Software Security Guide

Securing an application is just as important as building it in the first place. As data becomes more valuable, there are more people who want to steal it and use it for their own personal gain.

Making sure applications are indeed secure has always been a challenge, as hackers try to stay one step ahead of defenders. When organizations ran their applications in their own data centers, firewalls were an effective way of denying hackers access. The explosion of the Internet led to the creation of web applications, with entry points via the browser into client-side code that could endanger the organization.

Further, the increased speed of feature delivery in software stresses security teams trying to prevent hacks and data breaches. Today, with application modularity and edge computing increasing, along with the increased use of open-source software, that challenge has only become more difficult. Hackers now have more surface area to target than ever before. Here are the top threats organizations face as they work to secure their applications, data and systems.

IT and developers must work to ensure that their applications and systems are secure. On the development side, security touches nearly every step of the process, from the planning stage, development, to testing. The use of automation in security can help organizations stay one step ahead.


Backslash updates AppSec solution with new integrations, support for additional languages

AppSec company Backslash Security has announced new capabilities to better detect security issues in applications. Backslash utilizes a number of security scanning capabilities to uncover potential issues, including SCA, SAST, SBOM, VEX, and secrets detection.  It now integrates with GitHub Enterprise On-Premise, GitHub Enterprise Server, GitLab On-Premise, and Bitbucket On-Premise.  By offering integration into more … continue reading

GitLab 17 introduces GitLab Duo Enterprise and new CI/CD catalog

GitLab has announced the latest version of its platform. GitLab 17 introduces new features such as GitLab Duo Enterprise, a new CI/CD catalog, and Native Secrets Manager. GitLab Duo Enterprise is a new AI add-on that builds on the capabilities of GitLab Duo Pro. It can be used to detect and fix security issues, summarize … continue reading

GitHub announces new updates to improve supply chain security

GitHub has released two updates designed to help secure software supply chains. The company announced a public beta of Artifact Attestations for GitHub Actions, which makes it easier for companies to verify where software components came from, and announced that Dependabot can now be run as a GitHub Actions workflow.  Artifact Attestation allows maintainers of … continue reading

OpenText releases new browser extension that verifies if open source libraries meet company security policies

OpenText is releasing a new solution, Open Source Select, designed to help developers find open source libraries that comply with their organization’s security policy.  Developers can search for open source libraries and will be shown only the results that they can actually use. According to OpenText, this helps cut down on the time spent looking … continue reading

The key to successful secrets management is to make the best way the easiest way

Most organizations understand the value of secrets management — which is the practice of securely storing development credentials like API keys, certificates, and SSH keys — but not all organizations are following secure secrets management practices. According to the secrets management provider Bitwarden’s 2024 developer survey, which polled 600 developers across different industries, 86% of … continue reading

Red Hat Trusted Software Supply Chain gets updated with three new offerings

Red Hat is expanding its Red Hat Trusted Software Supply Chain solution with new offerings that will enable customers to ensure software components are verified and secured.  The first new addition is Red Hat Trusted Artifact Signer, now generally available, which allows developers to cryptographically sign and verify application artifacts with a keyless certificate authority.  … continue reading

Report: Java is the language that’s most prone to third-party vulnerabilities

According to Datadog’s State of DevSecOps 2024 report, 90% of Java services have at least one or more critical or higher severity vulnerabilities.  This is compared to around 75% for JavaScript services, 64% for Python, and 50% for .NET. The average for all languages studied was 47% The company found that Java services are also … continue reading

Implement a good secrets management practice to reduce your security risk

Supply chain security has been a big topic of conversation over the past several years, and while many of the conversations have revolved around insecure third-party components in codebases, there’s another part of the supply chain that could have a negative impact if not secured properly: secrets.  Max Power, product lead for Bitwarden Secrets Manager, … continue reading

Synopsys hopes to mitigate upstream risks in software supply chains with new SCA tool

Synopsys has released a new solution to help companies manage upstream risks of software supply chains. Black Duck Supply Chain Edition does software composition analysis (SCA) that makes use of a number of security analysis techniques to determine the components in a piece of software, such as package dependency, CodePrint, snippet, binary, and container analysis.  … continue reading

premium The importance of security testing

With more development teams today using open-source and third-party components to build out their applications, the biggest area of concern for security teams has become the API. This is where vulnerabilities are likely to arise, as keeping on top of updating those interfaces has lagged. In a recent survey, the research firm Forrester asked security … continue reading

Open source in 2024: Tackling challenges related to security, AI, and long-term sustainability

The first piece of open source code was published just over 70 years ago, and now open-source software finds itself in almost every application that exists today.  A 2024 report from Synopsys found that the average application has over 500 open source components in it, and most recent industry reports show that over 95% of … continue reading

Google Safe Browsing now performs real-time checks in privacy-preserving manner

Google has announced a new way to further protect its privacy-minded users who are browsing using Google Safe Browsing, which is a Google Search setting that warns users when they may be entering a potentially dangerous site.  While it has warned users about harmful sites across 5 billion devices since its launch 15 years ago, … continue reading

1 2 3 72 Protection Status