Mac server security

What the leak news feed watches

Enfour's Security Watch reads 48 sources around the clock, in English, Japanese and Korean: national computer emergency response teams, exploited-vulnerability lists, software projects' own announcements and the security press. It keeps only what can reach people who use KeyRotate or FrontierStack, and a person reads, checks and signs every advisory before it is sent. When the original notice is in Japanese or Korean, that language's advisory follows the original wording and the other languages are translations of it.

What counts as news

• A breach, leak or forced reset at any of the 419 services KeyRotate keeps keys for, when keys, tokens or logins were, or may have been, taken.
• Security releases of the server software FrontierStack checks on every server: PHP, OpenSSL, OpenSSH, nginx, Apache, Node.js, Python, MySQL, MariaDB, PostgreSQL, Redis.
• Exploited or critical flaws in the network appliances FrontierStack monitors: NetScaler, BIG-IP, FortiGate, PAN-OS, Ivanti, Cisco ASA/FTD, LoadMaster, SonicWall SMA, SonicWall firewall, ShareFile SZC, Check Point, WatchGuard, Zyxel, Array AG, OpenVPN AS.
• Certificate authority compromises, and attacks on the software supply chain (poisoned packages, extensions and updates).

A personal-data leak at a local shop, bank or school, or a flaw in a product our users don't run, isn't sent. Breaches appear on KeyRotate's Leak news; server and appliance advisories go to FrontierStack's Security Updates and Edge Appliances panes.

Where it looks

National CERTs and agencies

• United States: CISA advisories, CISA Known Exploited Vulnerabilities
• European Union: CERT-EU, ENISA EU Vulnerability Database
• Japan: JPCERT/CC, IPA, JVN, JVN iPedia
• Korea: KrCERT/CC, KISA

Exploited-vulnerability and breach lists

• CISA Known Exploited Vulnerabilities, ENISA EU Vulnerability Database (exploited), GitHub Advisory Database (malicious packages), Have I Been Pwned

Software projects' own security announcements

• PHP, Node.js, PostgreSQL

Supply-chain research

• Socket, StepSecurity, Aikido, Wiz

Security news

• in English: BleepingComputer, The Hacker News, Krebs on Security, SecurityWeek, The Record, DataBreaches.net, Dark Reading, Help Net Security, The Register, Ars Technica
• in Japanese: piyolog, Security NEXT, ITmedia, ITmedia NEWS, ITmedia Enterprise, @IT, Mynavi TECH+, ScanNetSecurity, INTERNET Watch
• in Korean: Boan News (보안뉴스), Electronic Times (전자신문), ITWorld Korea, DailySecu (데일리시큐)

Where an advisory may send you to report

When an incident mainly affects people in Japan or Korea, its advisory can point to the official place to report it or get help.

Japan

• JPCERT/CC インシデント報告 — report a security incident (companies and individuals)
• JPCERT/CC インシデント報告の手引き — what to report and how
• IPA コンピュータウイルス・不正アクセス届出 — report threats infection or unauthorised access to IPA
• JVN (Japan Vulnerability Notes) — vulnerability notes for products used in Japan
• JPCERT/CC — Japan's computer emergency response team
• 国家サイバー統括室 サイバー攻撃被害に係る相談・情報提供窓口 — where an organisation hit by a cyberattack can get help and report it
• 警察庁 サイバー警察局 — report cybercrime to the police: account takeover, fraud, ransomware, extortion
• 個人情報保護委員会 漏えい等の対応とお役立ち資料 — a business that leaked customers' personal data must report it to the PPC

Korea

• KISA 118 사이버 상담 — help for individuals: hacking, personal-data leaks, scams (call 118)
• KrCERT/CC 침해사고 신고 — companies report a hacking, ransomware or DDoS incident
• KrCERT/CC 침해사고 신고 안내 — what to report and how
• KNVD 취약점 신고 — report a vulnerability in a product
• 경찰청 사이버범죄 신고시스템 (ECRM) — report a crime to the police: account takeover, fraud, extortion
• 한국인터넷진흥원 (KISA) — Korea's internet security agency