Security Boulevard

Introduction

In this blog post, we will cover the basics of a source generator, the major types involved, some common issues you might encounter, how to properly log those issues, and how to fix them.

Source Generators have existed since .NET 5 was first introduced in late 2020. They have seen numerous improvements since that initial release, including the creation of newer Incremental Source Generators.

TLDR: Source generators in .NET enable you to inspect user code and generate additional code on the fly based on that analysis. The example in this blog post may seem a bit redundant, but as you use more advanced patterns, you can generate hundreds of lines of code, helping to reduce boilerplate and repetitive code across your projects. Source generators are also great for lowering runtime reflection use, which can be expensive and slow down your applications.

Skip to the real content.

While developing a C# library to perform messaging between various process components or between processes, I encountered an issue where client programs using this new messaging library would need to add a list of all the “Messenger types.” I had heard of source generators and experimented with them a small amount before encountering this problem, so I figured I could dive in and devise a working solution to handle this and inject the list of “Messenger types” as a property automagically.

I have also been learning various programming paradigms and interesting practices. Vertical Slice architecture and aspect-oriented programming (AOP) are the two relevant to this blog. Vertical slices focus on grouping things that will change together, typically by the feature they represent, regardless of the layer they belong to. The goal of the slices is to minimize coupling between slices and maximize coupling in a slice (i.e., things in a feature depend on each other while trying not to rely on other slice features). This keeps the code base modular and makes it easy to update, remove, or add new slices, as the changes shouldn’t directly affect existing slices. [You can read more on vertical slices here]

AOP is a programming paradigm that aims to increase modularity by allowing the separation of cross-cutting concerns. Typically, in C#, this is implemented by creating attributes that are then placed on classes, methods, etc., to introduce or modify the decorated code. So, with these things in mind, I wanted to look at creating a feature that worked with vertical slices using AOP, and given my newfound challenge of automatically injecting a list of objects into my messenger app at build time, I had just the target goal in mind to combine all of it together.

With that brief overview of why I started messing with source generators, let’s take a quick step back and cover the basics of what a source generator is, what it lets you do, and what it doesn’t.

What is a Source Generator?

According to Microsoft: “Source generators aim to enable compile-time metaprogramming, that is, code that can be created at compile time and added to the compilation. Source generators will be able to read the contents of the compilation before running, as well as access any additional files, enabling generators to introspect both user C# code and generator-specific files. Generators create a pipeline, starting from base input sources and mapping them to the output they wish to produce. The more exposed, properly equatable states exist, the earlier the compiler will be able to cut off changes and reuse the same output.”

Figure 1 — Source Generator dataflow, Microsoft

Simply put, source generators in .NET are library projects that you can add to a solution or include in existing NuGet packages. They are meant to be utilized only during the build process to add new code to a project.

[Read more about common source generator use cases here].

What Are Source Generators Not Meant to Do

Microsoft calls out two main concepts as areas where generators are not meant to be used. The first area is adding language features. Microsoft states: “Source generators are not designed to replace new language features: for instance, one could imagine records being implemented as a source generator that converts the specified syntax to a compilable C# representation. We explicitly consider this to be an anti-pattern; the language will continue to evolve and add new features, and we don’t expect source generators to be a way to enable this. Doing so would create new ‘dialects’ of C# that are incompatible with the compiler without generators.”

In this regard, I agree with the team that allowing any .NET developer to start adding new features to the language opens up the possibility of competing features, confusing requirements, and incompatibility with the .NET compiler; which will only serve to confuse and push developers away from source generators altogether.

The second is in code modification; the Microsoft documentation also states, “There are many post-processing tasks that users perform on their assemblies today, which here we define broadly as ‘code rewriting’. These include, but are not limited to:

• Optimization
• Logging injection
• IL Weaving
• Call site re-writing

While these techniques have many valuable use cases, they do not fit into the idea of source generation. They are, by definition, code altering operations which are explicitly ruled out by the source generator’s proposal.”

While technically accurate, this feels more like a semantic line in the sand for the team not wanting a “generator” to perform replacement and not a language-breaking functionality to have access to. With that said, I will show a workaround for code rewriting that I’ve used recently if that is part of your goal for using a source generator.

A source generator is also not an Analyzer. While often used together and sharing many of the exact same requirements to utilize one in a project, a generator’s job is to produce code and an analyzer’s job is to produce warnings or errors based on various rules such as code formatting or, as we will see in source generators, to block access to specific functions/code bases that the analyzer’s author deemed unwelcome.

The Primary Type of Source Generator in Modern .NET

At the time of writing this (September 2024), the .NET team has decided to deprecate source generators implementing “ISourceGenerator” in favor of incremental generators. This change will be enforced, seemingly blocking access to older “ISourceGenerator” APIs with versions of the Roslyn API after version 4.10.0 / .NET 9. (Old Generator Deprecated). In light of that, this blog post series will only cover “IncrementalGenerator” usage.

What Is an Incremental Source Generator?

An incremental generator is a source generator that performs its evaluation and execution on items only after they pass some filtering requirements, significantly increasing performance.

Typically, source generators try to execute during design time and compile time. While nice, this incurs an execution of any classes marked as a source generator every time something changes in the project (i.e., delete a line of code, add a line of code, make a new file, etc.). As you can imagine, having something running every time you type is not ideal for performance; thus, Microsoft created these incremental generators to help solve that performance problem.

Adding an Incremental Source Generator to Your Project

Source generators must target .NET standard 2.0. This allows them to be used in .NET framework 4.6+ or .NET core 5+ projects or other .NET standard 2.0+ projects. By the end of this section, we will have a solution containing three projects.

• A .NET standard 2.0 library (Source Generator)
• A .NET standard 2.0 library (A shared library for the generator and consumers)
• A .NET 8 web API project (Main project)

You can use the dotnet command in a terminal or your IDE of choice to create these projects. I will use the dotnet tool since it is IDE/platform agnostic. The following commands will produce the required projects.

1. dotnet new sln -n IncrementalSourceGenPractice
2. dotnet new webapi -n WebProject — project .\IncrementalSourceGenPractice.sln
3. dotnet new classlib -f netstandard2.0 — langVersion 12 -n SourceGenerator — project .\IncrementalSourceGenPractice.sln
4. dotnet new classlib -f netstandard2.0 — langVersion 12 -n SourceGenerator.SharedLibrary — project .\IncrementalSourceGenPractice.sln
5. dotnet sln .\IncrementalSourceGenPractice.sln add .\SourceGenerator.SharedLibrary\SourceGenerator.SharedLibrary.csproj .\SourceGenerator\SourceGenerator.csproj .\WebProject\WebProject.csproj

Before creating the source generator, adding a few Nuget packages and changes to the .csproj files are required. Open the SourceGenerator.csproj file and ensure it matches the following content.

https://medium.com/media/dd367dc0ae1158c23a5b82cf17ba07f5/href

The version numbers of the package references will likely be different, which is fine as long as they are valid for the .NET standard 2.0 target.

The three configuration settings added are the following

1. <EnforceExtendedAnalyzerRules>true</EnforceExtendedAnalyzerRules>

• Ensures the generator is using the recommended rules created by the .NET team

2. <IsRoslynComponent>true</IsRoslynComponent>

• Enables the project to act as a generator and work with the Roslyn compiler, making debugging of the generator possible

3. <IncludeBuildOutput>false</IncludeBuildOutput>

• This prevents the project build from being included in output, which is ideal since the generator is meant to be compile-time only

The other odd configuration in this .csproj file is the OutputItemType=”Analyzer” added to the project reference for the shared library. Even though the shared library is not an analyzer, this is required so the generator can access it during generation.

The final bit of configuration required is for the webproject.csproj file.

Add the following lines to the project.

<EmitCompilerGeneratedFiles>true</EmitCompilerGeneratedFiles>
<CompilerGeneratedFilesOutputPath>.\GeneratedFiles</CompilerGeneratedFilesOutputPath>

• These two options allow the source generator files to be written to the filesystem and set a custom path to write them to vs. using the default path.

Lastly, add the following item group also to the webproject.csproj file.

<ItemGroup>
<ProjectReference Include="..\SourceGenerator.SharedLibrary\SourceGenerator.SharedLibrary.csproj" />
<ProjectReference Include="..\SourceGenerator\SourceGenerator.csproj" ReferenceOutputAssembly="false" OutputItemType="Analyzer" />
</ItemGroup>

• When referencing the source generator, we do not need the output assembly again because it is not required after compile time.

Adding a Relevant Target for Generation

In this first part, we will generate something relatively simple; however, later posts go deeper into using source generators and we will create a small AOP framework to achieve the goal outlined at the start of this blog.

Open the WebProject and add a new class called Calculator.cs with the following source.

https://medium.com/media/30ebc82f45a40769bd16d812efb22e7a/href

We will then generate functions for this class to add, subtract, multiply, and divide. We must mark the class as partial to stick with the intended functionality of only adding content to existing classes. This indicates that more of the class’s source code may be in a different file.

Starting on the Incremental Source Generator

Congratulations; we finally made it through the required setup.

Finally, with that configuration done, we can start writing the source generator. In the SourceGenerator project, add a class named CalculatorGenerator with the following content.

https://medium.com/media/10d010241aa9280c31d8b38892d66486/href

This gives the bare-bones starting point. To be a valid Incremental source generator, the class must inherit from `IIncrementalGenerator` and be decorated with the [Generator] attribute. The interface requires our generator to implement only the’ Initialize’ function.

The Providers

The IncrementalGeneratorInitializationContext argument it provides in the Initialize method will give access to the underlying source.

The context object does this via several different “providers.”

Different Provides for Accessing Various Contexts

• CompilationProvider -> Can access data relevant to the entire compilation (assemblies, all source files, various solution-wide options, and configs )
• SyntaxProvider -> Access to syntax trees to analyze, transform, and select nodes for future work (Most commonly accessed)
• ParseOptionProvider -> Gives access to various bits of info about the code being parsed, such as language, whether it’s regular code files, script files, custom preprocessor names, etc.
• AdditionalTextsProvider -> Additional texts are any non-source files you might want to access, such as a JSON file with various user-defined properties
• MetadataReferencesProvider -> Allows getting references to various things like assemblies without getting the whole assembly item directly
• AnalyzerConfigOptionsProvider -> If a source file has additional analyzer rules applied to it, this can access them

The ones we care about are CompilationProvider and SyntaxProvider.

Access the context.SyntaxProvider.CreateSyntaxProvider() method call.

This method takes two arguments. The first is called thepredicate, a super lightweight filter that reduces everything in the codebase to only the items we care about. The second is called thetransform, which ingests what we care about from the filter and makes any additional changes, property access, additional filtering, etc., as desired before returning the objects we want to work with later.

An example of using this syntaxProvider method is as follows.

The names of the arguments (predicate, transform) do not have to be supplied. I included them to make it easier to understand which is which.

https://medium.com/media/b0ad897bf84ad2327a80bf198b4c2f86/href

The Predicate

The predicate code’s first argument is a SyntaxNode , and the second is a CancellationToken. The token allows any asynchronous tasking performed in this method to be gracefully stopped if needed. In this example, it is unnecessary, so we will focus on the SyntaxNode.

(SyntaxNode node, _) =>
{
return node is ClassDeclarationSyntax classDeclaration &&
classDeclaration.Identifier.ToString() == “Calculator”;
}

The preceding code can seem daunting initially, as you are quickly bombarded with terms not typically seen by C# developers (e.g., SyntaxNode, ClassDeclerationSyntax, identifier, etc.). If you are anything like me, you are wondering what they mean, what they are used for, and why you need to use them.

Source generators work alongside / utilize the Roslyn compiler. Roslyn is a set of compilers and code analysis APIs. Roslyn understands your code and projects by breaking down almost everything into SyntaxNodes and SyntaxTokens.

Some examples of syntax tokens include access modifiers like public or private, modifiers like static, abstract, and partial. Names of items like a class name, namespace, method name, etc.

Tokens also include grammar items in the language, like semicolons, brackets, etc.

Example of a SyntaxToken Item

Examples of syntax nodes include class declarations, method declarations, bodies of methods, and individual lines of code, including assignments, expressions, and using statements.

Example of a Syntax Node in this case a Class Declaration Syntax Node

This programmatic code breakdown is then used to analyze code, write new classes, modify methods, etc. While this can feel daunting, something to remember is that syntax is ultimately still text, and syntax objects can be cast into a string if required. This is precisely what we do in the predicate to convert this SyntaxToken into a string with the .ToString() method to compare it to our target name.

There are various syntax nodes and token types, which I plan to break down and provide examples of in later posts in the series.

In summary, the predicate says if this piece of code represents declaring a class like public partial class Calculator, then check if its identifier (i.e., class name) is “Calculator,” and if so, pass it to the transform. This way, when the generator sees a node like public static void Main(), it knows to skip it.

The Transform transform: (GeneratorSyntaxContext ctx, _) =>
{
var classDeclaration = (ClassDeclarationSyntax)ctx.Node;
return classDeclaration;
}

The transform takes in the item that passed the filter and a cancellation token again to help cancel it if needed. The GeneratorSyntaxContext item is basically the node and some extra metadata. We then cast the context node item to a ClassDeclarationSyntax. This is required because even though the filter only passed us nodes of that type, the SyntaxContext does not understand that; however, we can cast it and safely know we are getting what we expect.

The transform is where we could extract members of the class, bodies of methods, etc.; whatever item we want to work on. In this example, we want to work on a class, so we get the item as a ClassDeclarationSyntax.

Finally, we add a where statement to filter out any null items that may have made it through. This is optional, but ensuring we aren’t getting some weird invalid item does not hurt.

The CreateSyntaxProvider returns an IncrementalValuesProvider<T> where T is whatever item type we are trying to return from the method call.

An `IncrementalValuesProvider` is a fancy word for the object holding our returned items. There is also an IncrementalValueProvider<T>, which is similar but is meant to have one object instead.

For example, our code’s ValuesProvider contains class declarations from the ClassDeclarationSyntax type.

This then leaves us with an initialization method like this:

https://medium.com/media/c00809482473b3d19c0697bf6cb5a90d/href

The last central part of using a source generator is telling it what to do with the items we got back. Go ahead and add the context. RegisterSourceOutput() line to your project. This tells the generator what to do with the returned items. Next, we will go over the content of this Execute method.

The Execute Method

Alright, so we have our target type; we are filtering out everything we don’t care about, so let’s send it to the execute method and generate our source code.

The execute method is typically defined as follows:

public void Execute(ClassDeclarationSyntax calculatorClass, SourceProductionContext context)
{
//Code to perform work on the calculator class
}

The first argument will vary depending on the work you are trying to perform and the method can be modified to take extra arguments as needed. The SourceProductionContext object gives us essential information about the project/solution and enables us to add code to the compilation to include it in the final build.

Since our goal is to generate some simple calculator functions, we will first check all the members of the class we are working on to see if they already have a method with the same name so we don’t accidentally override an existing version. Next, we will gather some metadata, like the namespace, any modifiers, and any using statements, to ensure the code compiles correctly. Lastly, we will insert the code we want into the source file and save it to the compilation.

https://medium.com/media/f854aa10ea2e8c34783650948971019f/href

So the final generator code should look like the following:

https://medium.com/media/448789dddc2b13f03024903d2085d840/href

Alright, all the pieces are in place. Let’s build the solution and check out the generated code.

Example Error Messages When Source Generation Fails

Well, that’s not what we hoped for; however, as with many development projects, errors are bound to happen. Don’t panic yet; that is intended to show off some important things when working with source generators. First, source generators will only present a warning when they fail to generate code, so watch for warning messages like this when compiling the code.

Warning CS8785 : Generator ‘CalculatorGenerator’ failed to generate source. It will not contribute to the output and compilation errors may occur as a result. Exception was of type ‘NullReferenceException’ with message ‘Object reference not set to an instance of an object.’.

Second, source generators execute at compile time, making capturing extra context from the exception challenging as you might typically do with a try-catch where you can print info to the console.

If you try something like the following, you will notice no additional information is sent to the console.

public void Execute(ClassDeclarationSyntax calculatorClass, SourceProductionContext context)
{
Try
{
// code from before
}
catch(Exception ex)
{
Console.WriteLine(ex);
}
}

OK, no problem. Instead, Let’s save the message to a file in the catch statement.

File API Blocked in Source Generators

OK, maybe not. If we can’t log to a file in the generator and we can’t log to the console, how will we get the details we need to figure out what is going wrong?

Logging in Source Generators

This brings us to logging in source generators, which I wanted to include in this first part because it is by far the most accessible means of troubleshooting issues when using source generators.

To enable logging in the source generator, open the shared library we made at the start. It should have a single class named class1. Rename that to GeneratorLogging. While the File API is blocked inside the source generator itself, adding that functionality to a secondary library and having it write the content in a file for you is possible.

A simple logging class would be something like the following

https://medium.com/media/d2ee7383cf66da2e79d4042bf2ab6d95/href

There are a few key parts I will quickly explain.

• The lock object -> This ensures that only one instance of the log message call runs simultaneously. This way, the source generators do not step on each other while trying to access the same file. Even with just one source generator, this can still happen because it checks multiple classes simultaneously.
• The log message method -> This method will create the file at the provided path if it does exist. Then, so long as the log level is equal to or higher than the set level, it will log the message to the file. It will also add a small header and footer to messages set higher than info to better showcase errors.

Fixing the Example Code

Using the logging class is very straightforward; if you haven’t already, ensure the shared library is added as a dependency of the generator project so it can access it. So, let’s add some logging calls to our current code and see what the log shows.

https://medium.com/media/385cf2859d0c6be2ccde8d9ce079a1f7/href

If needed, perform dotnet clean to clean up any previous logs or generated files. Then, build the solution and check the log file.

The log then will contain output like the following:

[+] Generated Log File
[+] This file contains log messages from the source generator
Logging started at 2024–09–14 19:42:12.287
[+] Found 2 members in the Calculator class
[+] Checked if methods exist in Calculator class
[+] Added using statements to generated class

[Error start]
[-] Exception occurred in generator: System.NullReferenceException: Object reference not set to an instance of an object.
at SourceGenerator.CalculatorGenerator.Execute(ClassDeclarationSyntax calculatorClass, SourceProductionContext context)
[Error end]

From this log output, we can see the generator is running into this Null Reference Exception right after the using statement code, so let’s take a more in-depth look at that.

GeneratorLogging.LogMessage(“[+] Added using statements to generated class”);
calcGeneratedClassBuilder.AppendLine();

SyntaxNode calcClassNamespace = calculatorClass.Parent;

while (calcClassNamespace is not NamespaceDeclarationSyntax)
{
calcClassNamespace = calcClassNamespace.Parent;
}
GeneratorLogging.LogMessage($"[+] Found namespace for Calculator class {calcClassNamespace?.Name}", LoggingLevel.Info);

Here, we see the calcClassNamespace enumerates through the parents of the class object until it finds something. However, we did not add any null checks to ensure we had a namespace before continuing. Let’s modify this section of code to handle the nulls and perform a check against the nodes ancestors as well.

GeneratorLogging.LogMessage(“[+] Added using statements to generated class”);

calcGeneratedClassBuilder.AppendLine();

BaseNamespaceDeclarationSyntax? calcClassNamespace = calculatorClass.DescendantNodes().OfType<NamespaceDeclarationSyntax>().FirstOrDefault() ??
(BaseNamespaceDeclarationSyntax?)calculatorClass.DescendantNodes().OfType<FileScopedNamespaceDeclarationSyntax>().FirstOrDefault();

calcClassNamespace ??= calculatorClass.Ancestors().OfType<NamespaceDeclarationSyntax>().FirstOrDefault();
calcClassNamespace ??= calculatorClass.Ancestors().OfType<FileScopedNamespaceDeclarationSyntax>().FirstOrDefault();

if(calcClassNamespace is null)
{
GeneratorLogging.LogMessage(“[-] Could not find namespace for Calculator class”, LoggingLevel.Error);
}
GeneratorLogging.LogMessage($”[+] Found namespace for Calculator class {calcClassNamespace?.Name}”);

This updated version will now search through all of the child and ancestor nodes to see if the previous checks were null and update them as needed. If they are still null, we should get a log entry to keep troubleshooting issues.

This then gives us a final working source generator of:

https://medium.com/media/50b108415f0110617e43ced6881796e5/href

We can test this by modifying the WebApi project we created at the start.

Open the WebApi program.cs file and modify it to look like this:

https://medium.com/media/673f0284e8b3088d36d3531400658f7b/href

When we run this project and send a get request to the / URL, we will get back a message with the results from the source-generated methods.

API Call Showing the Generated Code Compiled and Executed Correctly Conclusion for Part 1

I would like to cover many other capabilities of source generators in future parts that help showcase the real power behind them. So, if you enjoyed this first installment, stick around for more in-depth looks at C# source generators.

Dotnet Source Generators in 2024 Part 1: Getting Started was originally published in Posts By SpecterOps Team Members on Medium, where people are continuing the conversation by highlighting and responding to this story.

The post Dotnet Source Generators in 2024 Part 1: Getting Started appeared first on Security Boulevard.

Pittsburgh, PA, Oct. 1, 2024 — ForAllSecure, the world’s most advanced application security testing company, today announced it is changing its corporate name to Mayhem Security (“Mayhem”), signaling a new era of growth and opportunity aligned with its award-winning … (more…)

The post News alert: Introducing Mayhem Security — ForAllSecure unveils name change, fresh focus first appeared on The Last Watchdog.

The post News alert: Introducing Mayhem Security — ForAllSecure unveils name change, fresh focus appeared first on Security Boulevard.

via the comic humor & dry wit of Randall Munroe, creator of XKCD

Permalink

The post Randall Munroe’s XKCD ‘Beamsplitters’ appeared first on Security Boulevard.

In a groundbreaking move, the House Administration Committee, along with the Chief Administrative Officer (CAO) for the House of Representatives, have introduced a comprehensive policy aimed at governing the use of artificial intelligence (AI) within the lower chamber. This policy is a significant milestone designed to foster the secure and effective deployment of AI technologies while addressing cybersecurity risks. The policy, which took effect on August 28, presents a structured approach to assessing and prioritizing AI tools, enabling all House personnel to contribute ideas and technologies. 

The post Breaking Down the House’s New Artificial Intelligence Policy appeared first on Security Boulevard.

APIs are crucial in our digital world, but they also introduce new vulnerabilities. Attackers often exploit these vulnerabilities by concealing malicious payloads within encrypted traffic, rendering them undetectable to traditional security tools. As we observe Cybersecurity Awareness Month, it's important to emphasize the significance of advanced solutions that can detect hidden threats.

eBPF: Illuminating the Dark Corners of API Traffic

eBPF (extended Berkeley Packet Filter) is a powerful method for inspecting network traffic, including encrypted traffic. It works within the Linux kernel to analyze API calls at a detailed level, identifying and blocking malicious activity with speed and efficiency. eBPF provides significant advantages in detecting and responding to hidden API threats without complex decryption processes.

Why eBPF Matters for API Security

eBPF offers several key advantages for API security:

• Deep API Visibility: eBPF offers unparalleled visibility into encrypted API traffic, enabling security teams to detect and respond to hidden threats.
• Performance and Scalability: eBPF is designed to be highly efficient and scalable, making it ideal for analyzing large volumes of API traffic without impacting system performance.
• Flexibility and Extensibility: eBPF is a flexible framework that can be extended to support a wide range of API security use cases, including threat detection and prevention, compliance monitoring, and incident response.

Salt Security and eBPF: A Powerful Combination

Salt Security, a leader in API security, has utilized eBPF to gain exceptional visibility into encrypted API traffic. By leveraging eBPF, Salt Security can:

• Inspect Encrypted Traffic: eBPF enables Salt Security to inspect encrypted API traffic at the kernel level, after ssl termination. This capability allows Salt Security to detect suspicious patterns and anomalies within encrypted payloads, providing essential protection against attacks that would otherwise be unnoticed.
• Increased Visibility: eBPF gives Salt Security detailed insight into API calls, including request and response headers, payloads, and metadata. This information allows Salt Security to create thorough API behavioral profiles, pinpoint subtle deviations from normal patterns, and accurately identify potential threats.

The Future of API Security with eBPF

The evolving nature of API attacks highlights the increasing importance of eBPF in API security. With its ability to offer comprehensive visibility, high performance, and flexibility, eBPF enables security teams to proactively protect their APIs from advanced threats, especially when combined with next-generation security solutions like Salt Security. Salt Security's incorporation of eBPF support demonstrates the potential for this technology to revolutionize how organizations approach API security. eBPF will be a critical component of our future API protection capabilities, allowing us to achieve comprehensive security across all layers by integrating it with our existing AI-powered engine. This integration will facilitate the identification and mitigation of threats at both the kernel and application levels, providing unparalleled protection against sophisticated attacks.

If you want to learn more about Salt and how we can help you on your API Security journey through discovery, posture management, and run-time threat protection, please contact us, schedule a demo, or check out our website.

The post Seeing the Unseen: Salt Security and eBPF appeared first on Security Boulevard.

Modern businesses are increasingly reliant on APIs. They are the building blocks facilitating data exchange and communication between disparate systems. Because of their prevalence and importance, they are also under attack by actors exploiting vulnerabilities and misconfigurations.  Unauthorized access, data exposure, injection attacks, broken authentication, DoS attacks, shadow or unmanaged APIs, insecure API dependencies, and [...]

The post API Gateways and API Protection: What’s the Difference? appeared first on Wallarm.

The post API Gateways and API Protection: What’s the Difference? appeared first on Security Boulevard.

Authors/Presenters:Yiluo Wei, Dennis Trautwein, Yiannis Psaras, Ignacio Castro, Will Scott, Aravindh Raman, Gareth Tyson

Our sincere thanks to USENIX, and the Presenters & Authors for publishing their superb 21st USENIX Symposium on Networked Systems Design and Implementation (NSDI '24) content, placing the organizations enduring commitment to Open Access front and center. Originating from the conference’s events situated at the Hyatt Regency Santa Clara; and via the organizations YouTube channel.

Permalink

The post USENIX NSDI ’24 – The Eternal Tussle: Exploring the Role of Centralization in IPFS appeared first on Security Boulevard.

As we enter October, we once again recognize national Cybersecurity Awareness Month, a pivotal initiative to raise awareness about the importance of securing our digital world.

The post Cybersecurity Awareness Month: Building a safer digital world together appeared first on Security Boulevard.

Takeaways from OWASP Global AppSec SF 2024, covering security tools, AI risks, and strategies for improving application security while empowering developers.

The post OWASP Global AppSec SF 2024: Empowering Developer Security As A Community appeared first on Security Boulevard.

Security operations platform provider Exabeam announced its first product release since acquiring LogRhythm earlier this year, a provider of self-hosted and cloud-native SIEM platforms, log management, network monitoring and behavior and security analytics products.

The post Exabeam Brings AI Security Operations to On-Premises, Cloud Native and Hybrid Environments appeared first on Security Boulevard.

The U.S. and its Five Eyes alliance partners are warning enterprises techniques threat actors use to target Microsoft's Active Directory and ways that they can detect and mitigate such attacks.

The post Five Eyes Agencies Put Focus on Active Directory Threats appeared first on Security Boulevard.

Cross-site scripting (XSS) vulnerabilities continue to be a major concern in today’s software landscape, despite being preventable. CISA and FBI have issued a Secure by Design alert to reduce the prevalence of these vulnerabilities. While XSS attacks have been around for years, they remain a persistent threat due to improper handling of user inputs in […]

The post CISA and FBI Issue Alert on XSS Vulnerabilities appeared first on TuxCare.

The post CISA and FBI Issue Alert on XSS Vulnerabilities appeared first on Security Boulevard.

A critical SAML authentication bypass flaw was recently identified in GitLab’s Community Edition (CE) and Enterprise Edition (EE). As of now, GitLab patches aiming to fix the flaw have been released; however, if the fixes had not been released, potential exploits of the flaw may have been detrimental. In this article, we’ll dive into the […]

The post GitLab Patches: Severe SAML Authentication Bypass Flaw Fixed appeared first on TuxCare.

The post GitLab Patches: Severe SAML Authentication Bypass Flaw Fixed appeared first on Security Boulevard.

Cybersecurity Awareness Month 2024: The Top Four Ways to Secure Our World
madhav
Tue, 10/01/2024 - 06:44

Cybersecurity Awareness Month is an international initiative that focuses on simple ways to protect ourselves, our families, and our businesses from online threats. The 2025 theme “Secure Our World” highlights the pervasiveness of digital technologies that enable connections across the globe and how straightforward, yet effective measures can have a lasting impact.

In a world where our digital lives are increasingly intertwined, every attack vector secured increases the safety of other connected people. And considering how connected we all are to our devices, networks, and the internet at large, this can be a lot of us.

Key Cybersecurity Practices to Implement 1. Use Strong Passwords and a Password Manager

Sadly, less than 40% of all online users use a distinct password for each account, according to the National Cybersecurity Alliance 2023 Oh Behave! report. Reused passwords give cybercriminals bonus access to other areas of a person’s digital life when they’ve only done the work to steal (or buy, or crack) a single credential. Aside from having a different login for each site, current wisdom (a la CISA) suggests that a strong password contains:

• At least 16 characters.
• Randomization, with a mix of letters, symbols, and numbers.
• Potentially a “passphrase” of 4-7 words, although randomization is recommended.

However, even strong and unique passwords have well-documented limitations and risks. As threat actors get savvier about targeting our access credentials, the industry is gradually moving away from passwords altogether and into a passwordless future. This means switching wholesale to other forms of authentication, which may leverage biometric data, PINs, patterns, and passkeys in place of passwords. With more and more platforms supporting passkeys and passwordless authentication, moving away from passwords is becoming easier and frictionless.

In either case – passwords or passwordless passkeys – a password manager is needed (here’s why). With the average person having to keep track of roughly 100 distinct credentials, it’s no wonder that nearly one-third of the internet uses a password manager to wrangle (and “remember”) them all.

2. Recognize and Report Phishing

According to the Thales 2024 Data Threat Report, phishing is the second fastest-growing attack. Phishing tactics are getting sneakier, thanks to AI, and it is more important than ever that employees be able to recognize their telltale signs. Now, AI-based campaigns can churn out word-perfect emails in any language, typically:

• Creating a sense of urgency (creating panic and short-circuiting your critical-thinking brain)
• Encouraging some unsolicited action (like “change your password now” or “download now”)
• Asking for some form of personal information (usually financial data, like in BEC scams)

However, the most effective way to enable people to spot and report phishing emails is to strengthen the “human firewall.” Businesses should invest in security awareness training programs not only for their employees but also for their families to establish a positive culture where everyone is invited to report mistakes, like clicking on a malevolent link.

3. Turn on Multifactor Authentication

Multifactor Authentication (MFA) is a required layer of security by many cloud service providers and even more everyday organizations. CISA, ENISA, and other global security agencies advise that everyone adopts it, as it provides additional layers of defense on top of just passwords alone (a text verification code, or a fingerprint, for example). There are various MFA options available:

• Phishing-resistant MFA is known by CISA as the “gold standard” and encompasses FIDO/WebAuthn authentication and Public Key Infrastructure (PKI)-based methods.
• App-based MFA methods increase security by sending a pop-up or “push” notification to the user’s phone, generating a one-time password (OTP), or using a token-based OTP.
• SMS or Voice MFA simply relies on sending the user a verification phone call or text.

Despite the importance and the variety of MFA methods, Thales 2024 DTR report shows that only 46% of the organizations use multi-factor authentication for more than 40% of their employees. It is essential to note that while phishing-resistant MFA is most effective against AI-enabled social engineering attacks, any form of MFA is much better than no MFA at all. In addition, there’s great business value behind adopting MFA. The Thales 2024 Digital Trust Index indicates that 81% of customers expect brands to offer MFA, which serves as a means to greater loyalty and trust.

4. Update Software: A Critical Defense, But Proceed with Caution

It is crucial that all employees know to accept and apply software updates every time the reminders come up because these are how vulnerabilities stay patched. One Ponemon report noted that 60% of breaches originated from unpatched vulnerabilities, making this simple practice even more vital.

Criminals have quickly embraced AI to spot and exploit even zero-day vulnerabilities. Interestingly, these unpatched gaps open the way for spreading disruptive ransomware attacks. However, businesses, especially in critical infrastructure settings, should patch their systems with caution and not out of fear. Although timely security updates are crucial, it is equally important to test those updates in a controlled environment before rolling them out to minimize the possibility of breaking critical systems.

A Little Goes a Long Way

The overall goal of the Cybersecurity Awareness Month celebration is to enhance data security—either personal or corporate data. As these highlighted methods show, it doesn’t have to be difficult to use or implement. In fact, keeping it simple will help you meet your users where they are and give them practical tools they can implement without reaching too far outside their comfort zones, which will increase the chances of engagement and long-term adoption.

Also, if you are a business, complement the above best practices with solutions that offer robust application and data protection to reduce the potential of a data breach. These solutions can provide a proactive compliment to employee security awareness efforts, letting you know where your data resides, who is accessing it, and when it is at risk. Combined with the above user-friendly methods, Imperva’s solutions allow employees to be your first line of defense and enterprise-ready cybersecurity tools to be your last.

Now that’s defense-in-depth to secure our world!

Data Security Identity & Access Management

Ashvin Kamaraju | Vice President of Engineering, Strategy & Innovation
More About This Author > Schema {
"@context": "https://schema.org",
"@type": "BlogPosting",
"headline": "Cybersecurity Awareness Month 2024: The Top Four Ways to Secure Our World",
"description": "Learn practical tips for enhancing cybersecurity during Cybersecurity Awareness Month 2024. Discover key strategies like strong password management, recognizing phishing attacks, enabling MFA, and updating software.",
"datePublished": "2024-10-01",
"author": {
"@type": "Person",
"name": "Ashvin Kamaraju",
"url": "https://cpl.thalesgroup.com/blog/author/akamaraju",
"sameAs": "https://www.linkedin.com/in/ashvinkamaraju/"
},
"publisher": {
"@type": "Organization",
"name": "Thales Group",
"description": "The world relies on Thales to protect and secure access to your most sensitive data and software wherever it is created, shared, or stored. Whether building an encryption strategy, licensing software, providing trusted access to the cloud, or meeting compliance mandates, you can rely on Thales to secure your digital transformation.",
"url": "https://cpl.thalesgroup.com",
"logo": "https://cpl.thalesgroup.com/sites/default/files/content/footer/thaleslogo-white.png",
"sameAs": [
"https://www.facebook.com/ThalesCloudSec",
"https://www.twitter.com/ThalesCloudSec",
"https://www.linkedin.com/company/thalescloudsec",
"https://www.youtube.com/ThalesCloudSec"
]
},
"mainEntityOfPage": "https://cpl.thalesgroup.com/blog/identity-data-protection/cybersecurity-awareness-month-2024"
}

basic

The post Cybersecurity Awareness Month 2024: The Top Four Ways to Secure Our World appeared first on Security Boulevard.

User interaction with online platforms, applications, and websites has become a fundamental aspect of daily life. Whether you’re shopping, managing finances, or engaging with social media, your interaction with a user interface (UI) shapes your experience. However, not all UI designs have your best interests in mind. Hackers sometimes use clickjacking and dark patterns to […]

The post How Dark Patterns Trick Users into Unintended Actions? appeared first on Kratikal Blogs.

The post How Dark Patterns Trick Users into Unintended Actions? appeared first on Security Boulevard.

The world of gaming can be a cut-throat place, with many players turning to online help via third-party programs (‘game hacks’) to get ahead. Although some of these programs offer legitimate game boosts, malicious actors frequently leverage these game hackers’ interest in modifications to deliver malware. One such example can be found in the game […]

The post Trouble in Da Hood: Malicious Actors Use Infected PyPI Packages to Target Roblox Cheaters appeared first on Blog.

The post Trouble in Da Hood: Malicious Actors Use Infected PyPI Packages to Target Roblox Cheaters appeared first on Security Boulevard.

After putting its controversial AI-based Recall feature on hold in June, Microsoft rearchitected many of its features to address the security and privacy concerns that users and experts raised and will release it for the upcoming Windows Copilot+ PCs.

The post Microsoft Readies a More Secure Recall Feature for Release appeared first on Security Boulevard.

Authors/Presenters:Jinzhu Yan, Haotian Xu, Zhuotao Liu, Qi Li, Ke Xu, Mingwei Xu, Jianping Wu

Our sincere thanks to USENIX, and the Presenters & Authors for publishing their superb 21st USENIX Symposium on Networked Systems Design and Implementation (NSDI '24) content, placing the organizations enduring commitment to Open Access front and center. Originating from the conference’s events situated at the Hyatt Regency Santa Clara; and via the organizations YouTube channel.

Permalink

The post USENIX NSDI ’24 – Brain-on-Switch: Towards Advanced Intelligent Network Data Plane via NN-Driven Traffic Analysis at Line-Speed appeared first on Security Boulevard.

The financially motivated Storm-0501 threat group is attacking hybrid cloud environments in the United States by compromising on-prem systems first and moving laterally into the cloud, stealing data and credentials and dropping the Embargo ransomware along the way, Microsoft says.

The post Storm-0501 Gang Targets US Hybrid Clouds with Ransomware appeared first on Security Boulevard.

Overview: IBM's Cost of a Data Breach Report 2024About the report

IBM’s annual 2024 Cost of a Data Breach Report provides IT, risk management, and security leaders with timely, quantifiable evidence to guide them in their strategic decision-making. The report is based on an in-depth analysis of real-world data breaches experienced by 604 organizations globally between March 2023 and February 2024.

About the research

The research for this report was done by Ponemon Institute on its own and was sponsored, analyzed, and published by IBM. Researchers looked at organizations across 17 industries, in 16 countries and regions, and breaches that ranged from 2,100 to 113,000 compromised records. It also included interviews with 3,556 security and business professionals from the breached organizations.

This article delves into the key takeaways from the report, examining the financial impacts and emerging trends in data security. We will explore the effectiveness of new technologies in breach mitigation, the costs associated with cloud security threats, and the other elements that play a critical role in preventing breaches. By unpacking these insights, organizations can better prepare themselves against the rising tide of cyberthreats.

Seven Key Takeaways Let’s look at some of the most important insights and lessons from this year's report and how companies can transform them into strategies.

Takeaway 1: Data breach costs hit new highs with a 10% spikeNotable stats: The global average cost of a data breach surged to $4.88 million in 2024, reflecting a 10% increase from 2023‌—the largest annual spike since the pandemic. The main factors contributing to this increase are the costs associated with business disruption, lost customers, and post-breach responses, such as regulatory fines and customer remediation efforts.

Other findings:

The United States had the highest average breach cost at $9.8 million
Healthcare remains the costliest industry for breaches at $9.8 million per breach
Mega breaches (those involving 1 to 10 million records) represent only a small fraction of incidents but were nearly nine times more expensive than the average breach, starting at around $42 million per breach
Noncompliance with regulations - 22.7% increase in the share of organizations paying fines of more than $50,000
Law enforcement involvement lowered breach costs by 20%

Fig. Global average cost of a data breach, IBM Cost of a Data Breach Report 2024

These figures demonstrate the rise of cyber assaults and the progressive complexity of the daily dangers that organizations encounter. Bad actors are using various advanced methods to breach defenses and carry out their attacks.

Key lesson: Know and protect your data landscape

Data breaches significantly impact businesses, rather than just causing small disruptions. They lead to substantial financial losses, reputation damage, and the erosion of customer confidence. It's then vital to enhance data security measures and assess potential data risks to prevent attackers from breaking in.

How Zscaler helps

Zscaler Data Security Posture Management (DSPM) can identify and protect sensitive data to mitigate the risk of data exposure, breach, and regulatory non-compliance. With Zscaler, organizations can improve visibility, conduct regular risk assessments, prioritize risk remediation, ensure compliance, and reduce data breach risk.

Takeaway 2: Exploding cloud data is a prime targetNotable stats: About 40% of all breaches involved data distributed across multiple environments. Data breaches solely involving public clouds were the most expensive type of data breach, costing $5.17 million on average, a 13.1% increase from last year.

Key lesson: Strengthen risk assessment and remedy

Multicloud environments and cloud native architectures have created both complexity and a data explosion that’s becoming increasingly difficult for security professionals to manage, making organizations vulnerable to breaches. Teams struggle to understand which data is in the cloud, where it’s located, and who’s using it.

Fig: Cost of data breach by storage location, IBM Cost of a Data Breach Report 2024

Moreover, cloud services and configurations change frequently, which can lead to data exposure. It's crucial to actively monitor, assess, and fix risks associated with new and changing data services before bad actors can exploit them.

Fig: Cost of data breach by storage location, IBM Cost of a Data Breach Report 2024

How Zscaler helps

DSPM seamlessly covers a variety of cloud environments and reads from various databases, data pipelines, object storage, and much more. What’s more, it’s managed and self-hosted to provide a single, consistent view of data across clouds, geographies, and organizational boundaries. This single view helps security teams to evaluate the risk of sensitive data across multicloud environments rather than individually.

Takeaway 3: Shadow data increases the risk and potential cost of breachesNotable stats: As per the report, 35% of data breaches involved shadow data, and breaches involving shadow data led to a 16% higher cost on average. Moreover, breaches involving shadow data took 26.2% longer to identify and 20.2% longer to contain. These resulted in data breaches lasting longer than the normal average life cycle of 291 days, 24.7% longer than data breaches without shadow data.

Fig: Cost of data breach including shadow data, IBM Cost of a Data Breach Report 2024

Key lesson: Monitor and protect shadow data

Managing data security across environments becomes further complicated by the impact of unmanaged or shadow data. Shadow data can cause large financial losses to a business if breached, and must be tightly secured as such. This data is often invisible to security teams, making it difficult to track, classify, and secure.

How Zscaler helps

Zscaler DSPM scans cloud data repositories to discover structured and unstructured data stores to give a clear view of the data landscape, inventory, and security posture. Security teams can easily track, classify, and secure shadow data while reducing the risk of breaches.

Takeaway 4: Common attack vectors cause substantial damage Notable stats: Credential-based attacks were the most common attack vector, accounting for 16% of all breaches. On top of that, they took the largest amount of time to identify and contain—an average of 292 days, approximately 10 months—resulting in some of the highest breach costs.

Phishing was the second-most costly common attack vector, at $4.76m on average, which led to 15% of breaches. Other common vectors included cloud misconfigurations, email compromises, and vulnerabilities that led to 15%, 9%, and 5% breaches.

Fig: Average response time to identify and contain breaches caused by common attack vectors, IBM Cost of a Data Breach Report 2024

Key lesson: Focus on consistent security across environments

Organizations need a robust data security strategy that can decode weak signals to uncover hidden risks and threats, analyze attack patterns, and help security teams with swift incident response to secure data.

How Zscaler helps

Integrating DSPM solutions with cloud environments allows security teams to monitor data flows—including tracking data, access, actions, and data transfer. Organizations can leverage artificial intelligence (AI), advanced threat correlation, analytics, and machine learning (ML) to identify patterns that indicate potential security risks, such as unauthorized access, abnormal data transfers, or attempts to exfiltrate sensitive data.

Moreover, encompassing a single DLP engine for your entire data protection solution lets organizations create a policy once and apply it everywhere in their environments.

Takeaway 5: Critical infrastructure organizations under pressure to secure crown jewelsNotable stats: For the 14th year in a row, the healthcare sector saw the costliest breaches across industries with average breach costs reaching $9.77 million. While the report highlighted a 10.6% decrease from 2023, healthcare remained a prime target for cybercriminals, followed by financial services, industrial, technology, and energy organizations. Organizations in these industries also reported the largest fines for regulatory violations such as GDPR violations.

Fig: Cost of data breach by industry, IBM Cost of a Data Breach Report 2024

Key lesson: Modernize and simplify security stack

Organizations in these industries generate and hold a vast amount of personal and sensitive information, with data often data scattered with default access. It’s loosely exchanged with third-party partners, such as agencies, research firms, and service providers, which creates opportunities for data breaches and insider threats, underscoring the need for stringent data protection protocols.

Most organizations opt for a siloed security approach with multiple security products that exacerbates the complexity of security challenges. As such, it’s crucial for organizations to modernize their security stack to better protect data and reduce breach costs.

How Zscaler helps

With Zscaler's comprehensive data protection platform, organizations can secure their structured and unstructured data across all channels, including web, SaaS, public clouds (AWS, Azure, GCP), private apps, email, and endpoints.

Takeaway 6: AI and automation reduce breach costsNotable stats: 53% of organizations that experienced a data breach in 2024 reported significant shortages in their security staff. This shortage is directly linked to higher costs associated with data breaches, as organizations with severe staffing shortages had to pay an extra $1.76 million for breach-related expenses.

In the face of this growing challenge, there’s been a marked shift towards AI and automation tools within security operations. The report highlights the fact that AI and automation can alleviate some of the workload and optimize security. According to the report, organizations that deployed security, AI, and automation extensively across their operations saved an average of $2.2 million compared to those that did not.

Fig: Cost of a data breach by AI and automation usage level; IBM Cost of a Data Breach Report 2024

Key lesson: Implement advanced AI and automation for data security

For organizations seeking to mitigate the risk of a data breach, investing in security automation is no longer optional—it’s essential. Due to a shortage of skilled manpower, companies have had to manually enforce security processes and data security policies, which can prove to be error-prone and inefficient, particularly in complex cloud environments.

Moreover, human error can introduce risks such as misconfigured access control or overlooked data transfers. AI and automation can enable security teams to act faster, reducing the time to identify and contain breaches, which in turn lowers breach costs overall.

How Zscaler helps

Organizations can leverage AI-powered DSPM to understand data context, making discovery and classification affordable at scale, and empowering cross-functional teams to be part of the solution. Moreover, DSPM can enforce automated, consistent security policies, like encryption, access control, data retention, and deletion, across various environments, ensuring uniformity and reducing non-compliance risk. By automating security policies, organizations can streamline processes to ensure that data is secured according to established rules and regulatory requirements.

Takeaway 7: Slow response increases risk and costNotable stats: The average time to identify and contain a data breach dropped to 258 days, reaching a 7-year low, compared to 277 days the previous year. Roughly one-third of organizations took more than three-quarters for a complete recovery.

Fig: Time to identify and contain a data breach, IBM Cost of a Data Breach Report 2024

Key lesson: Enhance breach detection and incident response plans

This is a significant amount of time to detect and contain breaches, and it highlights the importance of having a strong plan in place to detect and contain data breaches as quickly as possible.

How Zscaler helps

Zscaler DSPM leverages AI, ML, and advanced threat correlation capabilities to aggregate and effortlessly transform security data into meaningful insights to uncover hidden risks or attack vectors that could lead to a compromise or breach. This can be backed by near-real-time alerts and notification with remediation guidance that enables security teams to focus on what matters most.

The Bottom Line

The IBM Cost of a Data Breach Report 2024 highlights the growing financial impact and operational risks posed by data breaches. The threat landscape is becoming more challenging, growing more complex and dangerous. Given the report's findings, it’s clear that organizations without a modern and advanced security stack are at a considerable disadvantage, facing longer breach life cycles and higher associated costs. ‌

Investing in the right tools and strategies like Zscaler Data Protection and DSPM is not just a good choice, but a critical action that organizations must take to better protect themselves from the rising costs of data breaches. This will help them succeed and be resilient in the future.

Interested in learning more about Zscaler and how it can help prevent risk of data breaches?

Register for our upcoming webinar: Dissecting Cloud Data Breaches with DSPM
Watch on demand: Webinar: Why Does DSPM Belong In Your Data Protection Strategy?

Schedule a 1:1 Demo today to learn more about ‌our innovative solutions that secure your valuable data assets against the evolving threat landscape. Our team will work with you to assess your current security posture, identify potential vulnerabilities, and tailor a solution that maximizes protection and efficiency.

The post 7 Key Takeaways From IBM's Cost of a Data Breach Report 2024 appeared first on Security Boulevard.