Playwright: A Modern, Open Source Approach to End-To-End Testing
I was excited when I started writing my first end-to-end tests years ago. The idea was promising; create an automated test suite that spins up a browser and mimics your user’s behavior. Test your website end-to-end. Frontend, backend, your database—you name it. All these automated tests would cover everything! Unfortunately, it wasn’t all roses and […]
Federal Agencies Share DevSecOps Guidelines
The National Security Agency (NSA), Cybersecurity and Infrastructure Security Agency (CISA), and the Office of the Director of National Intelligence (ODNI) have published a set of DevSecOps best practices based on the Enduring Security Framework (ESF). Developed by a public-private cross-sector working group led by NSA and CISA, the ESF framework was created in the wake […]
Supply Chain Security: Has the Next SolarWinds Already Happened?
More than two years after the now-infamous hack of the firm SolarWinds, the incident is very much in the foreground of conversations about cybersecurity defense, threat detection and incident response. As evidence of that: The SolarWinds incident was the subject of five separate talks and panels at the recent RSA conference in San Francisco. Dozens […]
The Missing Link in DevOps Cloud Security
We’ve all seen the data from the latest Verizon Data Breach Incident Report that shows half of security breaches stem from credential abuse. It’s clear that credential compromise is an epidemic in cybersecurity and can be largely avoided with multifactor authentication and least-privilege policies. Misused credentials have shot up by almost 30% over the last […]
Why DevOps Teams Need Security Engineers
In the episode of View with Vizard, Mike Vizard sits down with Om Vyas, chief product officer for oak9, as he explains why security engineers need to become part of every DevOps team. The video is below followed by a transcript of the conversation. Vizard: Hey, guys. Thanks for the throw. We’re here with Om […]
Avoiding Security Review Delays
In the summer of 2021, I had lunch with a senior security developer at one of Seattle’s leading tech firms. Even though we were relaxed in the sunny and cool afternoon of the Pacific Northwest, there was no doubt my friend was frustrated. Part of his job was running code through a popular scanning product […]
Cycode Expands Scope of AppDev Security Platform
At the Black Hat USA 2022 conference, Cycode this week announced it has added static application security testing (SAST) and container scanning capabilities to its software composition analysis (SCA) platform that is based on a graph database. Amnon Even-Zohar, director of product management for Cycode, said the addition of these tools brings to eight the total […]
What GitHub’s 2FA Mandate Means for Devs Everywhere
Multifactor authentication (MFA) is becoming increasingly standard within software development organizations, with GitHub recently announcing that two-factor authentication (2FA) will be mandatory for all code contributors by the end of 2023. This is a smart move. In recent years, bad actors have frequently initiated attacks by accessing source code through the use of stolen developer […]
GitHub Brings 2FA to JavaScript Package Manager
GitHub has made generally available a two-factor authentication tool for the package manager for JavaScript applications maintained by its NPM, Inc. arm. In addition, all npm packages have been re-signed and there is now an npm command line interface (CLI) command to audit package integrity. Finally, GitHub has added the ability to connect GitHub and […]
CREST Defines Quality Verification Standard for AppSec Testing
At the Black Hat USA 2022 conference, CREST today shared a quality assurance verification standard to improve application security testing. The standard is based on the open source framework defined by the Open Web Application Security Project (OWASP). Tom Brennan, executive director for Americas at CREST, said the OWASP Verification Standard (OVS) measures an organization’s […]
IBM Unveils Simulation Tool for Attacking SCM Platforms
At the Black Hat USA 2022 conference, IBM today revealed it is making available a toolkit for launching simulated attacks against source code management (SCM) platforms. The toolkit was launched as a proof-of-concept. Brett Hawkins, head of adversary simulation for the X-Force Red arm of IBM Security, said the SCMKit takes advantage of the REST […]
The Everything-As-Code Revolution and the OWASP Top 10
After years of stagnation, the Open Web Application Security Project (OWASP) Top 10 list finally saw some shakeup. Most notably, insecure design debuted on the list as the number four security risk to web applications. “If we genuinely want to ‘move left’ as an industry, it calls for more use of threat modeling, secure design […]
JFrog Aligns With AWS to Improve Cloud Application Security
At the AWS re:Inforce event this week, JFrog announced it integrated its JFrog Xray software composition analysis tool with AWS Security Hub, a cloud security posture management (CSPM) service that alerts IT teams whenever a security issue is detected. In addition, JFrog also announced it is participating in a preview of an AWS Marketplace Vendor […]
Lock Down Your Toolchain
We have done amazing things with Agile and DevOps, increasing IT responsiveness to levels that most people would not have believed and our business counterparts only dreamed of even a decade ago. Think about it—we can check in a single source file and kick off a chain of events that involves half a dozen or […]
Future of DevOps: Trends to Watch
Technology is transforming every aspect of industry, and digitalization and automation have flourished in the past few years. DevOps has established itself as an indispensable software development methodology for successful digital transformation. According to a recent market survey, the DevOps market will exceed $20 billion by 2026, growing at a CAGR of 24.7% from 2019 […]
How DevOps Teams Can Defend Against API Attacks
Remember when ransomware was the main security threat that DevOps teams needed to worry about? Those days are over. Ransomware attacks are certainly still happening, but API security breaches—which increased by a whopping 600% in 2021—are now poised to become the top attack vector for threat actors, according to Gartner. That’s the bad news. The […]
Poor App Remediation Creates a Vicious Vulnerability Cycle
A survey of 200 security professionals found nearly 83% of respondents reported that an increase in the rate at which applications are being deployed has led to an increase in the reintroduction of previously remediated vulnerabilities. The survey, conducted by Waratek, a provider of tools for managing security-as-code, found 93% of the security professionals polled […]
What SASE Means for DevOps Teams
You have probably heard the acronym secure access service edge (SASE), and it’s hard to ignore its impact on the technology industry. SASE is a cool new way to implement networking in hybrid environments, and the most important thing about it is that it bakes security into the network fabric. In plain English—when you plug […]
To Prevent Supply Chain Attacks, Build Secure Code
More than a year after the massive SolarWinds cyberattack, targeted companies continue to feel its ramifications in both reputation and financial cost. Moreover, the global software supply chain remains vulnerable to severe attacks, whether from a hostile nation-state like Russia–now increasingly in the cybersecurity spotlight due to fears of retaliation due to U.S. sanctions–or from […]
Security Compass Makes Visualizing AppSec Threats Simpler
Security Compass this week updated its threat modeling platform for developers to make it easier to surface application security issues. The latest version of SD Elements 2022 adds support for developer-centric threat modeling diagrams, reusable components, more advanced reporting capabilities and 114 more just-in-time training (JITT) modules. In addition, Security Compass has now integrated its […]
Scribe Security Unveils Pair of Tools to Secure Software Supply Chains
Scribe Security today unveiled a Scribe Integrity tool that scans software artifacts to make sure they comply with IT organizations’ security policies before they are integrated into an application. The Scribe Integrity tool authenticates open source and proprietary source code before it is uploaded into a build. It assumes that all artifacts are “guilty” until […]
Styra Unfurls Cloud Service for Implementing Compliance-as-Code
Styra, Inc. today launched an authorization service based on the Open Policy Agent (OPA) software that can be invoked via an application programming interface (API). Torin Sandall, vice president of open source for Styra, said the Styra Run cloud service will make it much simpler to embed enterprise-grade authorization capabilities within applications. Today, developers spend […]
The Other Reasons for Password Management
I try not to write about ongoing work—if it is important enough to blog about then it is important enough to write about in the work product, and blog about something else. But every once in a great while, the need overrides my simple rule. After all, zealous adherence to rules is not really a […]