Static application security testing (SAST) plays a major
role in securing the software development lifecycle (SDLC).
Unlike dynamic application security testing (DAST), where
you need the system running to interact with it, SAST
works at the source code level prior to compiling. SAST
can address issues at the...
Security champions bridge the gap between security and development teams. Both of these teams want to deliver secure applications at the speed that the business demands, but traditionally, security practices are added into the SDLC without scaling knowledge and practices through development teams. This creates...
Cloud native applications don’t just run on a different platform; they
overhaul the scope of the applications, the methodologies with
which they’re built, and the skills and ownership around them. To
stay relevant, security practices need to undergo a transformation of
a similar magnitude. We have to embrace a...
The state of the art application security tool needs to combine the power of SAST and
DAST, with a focus on integrating security into the SDLC as early as possible. Additionally, the
tool needs to be developer-first — fast, seamless, contextualized, prioritized — in order to drive
adoption. And finally, it...
Researchers at Cider Security have uncovered a security loophole in GitHub Actions that allows adversaries to bypass the required reviews mechanism and push unreviewed code to a protected branch, allowing it into the pipeline to production.
As digital business and remote work become the new normal, organizations recognize their increasing
exposures to cyberattacks and the need to refactor their security strategies accordingly. In response to this
new landscape several key factors are influencing the demand for an inhouse Malware Lab,...
In an effort to bolster endpoint protection within the U.S. government, the White House is ordering federal agencies to allow CISA to access existing deployments. It is also setting timelines for improving the protection of workstations, mobile phones and servers.
Mobile applications have become a nearly ubiquitous offer from Financial Services organizations. While many banks employ defense in depth security protections at their perimeter, a surprising number do not shield their mobile apps from attack. Application Shielding protects banks and consumers by obfuscating code in...
A congressional letter sent to the heads of four federal agencies expressed an urgent need for the Biden administration to continue combating ransomware. This includes a particular focus on the cryptocurrency infrastructure that is enabling these cyberattacks, four Democratic lawmakers say.
Criminal hackers don't break for lunches, weekends or holidays. Of course, that's just one of many challenges facing information security teams, as they attempt to maximize visibility and minimize complexity while protecting their business around the clock, says Peter Van Lierde, the CISO of energy firm Sibelga.
Some 14,000 Google users were warned of being suspected targets of Russian government-backed threat actors on Thursday. The next day, the tech giant announced cybersecurity updates - particularly for email accounts of high-profile users, including politicians and journalists.
Microsoft, in its annual threat review report, Digital Defense, says 58% of cyberattacks worldwide over the past year originated in Russia. And 92% of the Russia-based threat activity came from the nation-state threat group Nobelium.
The number of breach reports filed by U.S. organizations looks set to break records, as breaches tied to phishing, ransomware and supply chain attacks keep surging, the Identity Theft Resource Center warns. It says that there's also been a rise in tardy breach notifications containing little detail.
In the latest weekly update, four editors at Information Security Media Group discuss important cybersecurity issues, including the importance of product security, the impact of ransomware on healthcare sector entities during the pandemic and thinking about cybersecurity awareness creatively.
Apache HTTP Server users are being warned to install yet another patch, as a fix released Wednesday was incomplete and introduced a new flaw. The U.S. Cybersecurity and Infrastructure Security Agency has urged all users to update immediately, citing in-the-wild attacks exploiting Apache's software.