Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

April 2024

Outpost24 Introduces Application Security Expert Service to Eliminate False Positives

Outpost24 is pleased to announce the launch of our bespoke application security service, DAST Expert. With this innovative offering, organizations gain access to in-depth analysis of application security scanning results, eliminating false positives and enabling you to prioritize remediation efforts more effectively.

Introducing Polaris Assist: Your virtual security assistant | Synopsys

Polaris Assist is a virtual assistant that combines generative AI with decades of Synopsys curated real-world vulnerability, risk, and secure coding data to simplify and streamline application security. Polaris Assist AI capabilities will first be introduced on the Polaris Software Integrity Platform by analyzing static analysis data.

Cloud Unfiltered with Marc Prioleau - Complexity of Collaborative Mapping - Episode 10

Marc Prioleau of the Overture Maps Foundation discussed the solution and the how and why of how it came to be. Mapping is critical in so many areas and we take for granted how dynamic we expect it to be. This cloud based, open source solution answers the question on how companies can share and contribute to mapping data.

Breaking the Cloud to Build the Cloud

There’s no such thing as a perfectly secure cloud environment. Vulnerabilities, holes left open by misconfigurations, over-permissive roles, and more create a target-rich environment for attackers. Breaking the cloud for good is the job of these expert hackers. View this panel session to learn about offensive security techniques and tactics for breaking the cloud to build the cloud better.

Managing Cybersecurity Risk from the CI/CD Pipeline to the Board Room

In this panel conversation with leaders in cybersecurity, get advice and insights into navigating between IT and Security teams with the advancement of “shift left” concepts as security increasingly moves to development teams and DevOps grows in importance. Further, hear tips and advice on educating Board Audit Committees and Executive Leaders on cloud trends and risk focus areas to maximize investment and focus on the risks that matter to the business.

A C-Suite View of Cloud DevSecOps Today and Tomorrow

Hear about trends of innovative security leaders and how developers and security practitioners can best collaborate together through aligned incentives and strong communication. Outshift is Cisco’s incubation engine, innovating what's next and new for Cisco products and sharing our expertise on emerging technologies. Discover the latest on cloud native applications, cloud application security, generative AI, quantum networking and security, future-forward tech research, our latest open-source projects and more.

Cloud Detection and Response Has Evolving, Cloud-Scale Challenges

In our previous post, we explored the essentials of cloud detection and response (CDR), highlighting how the cloud's scale and complexity have transformed cybersecurity needs. We discussed the types of threats unique to the cloud and the broad benefits that CDR systems offer to organizations aiming to secure their cloud environments. This follow-up takes us deeper into some of the challenges that arise with detecting and responding to threats in the cloud.

5 Best Open Source Application Security Security Tools in 2024

As cybersecurity becomes increasingly important in software development, the “shift left” security approach is widely recognized as a best practice for ensuring superior application security. Numerous traditional security firms are introducing shift-left products and capabilities, and the concept is gaining traction. However, some open source application security tools are more developer-friendly than others.

The What and Why of Cloud Detection and Response

A recent survey from Gartner forecasts that worldwide end-user spending on public cloud services will total $679 billion in 2024, and that number is expected to jump to $1 trillion in 2027. Businesses left and right are moving to the cloud. But as they make their move, the old ways of protecting data—like building a virtual wall around your data (“perimeter security”)—are proving inadequate.

Cloud-scale Threats Need Cloud Detection and Response

A recent survey from Gartner forecasts that worldwide end-user spending on public cloud services will total $679 billion in 2024, and that number is expected to jump to $1 trillion in 2027. Businesses left and right are moving to the cloud. But as they make their move, the old ways of protecting data—like building a virtual wall around your data (“perimeter security”)—are proving inadequate.

360 degrees of application security with Snyk

Application development is a multistage process. The App goes through various stages, each with its own area of focus. However, application security, a.k.a. AppSec, is constant throughout all the stages. For example, when a developer codes, it’s expected that the code will be secure. Similarly, the artifacts that are worked upon or generated as an end output of the respective stages are all required to be secure.

Cloud Unfiltered with Cole Kennedy - Attestation is the Key - Episode 9

In the latest episode of Cloud Unfiltered, Cole Kennedy - founder of TestifySec - breaks down the concepts of supply chain security and goes over the importance of attestation. Outshift is Cisco’s incubation engine, innovating what's next and new for Cisco products and sharing our expertise on emerging technologies. Discover the latest on cloud native applications, cloud application security, generative AI, quantum networking and security, future-forward tech research, our latest open source projects and more.

Discover your exposure to the XZ Utilities backdoor in 10 seconds or less

When high profile security events happen, it is essential for you and your team to have the information you require right at your fingertips. Using Panoptica’s powerful graph database and easy to use query engine, you are easily able to discover all the assets in all your cloud environments that could have compromised software installed.

Cloud Unfiltered with Sebastian Stadil - The Evolution of IaC at KubeCon 2024

In this special edition of Cloud Unfiltered, recorded at KubeCon Paris, host Michael Chenetz sits down with Sebastian Stadil, co-founder of Scalr. Sebastian has been pivotal in the DevOps community, especially with his recent work spearheading the OpenTofu initiative. During this insightful episode, Sebastian shares his journey in the tech world, the mission behind Scalr, and his perspectives on the evolution of infrastructure as code.

Cloud Unfiltered with Whitney Lee and Victor Farcic - Choose Your Own Adventure at KubeCon 2024

Embark on a unique journey into the depths of cloud security in this riveting edition of Cloud Unfiltered, direct from the heart of KubeCon Paris. This episode, featuring the insightful Whitney Lee and the knowledgeable Victor Farcic, takes you on a "Choose Your Own Adventure" exploration of cloud security, offering a personalized path through the complex landscape of protecting cloud environments.

Filter and prioritize IAST vulnerability findings using Project Views in Seeker | Synopsys

In this video, Product Manager, Scott Tolley shows how setting up the new Project Views feature in Seeker can help developers focus their time and attention on the most relevant vulnerability findings in running applications– without hiding the full details from security team. This new feature lets security and development teams...

15 Web Application Security Best Practices

Every day that an application is anything less than ‘fully secure’ is a day for a potential data breach. Consumer data, sensitive business information, monetary transactions, and business reputation; everything is at stake. Investing in effective web application security is the best and only way to mitigate the risk of financial losses and reputational damage for businesses. This blog presents a comprehensive blueprint for implementing best practices in application security.

Cloud Unfiltered with Matt Johnson - Cloud Native Security at KubeCon 2024

In this special edition of Cloud Unfiltered, recorded live from KubeCon Paris, host Michael Chenetz sits down with Matt Johnson, Cloud Security Field CTO at Palo Alto Networks, to dive deep into the evolving landscape of cloud native security. As organizations continue to embrace cloud technologies and Kubernetes, the complexity of securing these environments has never been more challenging. Matt shares his insights on the current state of cloud security, the importance of a holistic approach to securing applications across multiple layers, and the role of developers in the security ecosystem.

Six takeaways from our ASPM masterclass series

Software development moves fast, and many application security teams struggle to keep up. More sophisticated agile, DevOps, and cloud practices, along with the growing use of AI, mean more agility for development teams. However, these innovations are a challenge for security teams, as they must move at this same speed in order to secure applications effectively. Application security posture management (ASPM) directly responds to these emerging challenges.

Security at the Speed of Cloud

Cloud native technologies have empowered engineering teams to innovate rapidly: from releasing a few times a year to several times a day. This means security assessment have to be done continuously. To achieve this, developer, operation, and security teams have to collaborate in novel ways. Instead of communicating through backlogs, they need to work towards shared objectives. From processes to tooling, teams have to rethink the way they approach security, share context, and improve the security posture of their organization.

Mitigate Upstream Risk in your Software with Black Duck Supply Chain Edition | Synopsys

In this video, we introduce the new Black Duck Supply Chain Edition, which provides a full range of supply chain security capabilities to teams responsible for building secure, compliant applications. With third-party SBOM import and analysis, malware detection, and export options in SPDX or CycloneDX formats, teams can establish complete supply chain visibility, identify and mitigate risk, and align with customer and industry requirements.

What is ASPM - Application Security Posture Management Defined

Welcome to our concise video on ASPM – Application Security Posture Management! In this brief 1-minute video, we unravel the complexities surrounding ASPM, shedding light on its crucial role in safeguarding digital assets and data integrity. ASPM serves as a comprehensive framework for assessing, monitoring, and enhancing the security posture of applications throughout their lifecycle. From development to deployment and beyond, ASPM empowers organizations to proactively identify and mitigate security risks, vulnerabilities, and compliance gaps.

Webhook security checklist: How to build secure webhooks

Let’s not waste time. You’re here because you’re building a webhook feature in your app. Unfortunately, there are quite a few things that can go wrong from a security perspective. This article aims to ensure that you’re not making any well-known mistakes while building webhooks.

Cloud Unfiltered with Travis Runty - Cloud Native Trends - Episode 7

Welcome to this exciting edition of Cloud Unfiltered, where your host Michael Chenetz, delves into the intricate world of cloud computing with special guest Travis Runty, the CTO of Public Cloud at Rackspace. With almost 17 years of experience at Rackspace, Travis brings a wealth of knowledge from his journey as an engineer, architect, and delivery lead, to leading public cloud strategy.

Panoptica: Cloud application security done better

Panoptica, Cisco’s cloud native application security platform provides contextualized cloud security to identify, prioritize, and remediate security risks and misconfigurations in complex cloud environments. The unified cloud security platform makes every stage of cloud security simple from “code to cloud,” providing software supply chain protection, cloud workload and runtime protection, cloud security posture management (CSPM), security for API communication to and between your microservices, and cloud detection and response (CDR) for realtime security protection.

This Month in Datadog: DASH 2024 preview, Datadog Security for Google Cloud, and more

Datadog is constantly elevating the approach to cloud monitoring and security. This Month in Datadog updates you on our newest product features, announcements, resources, and events. To learn more about Datadog and start a free 14-day trial, visit Cloud Monitoring as a Service | Datadog. This month, our Spotlight is a preview of our annual conference, DASH 2024.

Walking the Risky Path: The Threat of hostPath to Your Kubernetes Cluster

In today's cloud technology landscape, Kubernetes is widely used to orchestrate containerized applications, enabling deployment, scaling, and management. Applications in a Kubernetes environment benefit from high availability and resource efficiency, making them ideal for cloud-native development. However, challenges with filesystem consistency due to the ephemeral nature of containers can lead to discrepancies when they are restarted or modified.

Securing CI/CD Runners through eBPF

During the Open Security Summit 2024, Yahoo! Principal Security Engineer Mert Coskuner and Kondukto CEO & Co-Founder Cenk Kalpakoglu delved into the intriguing topic of securing CI Runners through eBPF agents. Although the title might seem unconventional, it reflects their creative approach to solving security challenges in continuous integration environments. With the rapid digital transformation of businesses, there has been an increasing focus on supply chain attacks and their impact on security.