CVE-2021-33177, CVE-2021-33178, and CVE-2021-33179 are SQL injection, path traversal, and XSS vulnerabilities in the popular application, service, and network monitoring software Nagios XI.
In an effort to secure the software supply chain, Black Duck SBOM export capabilities now comply with the NIST standards in Executive Order 14028.
Looking to build trust in your software? Start with BSIMM12’s top five software security activities. For any organization looking to improve the security of its software, Building Security In Maturity Model (BSIMM) has dozens of options. Many dozens. The 12th iteration of the BSIMM report, released September 28, details 122 software security activities (also known as controls) that were observed in the 128 participating organizations.
Achieving a culture of DevSecOps is possible with the help of solutions like Intelligent Orchestration and Code Dx. As a trusted adviser to my clients, I use my unparalleled experience with a broad range of security tools to help them build and mature security programs. I work tirelessly to help them break down silos, facilitate collaborative change, create a culture of lean learning, and ensure continuous feedback and sharing, so they can build pipelines that are intelligent and risk-based.
Learn how tool orchestration empowers AppSec to keep pace with DevOps, providing a union of security and speed. Many organizations have advanced from the DevOps methodology to DevSecOps, and it is expected this trend will continue throughout 2020 as more enterprises leverage the cloud. A DevSecOps approach promotes collaboration between software application development teams and application security teams.
The Coverity and Wind River partnership supports developers with fast-turn CI/CD workflows and container-based development. Highlights.
Multiple AppSec tools lead to many results. Let Code Dx centralize your AppSec management to help you make sense of your data. Most organizations have more than one application—some large enterprises have hundreds or thousands of applications in development and production. Each application is constantly updated to fix security issues, improve performance, and meet new customer demands, and an essential part of the update process is to test the application for security issues.
Learn how to set up continuous assurance with Code Dx to improve code quality and security at the speed of DevOps. Continuous integration (CI) has made a tremendous impact on how we develop software. The concept is simple: fail fast and fail often. This allows the team to fix problems before they become a big deal, saving time and money.
Building an effective application security program for your organization begins with establishing policies and processes. Psychologist Abraham Maslow wrote, in 1964, “Give a small boy a hammer, and he will find that everything he encounters needs pounding.” This is commonly rephrased as “if you have a hammer, everything looks like a nail.”
Accountability is essential for AppSec analysts, managers, and CISOs. Learn how ASOC tools bring the visibility and transparency required. We have already discussed how application security orchestration and correlation (ASOC) makes the AppSec process more efficient and scalable. In this final post in our ASOC series, we will demonstrate how ASOC tools bring accountability to both the technical and business sides of application security.
