{"id":779,"date":"2022-09-13T06:43:06","date_gmt":"2022-09-13T05:43:06","guid":{"rendered":"https:\/\/metrics.blogg.gu.se\/?p=779"},"modified":"2022-09-07T06:50:17","modified_gmt":"2022-09-07T05:50:17","slug":"so-you-want-to-automate-your-security-assessment-beyond-pentesting","status":"publish","type":"post","link":"https:\/\/metrics.blogg.gu.se\/?p=779","title":{"rendered":"So, you want to automate your security assessment (beyond pentesting)&#8230;"},"content":{"rendered":"\n<figure class=\"wp-block-image\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"745\" src=\"https:\/\/metrics.blogg.gu.se\/files\/2022\/09\/cyber-security-1784985-1024x745.png\" alt=\"\" class=\"wp-image-780\" srcset=\"https:\/\/metrics.blogg.gu.se\/files\/2022\/09\/cyber-security-1784985-1024x745.png 1024w, https:\/\/metrics.blogg.gu.se\/files\/2022\/09\/cyber-security-1784985-300x218.png 300w, https:\/\/metrics.blogg.gu.se\/files\/2022\/09\/cyber-security-1784985-768x558.png 768w, https:\/\/metrics.blogg.gu.se\/files\/2022\/09\/cyber-security-1784985-1200x873.png 1200w, https:\/\/metrics.blogg.gu.se\/files\/2022\/09\/cyber-security-1784985-1320x960.png 1320w, https:\/\/metrics.blogg.gu.se\/files\/2022\/09\/cyber-security-1784985.png 1920w\" sizes=\"(max-width: 709px) 85vw, (max-width: 909px) 67vw, (max-width: 1362px) 62vw, 840px\" \/><figcaption>BIld av <a href=\"https:\/\/pixabay.com\/sv\/users\/madartzgraphics-3575871\/?utm_source=link-attribution&amp;utm_medium=referral&amp;utm_campaign=image&amp;utm_content=1784985\">Darwin Laganzon<\/a> fr\u00e5n <a href=\"https:\/\/pixabay.com\/sv\/\/?utm_source=link-attribution&amp;utm_medium=referral&amp;utm_campaign=image&amp;utm_content=1784985\">Pixabay<\/a><\/figcaption><\/figure>\n\n\n\n<p><a href=\"https:\/\/arxiv.org\/pdf\/2208.03837.pdf\">Automatic Security Assessment of GitHub Actions Workflows (arxiv.org)<\/a><\/p>\n\n\n\n<p class=\"has-drop-cap\">After my last post, and the visit to the workshop at MDU, I realized that there are a few tools that can be used automatically already now. So, this paper presents one of them. <\/p>\n\n\n\n<p>What is interesting about this tool is that it uses github workflows, so it&#8217;s compatible with many modern CI\/CD pipelines. The tool analyzes worflows and looks for security vulnerabilities. For example, if you keep sensitive information in a plain text file that is used in the workflow (secrets), or checks if the workflow enforces the &#8220;least privilege&#8221; principle. <\/p>\n\n\n\n<p>The implementation of the tool is OSS; can be found on github here:  <a href=\"https:\/\/github.com\/Mobile-IoT-Security-Lab\/GHAST\">Mobile-IoT-Security-Lab\/GHAST: GitHub Actions Security Tester<\/a>  <\/p>\n\n\n\n<p>I need to test it as it looks very interesting. Maybe I can use this tool on some of the company&#8217;s workflows to test their exploitability score? <\/p>\n","protected":false},"excerpt":{"rendered":"<p>Automatic Security Assessment of GitHub Actions Workflows (arxiv.org) After my last post, and the visit to the workshop at MDU, I realized that there are a few tools that can be used automatically already now. So, this paper presents one of them. What is interesting about this tool is that it uses github workflows, so &hellip; <a href=\"https:\/\/metrics.blogg.gu.se\/?p=779\" class=\"more-link\">Continue reading<span class=\"screen-reader-text\"> &#8220;So, you want to automate your security assessment (beyond pentesting)&#8230;&#8221;<\/span><\/a><\/p>\n","protected":false},"author":68,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6,9,5],"tags":[],"_links":{"self":[{"href":"https:\/\/metrics.blogg.gu.se\/index.php?rest_route=\/wp\/v2\/posts\/779"}],"collection":[{"href":"https:\/\/metrics.blogg.gu.se\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/metrics.blogg.gu.se\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/metrics.blogg.gu.se\/index.php?rest_route=\/wp\/v2\/users\/68"}],"replies":[{"embeddable":true,"href":"https:\/\/metrics.blogg.gu.se\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=779"}],"version-history":[{"count":1,"href":"https:\/\/metrics.blogg.gu.se\/index.php?rest_route=\/wp\/v2\/posts\/779\/revisions"}],"predecessor-version":[{"id":781,"href":"https:\/\/metrics.blogg.gu.se\/index.php?rest_route=\/wp\/v2\/posts\/779\/revisions\/781"}],"wp:attachment":[{"href":"https:\/\/metrics.blogg.gu.se\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=779"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/metrics.blogg.gu.se\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=779"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/metrics.blogg.gu.se\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=779"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}