Veracode Report Shines Spotlight on Massive Application Security Debt
In an analysis of more than a million applications, Veracode found 42% contained flaws that remained unfixed for longer than a year.
OpenText Extends Tool for Auditing Source Code Using Machine Learning
OpenText updated a static analysis code auditing tool using machine learning algorithms to provide deeper insights into on-premises IT environments.
Synopsys Report Sees Steady Application Security Gains
An analysis of the security automation practices of 130 organizations published by Synopsys suggests significant progress toward securing software supply chains.
Lineaje Allies With Persistent Systems on Open Source Software Remediation Service
Lineaje and Persistent Systems are providing a managed service for remediating open source vulnerabilities that leverages AI technologies.
CISA, NSA Issue Supply Chain Security Guidance Report
The NSA, ODNI and CISA have issued guidance to assist software developers and suppliers in shoring up software integrity and security.
Survey Surfaces Software Supply Chain Security Challenges
While there is general agreement on the importance of software supply chain security, there is a significant disconnect on how to achieve that goal.
Checkmarx Surfaces Threat to GitHub Repositories
Checkmarx reported that malicious actors have been able to compromise GitHub’s Dependabot, the free automated dependency management tool for software projects.
What DevOps Teams Should Know About Phishing and the Supply Chain
DevOps engineers are prime targets for phishing as cybercriminals look to infiltrate and disrupt the software supply chain.
Low-Hanging Fruit, 2023 Edition: Part Two
Last time, we discussed setting up a comparative inventory system for your growing API footprint. The idea is that as security catches up to new technology deployments, enterprises will have to step up their game and implement those new technologies. API security is currently the biggest need because of exposure to the world, but not […]
The Cyber Resilience Act Threatens the Future of Open Source
The EU is set to vote on the CRA July 19, 2023. Sonatype’s Brian Fox believes it’s a threat to the future of open source development.
DigiCert Allies With ReversingLabs to Secure Software Supply Chains
DigiCert today announced it has allied with ReversingLabs to integrate binary analysis and threat detection capabilities with a code signing service it provides. Deepika Chauhan, chief product officer for DigiCert, said the addition of these capabilities to the DigiCert Software Trust Manager service would make it simpler for organizations to operationalize a methodology for securing […]
Red Hat Moves to Secure Software Supply Chains
Red Hat today announced a portfolio of cloud services designed to better secure software supply chains. The expanded portfolio includes Red Hat Trusted Application Pipeline to secure continuous integration/continuous delivery (CI/CD) workflows and Red Hat Trusted Content offerings to better secure software components. Announced at the Red Hat Summit, the Red Hat Trusted Software Supply […]
DevOps Security: Your Complete Checklist
In a fast-paced environment like DevOps, your security strategy needs to be even more agile. While moving fast is great for delivering application features and functionality, speed shouldn’t come at the cost of security. DevOps security incorporates security strategies directly into your DevOps pipeline, creating a culture of pre-secured software deployments that work seamlessly for […]
AWS Converts Cedar Policy-as-Code Tool to Open Source Project
At the Open Source Summit North America conference today, Amazon Web Services (AWS) announced it is making Cedar, a language for defining permissions as policies that includes automated reasoning to mathematically prove an IT environment is secure, available as an open source project. In addition, AWS launched SnapChange, an open source fuzz testing tool that […]
ReversingLabs: Increased Focus on Software Supply Chain Security
A global survey of 300 global executives, technology and security professionals found software containing vulnerabilities (82%) followed by secrets leaked through source code (55%), malicious code (52%) and suspicious code (46%) posed a serious risk to the business. Conducted by Dimensional Research on behalf of ReversingLabs, a provider of a platform for securing software supply […]
DORA Report 2022: The Magnitude of Software Supply Chain Security
The term ‘software supply chain security’ (SSC) can be interpreted in many ways. Following the White House executive order in May 2021 and the European Cyber Resilience Act (CRA) of 2022, both governments and corporations are taking a more active role in ensuring their software is secure. Fundamentals such as having a software bill of […]
npm is Scam-Spam Cesspool ¦ Google in Microsoft Antitrust Thrust
In this week’s #TheLongView: The npm registry suffers spam infestation, and Microsoft makes Google sad.
Software Supply Chain Risk Management: A 2023 Guide
Software supply chain risk management (SSCRM) refers to the process of identifying, assessing and mitigating risks associated with third-party software components and services that are integrated into software products. SSCRM involves understanding the potential vulnerabilities that may arise from these components and taking measures to reduce the risk of exploitation or compromise to the software […]
Awareness of Software Supply Chain Security Issues Improves
A global survey of 167 software professionals suggested that, while there is a lot more awareness of application security issues, the adoption of DevSecOps best practices is still not pervasive. The survey, conducted by Chainguard, the Eclipse Foundation, the Rust Foundation and the Open Source Security Foundation (OpenSSF), found that just over half (51%) of […]
Addressing Software Supply Chain Security
It’s essential for organizations to learn more about the software supply chains they rely on and the steps needed to secure them. In just the past few years, we have seen a major uptick in malicious actors exploiting vulnerabilities in software supply chains to facilitate attacks on organizations. However, it’s important to remember that these […]
ReversingLabs Adds Ability to Detect Secrets in Application Binaries
ReversingLabs today announced it added an ability to detect secrets exposed in application binaries to its Software Supply Chain Security (SSCS) platform. Tomislav Peričin, chief software architect for ReversingLabs, said this addition will make it easier for DevSecOps teams to identify secrets that are inadvertently left in applications as plain text or that can be […]
GitGuardian: 10M Exposed Secrets on GitHub
GitGuardian published an analysis of more than one billion commits to GitHub repositories that found 10 million occurrences of secrets, with one out of 10 developers exposing a secret. Mackenzie Jackson, a developer advocate for GitGuardian, said more than 80% of all the secrets caught by live monitoring GitHub were exposed through personal repositories, with […]
Dev of core-js Will Flip Table ¦ Another 451 PyPI Maldeps
In this week’s #TheLongView: Denis Pushkarev is fed up with core-js freeloaders, and hundreds more malicious packages found at PyPI.