Software Security Guide
Securing an application is just as important as building it in the first place. As data becomes more valuable, there are more people who want to steal it and use it for their own personal gain.
Making sure applications are indeed secure has always been a challenge, as hackers try to stay one step ahead of defenders. When organizations ran their applications in their own data centers, firewalls were an effective way of denying hackers access. The explosion of the Internet led to the creation of web applications, with entry points via the browser into client-side code that could endanger the organization.
Further, the increased speed of feature delivery in software stresses security teams trying to prevent hacks and data breaches. Today, with application modularity and edge computing increasing, along with the increased use of open-source software, that challenge has only become more difficult. Hackers now have more surface area to target than ever before. Here are the top threats organizations face as they work to secure their applications, data and systems.
IT and developers must work to ensure that their applications and systems are secure. On the development side, security touches nearly every step of the process, from the planning stage, development, to testing. The use of automation in security can help organizations stay one step ahead.
Microsoft turns to Rust for safer code
Microsoft is starting to explore new programming languages to protect against security vulnerabilities. The company revealed it is turning to the systems programming language Rust to help developers build more reliable and efficient software. Microsoft has long turned to languages like C++ and C# in their security efforts. C# has helped protect against memory corruption … continue reading
Orasi Software and Saltworks Security enter into partnership with open source security leader Sonatype
Orasi Software, a DevOps technology and consulting firm that ensures confident delivery of transformative applications that grow and simplify business, today announced that Orasi and Saltworks Security, an Orasi Company, have entered into a cooperative partnership with Sonatype, an innovator in open source code governance. For the partnership, Orasi and Saltworks will promote Sonatype’s open … continue reading
A developer’s guide to key storage providers
As a developer, you specialize in code – not security. However, as DevOps continues to blend roles and responsibilities, the typical software developer has become responsible for more and more operational aspects like security. A core component of application and IoT security is code signing. Let’s start with a basic definition. Code signing is a … continue reading
Report: Not all open-source software is created equal
While open-source software is an integral part of software development today, security continues to be an issue. A recently released report revealed a 71 percent increase in open-source security related breaches over the last five years. In addition, 25 percent of organizations reported a confirmed or suspected open-source software related breach. RELATED CONTENT: Open source … continue reading
SD Times news digest: GitHub acquires Pull Panda, Cloudflare introduces advanced cryptographic library, and Raspberry Pi 4 Model B
GitHub acquired Pull Panda to help teams create more efficient and effective code review workflows on GitHub. The financial terms were not revealed by the companies. According to the company, Pull Panda advances code reviews through Pull Reminders,which sends a notification through Slack when a collaborator needs review; Pull Analytics, which offers real-time insight into … continue reading
GitLab turns its focus to DevSecOps
GitLab is taking the next steps in its DevOps initiative with the announcement that it is integrating security into its single application. The company is also releasing auto remediation, security dashboards and plans to release security approvals in an upcoming update. “The advantages of a single application are numerous: A single sign-on eliminates the need … continue reading
Google adds new level of privacy and insight to data with open-source project
Google has announced the open-source availability of its Private Join and Compute project. Private Join and Compute is a type of secure multi-party computation designed to help organizations work with confidential data sets. The project is a part of the company’s mission to help organizations do more with data while keeping users’ data as safe … continue reading
HackerOne: The top 10 security vulnerabilities
Companies are paying the highest amount of bounties to fix cross-site scripting (XSS), improper authentication and information disclosure vulnerabilities. Meanwhile, some cloud-based vulnerabilities such as server-side request forgery (SSRF), in which an attacker can abuse functionality on the server to read or update internal resources, are seeing an uptick in bounties. This is according to … continue reading
Top roadblocks to securing web applications
In recent weeks, data breaches seem to have suddenly become more widespread and far reaching across the globe. In Australia, the Office of the Australian Information Commissioner (OAIC) revealed more than 10 million individuals had their information compromised in a single incident. In Singapore, thousands of Red Cross blood donors had their personal information leaked. … continue reading
Report: More than 50 percent of data remains in the dark
A majority of organizations are vulnerable to hack attacks because they are still in the dark when it comes to their data. A newly released report reveals more than half of all data within organizations remains unclassified or untagged, which results in an organization’s inability to assess the risk or value of more than half … continue reading
SD Times news digest: New guidelines for Apple’s App Store, IOActive and Bugcrowd team up to identify security gaps, and Firefox’s default Enhanced Tracking Protection
Apple is changing its requirements for applications on its App Store to protect user data. Apps in the kids category, VPNs, health or fitness apps will no longer transmit data to third parties and MDM apps, and other apps can only collect data after requesting permission from the user. Additionally, apps in the kids category … continue reading
A guide to DevSecOps offerings
Contrast Software Contrast Assess produces accurate results without dependence on application security experts, using deep security instrumentation to analyze code in real time from within the application. It scales because it instruments application security into each application, delivering vulnerability assessment across an entire application portfolio. Contrast Assess integrates seamlessly into the software lifecycle and into … continue reading
