Cyber innovation and digital transformation are moving at increasing speeds. With the shift to cloud-based software and assets, SaaS (software-as-a-service) applications, and the need for remote working, businesses are changing the way they approach risk management and the security of their digital assets.
Security and observability data go hand in hand when it comes to application health. If you can put those two sources of data behind a single pane of glass you can make your life a lot easier. By leveraging the different options that the Snyk platform provides, you can send all your application security vulnerabilities found by Snyk directly to your New Relic observability platform. Let’s see how!
Vulnerability remediation is the process of finding, addressing, and neutralizing security vulnerabilities within an organization’s IT environment, which can include computers, digital assets, networks, web applications, and mobile devices. Remediation is one of the most important steps in the vulnerability management process, which is critical for securing networks, preventing data loss, and enforcing business continuity.
Developing and testing a frontend feature can be difficult, especially when the backend it depends on is not ready. This dependency on a backend API often slows down the development process. In scenarios like this, developing a mock API can save you a lot of time by allowing you to develop your feature independent of the backend, and make it easier to test and identify scenarios where your API might fail before it is ready.
In our previous blog breaking down The 5 Fundamentals of Cloud Security, we looked at the value of prevention and secure design. Mapping resource relationships and enforcing security guardrails throughout development helps greatly reduce an available attack surface. But who will enforce these guardrails when your security team is busy with other work? This should be where developers are able to step in. So let’s look at another vital element in cloud security: empowering developers.
19.10.2022 - As part of our goal to continuously improve our vulnerability detectors, we continuously test various open-source projects with Jazzer within OSS-Fuzz. In this case, a test run yielded a severe finding with a potential remote code execution in a HSQLDB (CVE-2022-41853).
A new critical vulnerability CVE-2022-42889 a.k.a Text4shell, similar to the old Spring4shell and log4shell, was originally reported by Alvaro Muñoz on the very popular Apache Commons Text library. The vulnerability is rated as a critical 9.8 severity and it is always a remote code execution (RCE) which would permit attackers to execute arbitrary code on the machine and compromise the entire host.
Categorizing the challenges and duties of your trusted friend, the site reliability engineer (SRE). From Snyk Ambassador Keith McDuffee, DevSecOps and founder of StackRef.com. “What’s the difference between a DevOps engineer and a site reliability engineer?” It’s a question I hear all the time — and one I’ve heard (and sometimes asked) in job interviews. But is there a correct answer? It all depends on who you ask.
Developer-centric security movements have dominated discussions in software development over recent years. The concepts are clear — integrate security early and find issues faster. But how does an organization measure the success of its developer security program?
