Security Experts:

long dotted

NEWS & INDUSTRY UPDATES

The final version of the ‘OWASP Top 10 - 2017’ has been released, and CSRF and unvalidated redirects didn’t make the list [Read More]
Microsoft uses deep neural networks to improve fuzzing techniques. Tests conducted via AFL fuzzer [Read More]
Following an increase in Android malware and adware abusing accessibility services, Google decides to crack down on apps that misuse the feature [Read More]
Microsoft releases security advisory on how users can protect themselves against attacks leveraging DDE [Read More]
A recently developed system that targets the audio version of Google’s reCAPTCHA challenges can break them with very high accuracy. [Read More]
Google is planning to deprecate and eventually completely remove support for public key pinning (PKP) from the Chrome browser. [Read More]
Microsoft releases Sonar, an open source linting and scanning tool that helps web developers find performance and security issues [Read More]
LokiBot Android banking trojan turns into ransomware if users try to remove it. The gang behind the attack has made more than $1.5 million [Read More]
Kaspersky launches new Global Transparency Initiative, which includes independent source code reviews and bug bounties of up to $100,000 [Read More]
Google is offering a bonus of $1,000 to researchers who find serious vulnerabilities in select Android apps present on Google Play [Read More]

FEATURES, INSIGHTS // Application Security

rss icon

Dan Cornell's picture
As you start to get an idea of what your application portfolio looks like, you then need to start determining the specific risks that applications can expose your organization to.
Alan Cohen's picture
From a security perspective, to create understand application dependencies you need not only to understand the flows and servers, you need to understand the ports and underlying processes.
Preston Hogue's picture
Today an organization may have thousands of apps on the internet, but having thousands of monolithic security devices just isn’t practical.
Dan Cornell's picture
Security cannot exist in a vacuum – it must be integrated with the entirety of an organization’s strategy when it comes to securing development operations.
Travis Greene's picture
Shadow IT 2.0 is a symptom of a bigger problem – the inability to maintain digital competitive advantage due to the insufficient pace of code deployment.
Jim Ivers's picture
Savvy organizations have learned how to use a mix of static and dynamic application security testing types to increase their coverage and lower their risk.
Dan Cornell's picture
When security teams can assess brand, financial, strategic risks – they are best able to act as a trusted advisor to DevOps teams as they build and maintain secure systems.
Travis Greene's picture
2017 is the year for information security teams to align to the work being done in DevOps – whether you call it DevSecOps or not.
Lance Cottrell's picture
OODA loop is a well established concept often used in security which originated in the military. OODA stands for Observe, Orient, Decide, Act.
Jim Ivers's picture
Hackers are human. Hopefully that doesn’t surprise you too much. Being human means that they are subject to human tendencies, like taking the path of least resistance.