Article 32 lays out a few legally binding requirements for handling customer data in a secure manner, many of which have long been considered best practice. If you are not yet familiar with Article 32, or you are in the process of achieving GDPR compliance read this article which breaks down some of the most important aspects of Article 32.
Fleetsmith just launched new security features: remote lock and wipe of employees' devices and kernel extension whitelisting. You can also escrow each Mac's FileVault recovery key, and enforce a company policy for password and screen saver settings. I use Fleetsmith every day, much recommended :)
I usually don't like to group items too much, because it cheats the "don't put too many items in one issue" rule I have. But there was just a lot of related news this week to group. So, sorry ^^ There's a few regular items in here too though.
The vulnerability can be triggered by cloning a submodule from a malicious parent repository. Both clients and server-side need updates.
I meant to include some of these last week, on the 25th (because duh), but pressed submit too early :-/ So here we go:
Data being stolen, leaked or just managed irresponsibly:
JScript is Windows' custom Javascript implementation. All that is needed is to visit a malicious site, however one still would have to break out of sandbox mode. Details are left out until a fix is available.
It's been a source of too many security problems. They'll provide a plugin system for when you explicitly need it.
Updates I came across:
Going black hat doesn't (always) pay off:
Very cool blogpost walking the reader through an example forensic test against a compromised Linux server.