Security Experts:

long dotted

NEWS & INDUSTRY UPDATES

VMware announces significant enhancements, including in security, to its Virtual Cloud Network offering. [Read More]
Achieving a genuine DevSecOps environment is not easy. Speed in code generation (DevOps) is a different requirement to security in code generation, and one can hinder the other. [Read More]
Misconfiguration in JIRA project management software results in thousands of companies’ filters, dashboards and staff data being publicly exposed. [Read More]
Hackers have managed to compromise 62 colleges and universities by exploiting a vulnerability in the Ellucian Banner system. [Read More]
BlackBerry Cylance has prepared an update to address a recently disclosed bypass of its AI-based antivirus, but the company has downplayed its impact. [Read More]
Researchers claim they can trick Cylance’s AI-based antivirus into believing a malicious file is benign by appending certain strings to it. The vendor has launched an investigation. [Read More]
Of 4,000 software professionals surveyed by GitLab, 69% of developers are aware they’re expected to write secure code, but nearly half of security pros say it’s hard to get developers to make vulnerability remediation a priority. [Read More]
The Magecart hackers have managed to infect over 17,000 domains by targeting improperly secured Amazon S3 buckets, RiskIQ reports. [Read More]
The Forum of Incident Response and Security Teams (FIRST) announces CVSS v3.1, which aims to simplify and improve upon CVSS v3.0. [Read More]
U.S. Coast Guard recently warned commercial vessel owners and operators of malware and phishing attacks and potential vulnerabilities in shipboard systems. [Read More]

FEATURES, INSIGHTS // Application Security

rss icon

Travis Greene's picture
While GDPR doesn’t require encryption, there are four mentions of encryption in GDPR that provide real incentives for organizations to use encryption.
Alastair Paterson's picture
A confluence of factors is putting hundreds of thousands of implementations of Enterprise Resource Planning (ERP) applications at risk of cyber attacks.
Jim Ivers's picture
Applications contain three specific components where vulnerabilities can be found, and each must be tested in a different way for security testing to be complete.
Dan Cornell's picture
As you start to get an idea of what your application portfolio looks like, you then need to start determining the specific risks that applications can expose your organization to.
Alan Cohen's picture
From a security perspective, to create understand application dependencies you need not only to understand the flows and servers, you need to understand the ports and underlying processes.
Preston Hogue's picture
Today an organization may have thousands of apps on the internet, but having thousands of monolithic security devices just isn’t practical.
Dan Cornell's picture
Security cannot exist in a vacuum – it must be integrated with the entirety of an organization’s strategy when it comes to securing development operations.
Travis Greene's picture
Shadow IT 2.0 is a symptom of a bigger problem – the inability to maintain digital competitive advantage due to the insufficient pace of code deployment.
Jim Ivers's picture
Savvy organizations have learned how to use a mix of static and dynamic application security testing types to increase their coverage and lower their risk.
Dan Cornell's picture
When security teams can assess brand, financial, strategic risks – they are best able to act as a trusted advisor to DevOps teams as they build and maintain secure systems.