Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

March 2024

The Essential Components of a DevSecOps Pipeline

DevSecOps pipelines arose in response to DevOps and CI/CD, which made it possible for developers to iteratively and continuously deliver small code changes, rather than massive deployments periodically. In theory, by integrating security into DevOps processes that enable continuous integration and delivery, developers could find and resolve security issues early in the software development lifecycle (SDLC), which is much faster than fixing security issues in production.

7 Steps to Implement an Effective Vulnerability Management Program

When a new vulnerability is found, the race is on to either solve it or exploit it (depending on which side you’re on). But while attackers are getting faster, companies not so much. Dev teams take around 215 days to resolve a security vulnerability. The numbers are only marginally shorter when dealing with critical vulnerabilities. This delay is particularly concerning given the rise in zero-day exploits, where hackers take advantage of a security flaw before the organization even knows it exists.

Securing the Future: Cybersecurity Meets Physical Access Control

In today's digital age, the lines between cybersecurity and physical access control are increasingly blurring. At Brivo, we're at the forefront of this revolution, ensuring your information and facilities are safeguarded against emerging threats. Dive into our latest video where Matt Graham, a visionary in the field, explores the intricate dance of integrating cybersecurity measures with physical access management. Discover how these two realms converge to fortify security like never before.

Exploring OneTrust Alternatives: Which GRC Fits You Best?

When one looks at the marketplace of governance, risk management, and compliance (GRC) software platforms, it’s clear that OneTrust has established itself as a key player in the field — and also that the quest for the right GRC solution is a nuanced exercise, depending on your organization’s specific needs and preferences.

Unraveling Cyber Intrigue: Decoding the Complexities of State-Sponsored Hacking Groups

Join us as we uncover the intricate web of state-sponsored hacking groups and the hidden motivations driving their actions. Explore insights from recent revelations, including examples from China dating back to 2012-2013, where various government agencies sponsored competing hacking groups. In this eye-opening discussion, we delve into the financial motivations behind these operations and shed light on the key players pulling the strings. From government agencies vying for dominance to clandestine funding sources, the landscape of cyber intrigue is more complex than meets the eye.

The 443 Podcast - Episode 283 - Trucking Worms

This week on the podcast we discuss a vulnerability in required commercial truck hardware that could enable an automatically propagating worm across the entire US. Before that, we cover Apple's "un-patchable" vulnerability in their M-series processors as well as a vulnerability that could let attackers unlock hotel room doors at will. The 443 Security Simplified is a weekly podcast that gets inside the minds of leading white-hat hackers and security researchers, covering the latest cybersecurity headlines and trends.

Selecting SIEM Tools - Questions to Consider

So, you’ve done your homework. You’ve clearly defined business requirements, and you think you want to implement a Security Information and Event Management (SIEM) solution into your organization. Cloud migration and remote work have changed the way threat actors attack, and it feels like every day you read about a new methodology. While a lot of companies added a SIEM to their cybersecurity technology stack, you’re not sure whether you can afford one.

NPM Manifest Confusion: Six Months Later

Several months ago, Darcy Clarke, a former Staff Engineering Manager at GitHub, discovered the “Manifest Confusion” bug in the npm ecosystem. The bug was caused by the npm registry not validating whether the manifest file contained in the tarball (package.json) matches the manifest data published to the npm server. Clarke claims this to be a large threat, allowing malicious actors to deceive developers and hide harmful code from detection.

Resolving Simple Cross-Site Scripting Flaws with Veracode Fix

In the last blog on fixing vulnerabilities with Veracode Fix, we looked at SQL Injection remediation in a Java application. Since then, we have released Fix support for Python (and PHP) and launched a new VS Code plugin that includes support for Fix. It seems appropriate, therefore, to look at resolving a problem in a Python app using Veracode Fix in the VS Code IDE. This time let’s examine a simple cross-site scripting (XSS) weakness.

Enterprise Browsers Need to Secure Identities Without Compromise

Now is the time. It’s been over 30 years since the introduction of the first web browser. Since then, the browser has evolved into an application that allows us to stream entertainment, work and interact through social media. It’s the most widely used application among consumers … and now the enterprise. Unfortunately, there’s little separation between work and personal life when you use a browser designed for consumer use.

How Effortless Solutions Managed Multi-Tiered Client Needs with BoxyHQ SSO

Effortless Solutions faced a unique challenge: implementing an Enterprise Single Sign-On (SSO) solution for a customer's client in the Netherlands, requiring a SaaS application developed on the Bubble platform to seamlessly integrate with Microsoft EntraID, ensuring minimal disruption and downtime while enhancing productivity and maintaining high-security standards.