Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

May 2024

Peter Guagenti from Tabnine Discusses the Future of AI Development Tools

Join our host, Michael Chenetz, as he dives into an enlightening conversation with Peter Guagenti, the President of Tabnine. In this episode, they explore the transformative power of AI in software development and how Tabnine is revolutionizing the way developers work.

Key learnings from the State of DevSecOps study

We recently released the State of DevSecOps study, in which we analyzed tens of thousands of applications and cloud environments to assess adoption of best practices that are at the core of DevSecOps today. In particular, we found that: In this post, we provide key recommendations based on these findings, and we explain how you can leverage Datadog Application Security Management (ASM) and Cloud Security Management (CSM) to improve your security posture.

Top 10 app security problems and how to protect yourself

You know your latest web application is inherently vulnerable to all kinds of attacks. You also know app security can never be perfect, but you can make it better tomorrow than it was yesterday. The problem is that whether you’re using enterprise-grade (aka, expensive and complex) security tools, or have cobbled together a handful of open-source projects into a CI/CD pipeline or Git commit hooks and are hoping for the best, your toolkit can’t help you see.

Older, Larger, Riskier: The Correlation Between Application Age and Security Debt in the Public Sector

Years of accumulated security debt due to unaddressed software vulnerabilities and inadequate security configurations plague the applications that support our government functions. The age and size of applications play a significant role in the accumulation of security debt. The State of Software Security 2024 report provides a detailed analysis of how these factors correlate with security vulnerabilities, particularly in older and larger applications.

Cloud Unfiltered with Andre Zayarni - Exploring AI and Vector Databases - Episode 13

Join your host Michael Chenetz as he interviews André Zayarni, the CTO of Qdrant, a leader in AI innovation with their cutting-edge vector database technology. This conversation is essential listening for anyone interested in the integration of advanced search technologies and AI in modern applications.

Network Security and Application Security: The Power Duo of Cybersecurity

In a world with frequent technological changes, maintaining the trustworthiness and protection of your data and systems should be of paramount importance. With technology constantly evolving for the better, dangers and susceptibility could also make your online security more extraordinary. This is where the issues of network security and application security appear, which may be referred to as two complementary subtopics.

How to Protect Your Cloud Assets from Being Cryptojacked

Cryptojacking attacks have become the most prevalent type of attack on cloud native infrastructures. For example, in 2022, there were 139M cryptojacking attacks, but the following year there were over 1 billion! That translates to nearly 3M cryptojacking attacks every day, on average in 2023.

How to Protect Your Business From API Data Leaks

Application Programming Interfaces (APIs) are rapidly becoming the primary attack vector for cloud native applications. In fact, according to one study, 92% of organizations have already experienced a security incident resulting from insecure APIs. This is because loosely coupled microservices predominantly intercommunicate via APIs. In this video, we will analyze a ‘ripped from the headlines’ case-study example of data leakage via insecure APIs. Then we will examine various API vulnerabilities that can be exploited by attackers to enable data leaks, including Broken User Authentication (BUA), Broken Object Level Authentication (BOLA), and Broken Function-Level Authentication (BFLA).

Cloud Unfiltered with Sathish Balakrishnan - Exploring the Future of AI and Automation - Episode 12

Join host Michael Chenetz on this enlightening episode of Cloud Unfiltered as we dive deep into the realms of AI and automation with special guest Sathish Balakrishnan from Red Hat. Sathish, who leads the Ansible Automation Platform business, shares his valuable insights on how AI is enhancing automation technologies and the critical role of automation in leveraging AI effectively across industries.

Scaling DevSecOps with Dynamic Application Security Testing (DAST)

In the swiftly evolving landscape of AI-driven software development, DevSecOps helps strengthen application security and quality. Dynamic Application Security Testing (DAST) is a key tool that helps scale your DevSecOps program by facilitating continuous and accurate security tests on running applications. DAST simulates real-world attacks, enabling you to identify security weaknesses and evaluate your application's defenses in response to actual attacks.

AppSec spring cleaning checklist

Something about the springtime sunshine and blooming flowers inspires many of us to start cleaning. For some, it might be tackling the backyard shed that accumulated cobwebs over the winter or that overflowing junk drawer in the corner of the kitchen. As you survey your home and yard and decide where to start cleaning, it’s also a great time to look at your application security program and see if any of your existing processes need some tidying up. Here are a few great places to start.

Google Cloud affected by CVE-2021-30476

CVE-2021-30476 affects HashiCorp's Terraform Vault Provider and involves incorrect configuration of bound labels for GCP (Google Cloud Platform) authentication. This issue permits unauthorized users to potentially bypass authentication mechanisms. The vulnerability stems from the Vault provider not correctly configuring the bound labels within the GCP authentication method, which could lead to improper access control.

The Application Security Assessment Checklist for Cloud Native Environments

A cloud-based application security assessment (or ASA) is a systematic evaluation to identify vulnerabilities and improve security in cloud applications. It aims to ensure the application’s structural, design, and operational integrity against all cyber threats. A staggering 82% of data breaches in 2023 involved data stored in the cloud.

kntrl integrates Open Policy Agent

Addressing the security intricacies of sophisticated automation frameworks, in our case the Continuous Integration/Continuous Deployment (CI/CD) environments, is always challenging. The inherent complexity of such environments, characterized by the multitude of components that are each performing distinct tasks, necessitates a dynamic and adaptable rule engine to ensure the security of our pipelines.

Outshift by Cisco | An Era of GenAI & Human Collaboration

AI is the key to unlocking the untapped potential within your organization. At Outshift, we invest in the future of GenAI, not as a tool that replaces human effort but as a transformative force that amplifies the creativity and ingenuity of people across your enterprise. We invite you to reimagine the role of GenAI in business. Thinking of it as a tool for connection, adaptation, and creativity - a tool with unprecedented efficiency and impact.

Accelerating AppSec with Mend.io and Sysdig

Today at RSA Conference 2024, Mend.io and Sysdig unveiled a joint solution targeted at helping developers, DevOps, and security teams accelerate secure software delivery from development to deployment. The integration incorporates the exchange of runtime insights and application ownership context between Sysdig Secure and Mend Container to provide users with superior, end-to-end, and risk-based vulnerability prioritization and remediation across development and production environments.

Shift left: How securing from code to cloud can improve your time to market

Embracing a shift-left security approach in software development will not only enhance your application security but will also accelerate your software product's time to market. By integrating security practices early in the software development lifecycle (SDLC)—particularly in your cloud-native applications—you can navigate modern cyber threats more effectively as you get to market more swiftly.

Smart Cloud Detection and Response: Detecting attacks in real-time with Panoptica

Modern technology continues to assist, enhance, and shape every aspect of our lives—in our work, our homes, and even our vehicles. Home security video cameras and car dashcams are prevalent ways to ensure our personal safety and security. A popular electric vehicle has a “sentry mode” that is a perfect example of a system that monitors and captures events happening around the vehicle, providing information about incidents to vehicle owners.

Elevate, Automate, Anticipate: Panoptica's Cutting-Edge Security Solutions Unveiled at RSAC

The RSA Conference 2024 was a landmark event for Panoptica as we unveiled three transformative solutions: Smart CDR, GenAI Dynamic Remediation, and Security Graph Query. These tools work together seamlessly to strengthen your security architecture and ensure readiness against today's complex and evolving threats. Let’s take a look at each of these exciting new capabilities.

Generative AI & Security - Cisco Research Summit Spotlights the Latest in GenAI

Cisco Research hosted a virtual summit to explore current research in the generative AI and cybersecurity space. The session includes presentations from University professors collaborating with the Cisco Research team, including Srini Devadas (MIT), Vijayalakshmi Atluri (Rutgers), Jie Ding (Minnesota), and Ravi Sandhu and Ram Krishnan (UT San Antonio). Listen in for unique and exciting perspectives on the possibilities of generative AI in security, including discussions on the trustworthiness of LLMs, training and maintenance of AI models, and more.

Building Trust and Engagement: Mobile App Security for the Modern User

In today's fast-paced digital world, the focus is on creating secure and frictionless mobile applications that prioritize user privacy. This balance is particularly critical when dealing with in-app subscription management, a key revenue source and a hot spot for user data interaction. Proper management of these subscriptions is crucial for both securing continuous revenue and ensuring user trust alongside compliance with strict data protection standards.

4 Ways to Improve AppSec Accountability

This blog post dives into four essential strategies to enhance AppSec accountability: establishing clear security policies, utilizing advanced tools and automation, fostering a security-conscious culture, and implementing security orchestration. Readers will gain valuable insights into aligning their cybersecurity measures with business goals, ensuring a robust and strategic AppSec framework.

Leveraging Shift Left and Shift Right for End-To-End Application Security

Despite organizations’ best efforts, security threats are on the rise, with malicious actors continuously evolving their tactics. Unfortunately, the situation is only intensifying as hackers from all walks of life leverage artificial intelligence (AI) and machine learning (ML) techniques. To combat these threats, security teams need to implement gates and controls throughout their entire software development lifecycle.

We just raised our $17 million Series A

TL;DR we raised a lot of money and we’re ready to go big. We've raised $17M to bring “no BS” security to devs. We’re happy to welcome Henri Tilloy from Singular.vc on board, who is again joined by Notion Capital and Connect Ventures. This round comes just 6 months after we raised $5.3M in seed funding. That’s fast.

How to Build an Application Security Program

Application security is vital for ensuring the resilience of organizations, as it encompasses measures and practices that safeguard applications against potential threats and vulnerabilities. It plays a critical role in safeguarding sensitive data, preventing unauthorized access, and maintaining the integrity and availability of applications.

Aikido lands $17M Series A to bring it's 'no BS' security platform for developers to SMEs world-wide

Ghent-based Aikido, the get-it-done security platform for developers and SMEs, has raised $17M in fresh Series A funds from Singular.vc, joined by Notion Capital and Connect Ventures. The round comes a mere 6 months after Aikido raised $5.3M seed funding, making Aikido the fastest capitalized startup in Belgian history. The funds will be used to expand the platform and push Aikido onto the international stage to make security simple for SMEs and doable for developers.