DARPA Turns to AI to Help Turn C and C++ Code Into Rust
DARPA will lean on emerging AI capabilities to deal with the costly and time-consuming challenge of rewriting C and C++ code to Rust in a move designed to meet the push for federal agencies and private organizations to adopt memory-safe programming languages.
Survey Finds Speed of Software Deployment Outpacing Security
A survey of 5,315 individual contributors and leaders in development, IT operations and security finds two-thirds (66%) are releasing software faster than they were a year ago.
Report: High Risks to Software Supply Chains are Commonplace
A nine-month analysis of more than 100 million alerts, tens of thousands of code repositories, and 140,000 real-world applications finds 95% of organizations have at least one high, critical, or apocalyptic risk within their software supply chain.
CrowdStrike CEO: 97% of Windows Systems Back Online After Crash
More than 97% of the Windows desktops that were suddenly disrupted a week ago by a problematic software update from CrowdStrike are back online, according to the cybersecurity company’s top executive, but the pain from the worldwide outage will continue to be felt.
Succeeding at DevSecOps Requires a Rubric for SDLC Governance
Now is the time to engage your SDLC stakeholders and begin the journey of securing your development pipelines — the future of your organization’s security depends on it.
Backslash Security Adds Simulation and Generative AI Tools to DevSecOps Platform
Backslash Security today added an ability to simulate upgrades to a higher version of an application to its application security platform for scanning code and creating software bills of materials (SBOMs).
CrowdStrike: Faulty Test Software Led to Global Windows Crash
A tool for validating Rapid Response Content updates to the Falcon software improperly let one with “problematic content” get through.
Secure Code Warrior Unveils Agent to Manage Commit Permissions
Secure Code Warrior (SCW) today added an agent to its portfolio of application security that assesses the security competency of developers as they commit code to a repository.
CrowdStrike Software Update Sparks Microsoft Outage, Global Chaos
Airlines, hospitals, banks and other businesses were disrupted when a faulty software update knocked Windows users of their systems.
Survey Surfaces Troubling Signs of Software Supply Chain Insecurity
A survey of software engineering professions has uncovered disconcerting signs of software supply chain insecurity.
Implementing Threat Modeling in a DevOps Workflow
Integrating threat modeling into the DevOps workflow is essential to identify and mitigate potential security threats.
Report Surfaces Thousands of Potential Vulnerabilities in GitHub Workflows
An analysis of 2.5 million GitHub Actions workflow files belonging to 553,000 organizations and personal users surfaces thousands of potential vulnerabilities.
Helping Developers Build Secure APIs From the Start
Developers are already tasked with creating and managing APIs; they must also be empowered to secure them easily.
Survey Surfaces Lots of Software Supply Chain Insecurity
A global survey of 900 application security professionals finds nearly two-thirds work for organizations that have had their software supply chains compromised in the past two years.
Open-Source Software Community Riled by Yet Another CVE
Another maintainer of an open-source software project has decided to no longer actively update IP address parsing utilities used widely by JavaScript developers.
Aqua Security Shines Spotlight on Secrets Management Blindspots
A report published by Aqua Security finds that as many as 18% of secrets inadvertently exposed are not being discovered.
Most Critical Open Source Projects Lack Memory-Safe Code, CISA Says
The country’s top cybersecurity agency is continuing to urge software developers to adopt memory-safe programming languages to help reduce the number of vulnerabilities in their products.
Orca Security Adds Ability to Scan Source Code for Vulnerabilities
Orca Security this week extended the reach of its cybersecurity portfolio to include an application that scans source code stored in GitHub and GitLab repositories for vulnerabilities.
Ensuring Application Security from Design to Operation with DevSecOps
Safe development is critical for any company that creates software, whether for its own use or for others. DevSecOps principles focus on automating information security processes and introducing security measures early in software development. DevSecOps is extremely important these days as, according to recent surveys, more than 99% of tech professionals report that, on average, […]
Datadog Extends Scope and Reach of Observability Platform
Datadog at its DASH 2024 conference added a bevy of tools and capabilities to streamline DevSecOps workflows, including integration with open-source OpenTelemetry agent software developed under the auspices of the Cloud Native Computing Foundation (CNCF) and the Datadog On-Call tool to optimize incident management workflows in a way that maintains context with observability data already collected.
Decoding DevSecOps: Striking the Right Balance
DevSecOps has promise and pitfalls, and we need a path forward to achieve a balance between speed and security.
From Concept to Reality: How ASPM Brings DevSecOps to Life
Building on the foundation laid by DevSecOps, ASPM represents a leap forward in operationalizing these principles within the CI/CD process.
Survey Surfaces Extent of Web Application Security Crisis
A survey of 349 U.S. and UK cybersecurity professionals finds that while 60% work for organizations that update web applications at least once a week nearly three-quarters (75%) test their web applications monthly or less often.