Abstract: A vulnerability with respect to a file in a continuous integration (CI) pipeline can be suppressed according to some aspects described herein. For example, a computing system can determine that the vulnerability is suppressible. In response to determining the vulnerability is suppressible, the computing system can automatically adjust a status of the vulnerability from an observed state that prevents deployment of the file to a suppressed state that allows the deployment of the file. The computing system additionally can determine a security risk of deploying the file. The suppressed state of the vulnerability can exclude the vulnerability from the determination of the security risk. The computing system can deploy the file in the CI pipeline subsequent to automatically adjusting the status of the vulnerability to the suppressed state.

Abstract: A vulnerability with respect to an image file in a continuous integration (CI) pipeline can be suppressed according to some aspects described herein. For example, a processor can receive an alert for the vulnerability with the CI pipeline being able to block deployment of the image file in response to the alert. Based on the alert, the processor can determine that the vulnerability of the image file is deferrable. After determining that the vulnerability is deferrable, the processor can automatically adjust a status of the vulnerability from an observed state to a deferred state. The CI pipeline can allow the deployment of the image file based on the status of the vulnerability being in the deferred state. The processor can deploy the image file in the CI pipeline after adjusting the status of the vulnerability to the deferred state.

Abstract: A vulnerability with respect to an image file in a continuous integration (CI) pipeline can be suppressed according to some aspects described herein. For example, a processor can receive an alert for the vulnerability with the CI pipeline being able to block deployment of the image file in response to the alert. Based on the alert, the processor can determine that the vulnerability of the image file is deferrable. After determining that the vulnerability is deferrable, the processor can automatically adjust a status of the vulnerability from an observed state to a deferred state. The CI pipeline can allow the deployment of the image file based on the status of the vulnerability being in the deferred state. The processor can deploy the image file in the CI pipeline after adjusting the status of the vulnerability to the deferred state.

Abstract: Systems and corresponding computer-implemented methods for context-based rule evaluation in an electronic data storage system are described. A request to perform an operation with respect to a resource is received from a client device, with the request including various attributes associated with the client device. At least one set of rules applicable to the operation is identified. The rules can be formed from a combination of primitives arranged to dynamically evaluate attributes associated with the resource and attributes associated with the client device. Based on the evaluation of the rule set(s), an action is identified to be performed with respect to the resource.

Abstract: Techniques are described for separating subdomains as part of a secure login process. For example the subdomains can correspond to an enterprise user or personal user accounts, or both. The login process involves responding to a login request with an assertion, such as for example a redirect based assertion, that includes an encrypted data structure with account and user information necessary for identification of the corresponding subdomain. The encrypted data structure includes browser-, IP address, and user-specific information to thwart a cross-site request forgery (CSRF) security vulnerability, among other things.

Abstract: Techniques are described for separating subdomains as part of a secure login process. For example the subdomains can correspond to an enterprise user or personal user accounts, or both. The login process involves responding to a login request with an assertion, such as for example a redirect based assertion, that includes an encrypted data structure with account and user information necessary for identification of the corresponding subdomain. The encrypted data structure includes browser-, IP address, and user-specific information to thwart a cross-site request forgery (CSRF) security vulnerability, among other things.

Abstract: Systems and corresponding computer-implemented methods for context-based rule evaluation in an electronic data storage system are described. A request to perform an operation with respect to a resource is received from a client device, with the request including various attributes associated with the client device. At least one set of rules applicable to the operation is identified. The rules can be formed from a combination of primitives arranged to dynamically evaluate attributes associated with the resource and attributes associated with the client device. Based on the evaluation of the rule set(s), an action is identified to be performed with respect to the resource.