Sharon Goldberg
@goldbe
Followers
4K
Following
2K
Media
210
Statuses
4K
ceo @getBastionZero. infosec researcher and professor @BUCompSci https://t.co/Csj18OQi16 mastodon:: @[email protected]
Boston
Joined April 2009
@RSAConference @getBastionZero This was such a great moment for our team @getBastionZero! Here's the video of my 3-min pitch about BastionZero, which placed 2nd amongst hundreds of startups at the #RSAC 2022 innovation sandbox. https://t.co/nOKg5soE58
1
3
7
New blog post from me!
We read NIST’s new guidance on “Implementing a Zero-Trust Architecture” so that you don’t have to. Read this to get the key points on the newly-released NIST Special Publication 1800-35.
0
2
3
This reaction. 💙 Alisa Efimova & Misha Mitrofanov end their free skate and receive a standing ovation from the Boston crowd. #WorldFigure 📺 USA Network
9
66
549
They are missed 🕊️
One of my favorite pairs programs in my early days of figure skating fandom - Evgenia Shishkova/Vadim Naumov were playful in their musicality, original in their lifts, and phenomenal in their line. They won 1994 Worlds with this fun free skate
0
0
1
It's live! 🎉
Access for Infrastructure, will enable organizations to apply #ZeroTrust controls to their servers, databases, Kubernetes clusters, and more. Today we’re announcing short-lived SSH access as the first available feature of this integration.
1
0
15
SQL injection, sadly still relevant in 2024. It's the topic of "Lecture 2" of my "Intro to Infosec" course at @BUCompSci today (and has been for the last 10 years).
In April, @samwcyo and I discovered a way to bypass airport security via SQL injection in a database of crewmembers. Unfortunately, DHS ghosted us after we disclosed the issue, and the TSA attempted to cover up what we found. Here is our writeup: https://t.co/g9orwwgoxt
0
0
1
Congratulations to @goldbe and the BastionZero team!
With immense gratitude and excitement, I’m thrilled to announce that BastionZero is now part of Cloudflare! This is an incredible opportunity to take our tech to the the next level as we deeply integrate into the world’s largest SASE network. Watch this space!
1
1
12
Excited to share that @Cloudflare has acquired @getBastionZero, expanding the scope of Cloudflare’s VPN replacement solution beyond apps and networks to infrastructure. Welcome to the team!
blog.cloudflare.com
We’re excited to announce that BastionZero, a Zero Trust infrastructure access platform, has joined Cloudflare. This acquisition extends our Zero Trust Network Access (ZTNA) flows with native access...
7
8
84
Congratulations to @getBastionZero and @Cloudflare, as they join forces to help more IT and security teams provide zero-trust access to their servers and other infrastructure! We tip our hats to @goldbe and @Ethan_Heilman, the incredible co-founders of BastionZero. 👏
Excited to share that @Cloudflare has acquired @getBastionZero, expanding the scope of Cloudflare’s VPN replacement solution beyond apps and networks to infrastructure. Welcome to the team!
1
3
10
With immense gratitude and excitement, I’m thrilled to announce that BastionZero is now part of Cloudflare! This is an incredible opportunity to take our tech to the the next level as we deeply integrate into the world’s largest SASE network. Watch this space!
15
6
86
.@getBastionZero CEO @goldbe is teaming up with Cisco's @rlbarnes to solve a problem relevant to the #OpenPubkey community. Check out the blog below to learn more about their vision for Proof of Issuer Key Authority (PIKA).
bastionzero.com
0
3
4
Our CEO @goldbe and @rlbarnes from Cisco are excited to introduce PIKA: Proof of Issuer Key Authority to solve a problem relevant to #OpenPubkey #oidc and JWT (JSON Web Tokens). Learn more in our latest blog: https://t.co/uvFKJFda15
bastionzero.com
0
2
4
I really like this new blog explaining how to generalize #openpubkey to any Identity Provider.
Post explaining how we used Guillou-Quisquater (GQ) signatures add @gitlab CI/CD support to OpenPubkey This cryptographic combability trick allows #OpenPubkey to support all sorts of identity providers we never thought we could support. https://t.co/XZ4gW8sE1D
0
0
3
"Tracked as CVE-2024-3400, the issue has a CVSS score of 10.0, indicating maximum severity. "
thehackernews.com
Critical security flaw found in Palo Alto Networks firewalls. Hackers are already taking advantage.
0
0
0
Monster release from our #OpenPubkey team!
BastionZero is proud to announce a new release of #OpenPubkey (Release v0.3.0), probably the biggest release we've ever done. The release is packed with 44 PRs from 10 different contributors at @getBastionZero, @Docker, and others. Read more.
0
2
6
v0.3.0 release of OpenPubkey is out. Thanks to everyone who contributed, this is probably the biggest release we've ever done. https://t.co/VH1Cby1T5y
github.com
What's Changed Allow setting op signature type on pk token creation by @lgmugnier in #63 Perform blinded ModInverse and replace big.Int with bigmod.Nat where needed by @johncmerfeld in #67 Add...
0
3
6
@ietf We're still digesting all the different ways that PIKAs can be used to improve the security of OIDC, SSO or software supply chain security applications. Please get in touch if you have any feedback on our new @ietf draft! https://t.co/r4KglgXCNj
0
1
2
@ietf PIKAs also allow verification of JWTs, ID Tokens and other OIDC tokens without querying the OP directly. Use PIKAs to reduce the load on a OP, or to build software #supplychain applications that need historical information about OP keys.
1
1
1
In this new @ietf draft, we introduce the PIKA and show how it can be combined with a timestamping authority to allow #OpenPubkey PK Tokens to be used even after the OP rotates it signing key. https://t.co/HTcC7vIwTt
1
1
1
This is where the PIKA comes in. A PIKA is a secure object that allows you to cache an OP's key, and verify using the OP's key even if the OP is offline.
2
1
1
OpenPubkey uses PK Tokens to allow an OpenID Provider (OP) to bind user identities to user-held public keys. Tokens are signed by the OP's signing keys. But, OP's rotate their signing keys over time. What happens if we need to use a PK Token *after* the OP rotates signing key?
1
1
2