malicious because the supporting community or company will prevent that ». While this could be the case for some active projects, you cannot just assume that, as they could have failed some security checks as well (code, dependencies, etc.). You should at least consider checking if the library has some known CVE or issues. Some tools to consider: npm audit, Safety for python, Dependabot, snyk ## Secrets management Most deployments need a set of credentials at some point. Whether to interact with a database, object storage, or a third-party API, the tokens or passwords need to be securely managed. This is a very common topic in Cybersecurity, and we will detail the proper patterns in a dedicated article. Here are some insights that you need to consider: - Use a proper password management system. The most known one is probably Hashicorp Vault. If you are using AWS or Azure, you can use their equivalent native services as well. Modern solutions have all the options that you might need, ranging from secrets generation to API interaction. - Never commit a secret to your codebase. If it is the case, your first reflex should be to revoke the credential and then, ideally, rework your git history if it is not too late - Perform regular checks to identify if there have been any leaks - If your development environment is unified amongst the team, you can even consider preventing committing the secrets (based on git hooks for instance). Some IDEs support plugins for that as well Some tools to consider: - Keys management: Hashicorp Vault, KeePass - Leaks detection: Trufflehog, Git guardian, Github secret check ## Compute vulnerability management Once your app is ready for deployment, it will require some form of compute service to run it: bare metal, VM, container-based, serverless, etc. Compute security is the foundation of any application security, and is either managed directly by you or delegated to a provider, as part of a Shared Responsibility Model. The process is basically about monitoring and applying the security patches of your OS components, as well as the associated libraries and dependencies. The patch management strategy will depend naturally on the compute technology and at which level the fix needs to be applied. For the most common case of VM or containers, it is basically about rebuilding and deploying your images. If you have opted for a serverless approach, it is most likely that the provider handles that on your behalf without any downtime to manage. You need to consider the following: - Detection is mandatory: you need to be able to identify the vulnerabilities and keep track of them - The lower you go at the infrastructure level, the more you need to handle patch management. Use managed services (PaaS or higher) as much as possible, to delegate that to the provider Some tools to consider: OpenVAS, Clair or Trivy for containers ## Runtime check: DAST Now that your app is deployed, you need to check it for security issues while it is running. To achieve that, we need a DAST tool, which stands for Dynamic Application Security Testing. Keep in mind that it is complementary to the SAST check explained above. A DAST tool operates as a lightweight pentest. It performs the usual checks for security vulnerabilities on runtime while considering your application as a black box and attacking it: port scan, SQL injection, cipher checks, banners detection to run specific exploits and even fuzzing. You should consider the following: - Tune and adapt the scan to your application to get relevant data. Modern DAST tools support multiple options: authenticated scan, API support, combination with functional testing such as a Postman collection, or even load testing - Run regular DAST scan on your production app, or at least on an accurate replicate with the same settings - Ideally, if you can tolerate some extra delay on your pipeline, perform the scan on your staging environment so that you can eventually block the deployment if issues are found Some tools to consider: OWASP ZAP, Nikto ## Core CI/CD security It goes without saying, but your software factory security will depend on your CI/CD tooling security. The hardening practices will vary according to your stack. Assuming that you are using Jenkins for instance, you should consider the following: - Review and maintain the underlying compute security, always :) - Federate your Jenkins access control with your existing authentication system (eg. Active directory) and fine-tune the roles - Review the credential store security since it will probably host your initial secret, the one that allows you to connect to a vault for instance. Some common practices are to ensure that the underlying storage is encrypted, the ssh access protected, etc. - Use a dedicated account to interact with the code base, vault, etc., ideally in read-only mode ## Combining everything Now that you have the big picture, we can summarize as follows: - Review your pipeline tooling security and do the proper hardening - Use a proper solution for secrets management - Prevent secrets committing and look for leaks - Perform SAST check on your codebase - Properly control your dependencies and regularly recheck them for vulnerabilities - Perform DAST check on your staging environment and prevent the deployment if it doesn't match a security gate - Ensure that the compute patch management is properly done, either by you or delegated to your managed services provider ## Final thoughts The main takeaway of this approach is that the earlier you fix it, the less it will cost you. It goes for vulnerabilities as well as for any other bug. You will end up having multiple warnings and many false positives: do not be discouraged by that, since it is part of the process. Progressively, you will be able to add nice and smart filters on all these findings and establish a priority system. A simple one will be probably based on the severity of the finding, the CVSS score, etc. If you choose to go with a more advanced solution, some can even give you an estimation of the effort to fix it. Just remember to measure and keep track of your progress. Do not rely entirely on automated tools, and support them with an awareness program, so that your team can make sense of all these practices and adopt them. --- ## File: src/content/post/we-are-going-open-source.md --- draft: false title: "We are Going Open Source" category: "News" author: Abderrahmane Smimite publishDate: 2023-09-20T19:25:00Z image: https://images.unsplash.com/photo-1569017388730-020b5f80a004?ixlib=rb-4.0.3&ixid=M3wxMjA3fDB8MHxwaG90by1wYWdlfHx8fGVufDB8fHx8fA%3D%3D&auto=format&fit=crop&w=430&q=80 excerpt: "Five common mistakes that executives keep repeating about cyber security and some actionable insights on how to deal with them" tags: ["cybersecurity", "ciso-assistant", "open source", "community", "GRC"] --- Hello to our valued customers, partners, and the cybersecurity community, We are thrilled to announce something that has been in the works for quite some time now. We've always believed in making cyber risk management and GRC (Governance, Risk, and Compliance) more accessible, transparent, simple, and effective for everyone. Today, we're taking a significant step in that direction by making our flagship products, Mira and CISO Assistant, available as open-source software through a Community Edition. ## Why Open Source? **Community Collaboration:** The challenges of cybersecurity are ever-evolving. Going open-source allows us to collaborate with a vast community of developers, industry experts, and end-users. Together, we can better shape and evolve the GRC tools landscape. **Transparency:** In a domain like cybersecurity, trust is paramount. By opening up our source code, we're offering complete transparency, so you know exactly what you're implementing in your systems and how sensitive data are being processed. **Accessibility:** Our mission has always been democratizing cyber risk management and GRC tools. With free-to-use Community Editions, smaller businesses can also implement best-in-class cybersecurity measures and benefit from the community expertise. ## What’s Included in the Community Edition? Mira and CISO assistant core features are open-source and free to use. All future general usage features will be as well. Visit the website to learn more about their capabilities. Community editions will benefit from both community support as well as the regular maintenance and bug fixes that we will keep doing on the internal branches. There is no change on the enterprise edition, where customers can request custom features that we’ll maintain as the product grows. Custom-made features will not be part of the community edition unless agreed on with the customer. Enterprise edition benefits from direct and priority support, as well as advanced assistance for setup, integration, and team coaching. ## How to Get Started? This is the easy part. Just head over to our GitHub repositories, clone them, and follow the instructions on the readme files. - Mira Repo is here: [https://github.com/intuitem/mira-community] - CISO Assistant repo is here: [https://github.com/intuitem/ciso-assistant-community] ## Don’t want the setup? We have a free 30-day trial, and no credit card is required. Head out to [https://intuitem.com/fr/trial/]. We automatically create isolated demo infrastructure even for the trial to keep your data private and secure. You’ll get a notification email once it’s up. ## Need more? Reach out to our team on [https://intuitem.com/fr/contact/] for the enterprise plan with extra features, customization, and priority support. ## A Big Thank You! We want to extend our heartfelt gratitude to everyone who has supported us thus far. We're excited to see where this new chapter takes us, and we can't wait for you to be a part of it. Best regards, intuitem Team