Security Experts:

long dotted

NEWS & INDUSTRY UPDATES

Zyxel has released patches for a format string vulnerability impacting the firmware of multiple NAS device models. [Read More]
Symantec discovered hardcoded AWS credentials in 1,800 mobile apps and highlighted some instances that show the extent of the potential risks. [Read More]
A group of academic researchers have designed an open source Node.js vulnerability hunting tool that has already identified 180 security flaws. [Read More]
As part of its Open Source Software Vulnerability Rewards Program (OSS VRP), Google is offering bug bounty payouts of up to $31,337. [Read More]
Atlassian said the vulnerability carries a CVSS severity score of 9.9 out of 10 and can be exploited remotely to launch code execution attacks. [Read More]
Password management software firm LastPass has suffered a data breach that led to the theft of source code and proprietary technical information. [Read More]
Texas startup BalkanID scores additional financing for technology in the Identity Governance and Administration (IGA) space. [Read More]
The Paranoid project is meant to test cryptographic artifacts for well-known weaknesses, including programming errors and weak proprietary random number generators. [Read More]
Streaming media startup Plex is scrambling to reset user passwords after a database hack that included the theft of emails, usernames, and encrypted passwords. [Read More]
VMware releases patches to fix an important security flaw in the VMware Tools suite of utilities. [Read More]

FEATURES, INSIGHTS // Application Security

rss icon

Preston Hogue's picture
Today an organization may have thousands of apps on the internet, but having thousands of monolithic security devices just isn’t practical.
Dan Cornell's picture
Security cannot exist in a vacuum – it must be integrated with the entirety of an organization’s strategy when it comes to securing development operations.
Travis Greene's picture
Shadow IT 2.0 is a symptom of a bigger problem – the inability to maintain digital competitive advantage due to the insufficient pace of code deployment.
Jim Ivers's picture
Savvy organizations have learned how to use a mix of static and dynamic application security testing types to increase their coverage and lower their risk.
Dan Cornell's picture
When security teams can assess brand, financial, strategic risks – they are best able to act as a trusted advisor to DevOps teams as they build and maintain secure systems.
Travis Greene's picture
2017 is the year for information security teams to align to the work being done in DevOps – whether you call it DevSecOps or not.
Lance Cottrell's picture
OODA loop is a well established concept often used in security which originated in the military. OODA stands for Observe, Orient, Decide, Act.
Jim Ivers's picture
Hackers are human. Hopefully that doesn’t surprise you too much. Being human means that they are subject to human tendencies, like taking the path of least resistance.
Jim Ivers's picture
Aside from tools, there are many types of application security testing that can be used to find vulnerabilities in software. An organization must consider multiple software security testing methods to really manage its risk.
David Holmes's picture
Considering that you can find vendors, startups, and specialists in any of these 28 application security technologies, is it realistic to expect any one person to be a subject matter expert in all of them?