Fuzzing can be dangerous. After all, you’re trying to break things. In fuzzing, you deliver deliberately malformed inputs to software to see if the software fails. If it does, you’ve located a vulnerability and can go back to the code and fix it. It’s an excellent, proactive method for software development organizations to fix security weaknesses. And it should be no surprise that fuzzing is also the preferred method for attackers who want to locate zero-day vulnerabilities.

Application security testing tools help developers understand security concerns, but having too many tools can do more harm than good. Good tools are essential for building just about anything. But maybe that needs a bit more clarification: Not just good tools. They also have to be the right tools. Because the old cliché, “if all you have is a hammer, everything looks like a nail,” is a warning that using the wrong tool can mess everything up.

Selecting the perfect IAST solution for your organization’s needs can be difficult. Learn about the eight must-have features of any good IAST tool. Interactive application security testing (IAST) has quickly gained momentum in the application security (AppSec) space. According to Gartner, there was a 40% increase in inquiry volume around IAST in 2019. Why is IAST one of the fastest-growing AppSec tools?

The benefits of application security (AppSec) tool integration in the continuous integration/continuous delivery (CI/CD) pipeline are greater the earlier (the “further left”) you perform them in the process. Development organizations are continuing to shift left to implement security earlier in the CI/CD pipeline. But software security group leaders need to know where AppSec tools should go in the CI/CD workflow, and their purposes in different phases.

GDPR best practices often focus on how to process and manage personal data, but companies should also consider application security to ensure compliance. The standard cliché used to be that you are what you eat. Which remains true, of course. But it’s also incomplete—so last century. Today, you are what you do online, which is almost everything.

Stay on top of open source vulnerabilities and license obligations with discovery capabilities from Black Duck.

Open source risk goes beyond application security. Legal, operational, and supply chain implications demand a capable solution like Black Duck SCA. Open source can be found in everything; nearly all applications in all industries are composed to some degree of open source. The introduction of more cloud-native applications, more open source usage as a whole, and the creation of more-complex applications mean organizations are facing increasing levels of risk.

Sometimes it’s hard to convince people that security needs to be part of every software development process. “We passed all our tests,” they might tell you. “Isn’t that good enough?” The problem is that functional testing usually focuses on the happy path—a place where users act rationally, systems behave well, and nobody is attacking your application.