Tales from Fleet security: securing the startup Fleet is an all-remote company that makes open-source software. Openness is one of our core values.In this blog series, I will explain the process behind security here at Fleet. We document the how and why in our handbook, but blogging is a better medium for covering the process that allowed us to reach those conclusions.These articles will also contain links to different resources...

A quick guide to installing osquery and enrolling Linux devices into Fleet via the Fleet osquery installer (Fleet’s recommended method)Here, we will cover enrolling Linux devices to an existing Fleet server. If you don’t have a Fleet server configured already, check out the Server Installation docs. If you’re still getting to know Fleet and would like to skip the server setup process and check out a preview, you can Get Started using fleetctl...

My Perfect B2B SaaS Sales Deck Is 14 Slides Long Learn how I prepared for and built out my perfect B2B SaaS Sales Deck for Kolide, including what common mistakes to avoid.

Fleet 4.12.0 | Policy automations for teams, platform-specific policies, and improved query results We’re pleased to announce Fleet 4.12.0. Check out the full changelog or continue reading to summarize what’s new.For update instructions, see our upgrade guide in the Fleet docs.HighlightsPolicies: check policies on specific platformsFleet UI: help users understand which hosts are returning resultsPolicies: check policies on specific platformsFleet admin and maintainers can specify the platform (macOS, Windows, Linux) for a...

Tales from Fleet security: securing Google Workspace At Fleet, we collaborate using various SaaS tools, from GitHub to Google Workspace and Slack. Since we use our Google identities for many of these, Workspace is the most critical one from a security point of view.Our high-level goals are to:Secure Google WorkspaceReduce the number of tools used (eliminate those that serve the same purpose)Use single sign-on (SSO) where possible or Google Auth where genuine SSO is not available.Our complete configuration guide is available in the Fleet <a...

What Are The Security Risks Of Cloud Computing? Nearly all encompassing and only set to continue evolving, cloud computing has changed the way we live our lives and the course of modern business. With a current estimate of $371.4 billion in 2020 and projected Compounded Annual Growth Rate of 17.5% to amass a market worth of $832.1 billion by 2025, the continued expansion of cloud is guaranteed.

2022 MITRE ATT&amp;CK® Evaluations: Spotlight on Ransomware We’re able to share our results from the MITRE ATT&CK® Evaluations Enterprise Round 4. This is our second year participating in the ATT&CK Evaluations, and we are proud of our performance in both the Windows and Linux portions of the evaluation. The ATT&CK Evaluations are much-needed third-party assessments of detection efficacy. Read more about the...

Security testing at Fleet/Orbit auto-updater audit At Fleet, openness is one of our core values. We believe a rising tide lifts all boats and that almost everything we do regarding security should be public.Orbit is an osquery runtime and auto-updater. It leverages The Update Framework to create a secure update...

New Google Chrome Update Check Over the weekend, Google issued numerous warnings to Chrome users, telling them to update their browser version immediately to protect again...

2022 MITRE ATT&amp;CK® Evaluations: Spotlight on Ransomware We’re able to share our results from the MITRE ATT&CK® Evaluations Enterprise Round 4. This is our second year participating in the ATT&CK Evaluations, and we are proud of our performance in both the Windows and Linux portions of the evaluation. The ATT&CK Evaluations are much-needed third-party assessments of detection efficacy. Read more about the...

Is Your Security Awareness Program a Total Snoozefest? See why your cybersecurity training program might be failing, what you can do to improve it, and the one thing you must keep in mind for long-term success.

Spring4Shell and CVE-2022-22963: How They Work and How to Inventory Vulnerable Packages with Uptycs A remote code execution vulnerability, CVE-2022-22965, was disclosed on March 29th by a security researcher on Twitter (now deleted). Even though for a few hours there were questions about its legitimacy, the Spring team soon officially <a...

Osquery: a tool to easily ask questions about operating systems Osquery unifies how we ask questions across operating systemsAccess is available to the underlying state of an operating system.Compatible device operating systems include Windows, macOS, or, if it’s a server, a Linux distribution like Ubuntu or Debian.It is powerful, flexible, and provides relevant and specific data that you can use to manage devices.It is easy to perform tasks like checking the battery health of your MacBook Pro or checking for vulnerabilities on your CentOS servers.Osquery...

How to Write a New Osquery Table Under the hood, Kolide uses osquery to collect telemetry from devices. This tutorial will teach you how to design, code, and submit a new virtual table to the osquery project.

Modernize Your Vulnerability Management With Honest Security How Kolide approaches vulnerability management has always been different from other security vendors. In this article, we describe why the bar is so much higher and how our views on vulnerabilities inform what checks we ship with Kolide.

What Is Lateral Movement? An attack method where behavior analysis and remote access tools are used to sidestep devices in an attempt to exfiltrate data from an organization, lateral movement mimics human behavior to widen its range and depth of undetectability. As cyber threats become more sophisticated, company networks have seen a rise in lateral movement attacks. As they easily avoid detection from...

What Is Lateral Movement? An attack method where behavior analysis and remote access tools are used to sidestep devices in an attempt to exfiltrate data from an organization, lateral movement mimics human behavior to widen its range and depth of undetectability.

What Is Lateral Movement? An attack method where behavior analysis and remote access tools are used to sidestep devices in an attempt to exfiltrate data from an organization, lateral movement mimics human behavior to widen its range and depth of undetectability.

Tales from Fleet security: GitHub configuration and OpenSSF Scorecards At Fleet, we do our work in public. Our code is open source. Customers and open source users use it with osquery, another great open source project. We want to provide quality software and a method for potential users to assess the maturity of our security.Security maturity assessments are a complex topic. We felt we could start by providing some metrics and information to those looking at using anything from the Fleet <a...

Fleet 4.13.0 Fleet 4.13.0 | Security fixes, policy automations for teams, and aggregated macOS versions for MacAdmins.Fleet 4.13.0 is here. Check out the full changelog or continue reading to summarize what’s new.For update instructions, see our upgrade guide in the Fleet docs.HighlightsSecurity fixesPolicy automations for teams.Aggregated macOS versions for...

Do Macs Need Third-Party Antivirus for SOC 2 Compliance? Can macOS' built-in anti-malware protection meet SOC 2 compliance requirements? If true, can Osquery play a role in compiling the evidence needed for the auditors?

Q1 ’2022 Quarterly Threat Bulletin The Uptycs threat research team regularly monitors the TTPs (tactics, techniques and procedures) of the latest malware using our threat intelligence sources and systems. Organizations can use this bulletin as a tool to evaluate and form a more robust detection and protection posture against the latest threats in Windows, Linux and macOS platforms.

Kolide Now Fully Supports Slack Enterprise Grid Starting today, Kolide's Slack application now fully supports Slack Enterprise Grid.

KurayStealer: A Bandit Using Discord Webhooks Research by: Ashwin Vamshi and Shilpesh Trivedi

What Is Network Segmentation? Network segmentation is the process of dividing a computer network into subnets, each of which is isolated from the others. The purpose of this is to improve security and performance by keeping traffic local to each subnet. This way, if one subnet is compromised, the others will remain secure.

Business Password Management for Storing and Sharing Credentials See how to implement business password management best practices for storing and sharing passwords securely to strengthen your organization's security.

What Is Network Segmentation? Network segmentation is the process of dividing a computer network into subnets, each of which is isolated from the others. The purpose of this is to improve security and performance by keeping traffic local to each subnet. This way, if one subnet is compromised, the others will remain secure.

What Is Network Segmentation? Network segmentation is the process of dividing a computer network into subnets, each of which is isolated from the others. The purpose of this is to improve security and performance by keeping traffic local to each subnet. This way, if one subnet is compromised, the others will remain secure.

What Is Cyber Threat Hunting? The process of proactively searching through networks and datasets to detect and respond to advanced cyberthreats that evade traditional rule or signature based security controls, Proactive Cyber Threat Hunting uncovers malicious actors that have slipped past initial endpoint security defenses.    Businesses in every industry and governments in every nation are acutely aware...