Enterprises that integrate security testing into their CI/CD pipeline fix 91.4 percent of new issues, according to a progress report from ShiftLeft. Recent software supply chain attacks illustrate the growing risks businesses, their partners, and customers face. But a recent report suggests better outcomes for those who put security at the heart of app development. Data from […]
With a shortage of four million cybersecurity workers, we need to get more creative in identifying non-technical skills among potential candidates that can be applied to the cybersecurity realm. One way is to test them for aptitude and personality traits, like the career planning tests I took in college.That’s what the University of Maryland did […]
In 2020, cyber criminals used cloud applications, the cover of a pandemic, and a newly embraced work-from-home culture to serve up ransomware, steal data, and disrupt how companies do business. The year is over, but the challenges and risks remain. How do we prevent these criminals from injecting chaos into our hybrid work environments? As […]
Security starts before detection and response, but many organizations focus there first. Mature security teams understand the importance of identification and protection. Establishing good cyber hygiene and taking proactive measures to secure themselves against the ever-increasing threat landscape is a critical first step in a holistic security program. How should organizations build a holistic security […]
The Biden Administration’s Cyber Executive Order includes a Software Bill of Materials (SBOM), an electronically readable format designed to provide an inventory of third-party components that make up software components. It is a critical and necessary first measure for protecting the software supply chain, but is it enough?One of the biggest challenges to supply chain transparency […]
Preventing breaches begins with understanding and protecting your attack surface. For most enterprises, their attack surface is huge. To help wrangle it, security professionals have struggled for years to use tools such as network mapper (nmap) or vulnerability scanners to discover and test the security of internet-exposed assets; these typically present a path of least […]
While 2021 will, unfortunately, play host to a wide variety of threats, it’s unlikely any factor will feature more prominently than cryptocurrency. Two types of attacks leverage cryptocurrency directly: extortion and cryptojacking. Before cryptocurrency, cybercriminals worked a lot harder to get paid a lot less. Turning stolen personal information or credit cards into a paycheck […]
Application security has become a complex, distributed problem. During the days of waterfall development and monolithic applications, application security was pretty straight forward – statically scan your source code, dynamically test your business logic, and deploy a web application firewall to protect layer 7 traffic. But with agile development, DevOps processes, and containerized applications, application […]
The introduction of containers and micro-service architectures have changed the way we develop, deploy, and run our applications. Not only has this changed application development, but it’s also created some visibility challenges for application security. Move those applications to the cloud and we only amplify those challenges. How do we architect our cloud services and […]
The MITRE ATT&CK Framework is widely recognized as instrumental in providing a common language and framework for describing attack techniques and effectively sharing information across organizations. However, we’re just starting to see the potential benefits this matrix can provide when integrated directly into security tools. Uptycs recently announced a major release of its product that […]
