For continuous coverage, we push out major Detectify security updates every two weeks, keeping our tool up-to-date with new findings, features and improvements sourced from our security researchers and Crowdsource ethical hacker community. Due to confidentially agreements, we cannot publicize all security update releases here but they are immediately added to our scanner and available to all users. This post highlights a few things that we have improved in the last two weeks.

A selection of this week’s more interesting vulnerability disclosures and cyber security news. Some absolute gems this week – that’s a bad thing, right? As the stakes rise for security risk and disclosure, two articles tweaked my attention on how it can sometimes not go right; for both sides. Something we all have to learn and build upon errors.

Anyone who has a presence on the internet is likely to be suffering from breach fatigue. Data leaks are reported in the headlines on a daily basis, and users can feel so overwhelmed by the sheer number of breaches that they feel there’s little they can do to keep ahead of hackers.

Today’s increasingly connected world, with access to mobile devices and cloud scale computing, is leading to disruption in business models and processes. To succeed, you have no option but to continuously deliver new value to customers at the increasing speed that they demand.

Pype provides innovative construction software solutions – AutoSpecs, Closeout, and eBinder – that enable teams to start projects faster and close out stronger. Called “game changers” by top GCs, Pype is dramatically changing business operations for construction, with proprietary, industry-leading specification management and closeout automation software.

In mid-November last year, the retail giant Target experienced a security breach where customers’ credit card information was stolen. At first, it was thought that 40 million users had been affected but by January 2014, those numbers skyrocketed to a stunning 100 million. What emerged was the story of hackers who had appeared as “the good guys” in order to harvest as much information as they could from Target’s network.

Developing software while maintaining its embedded security can feel like the “Impossible Dream.” As you update your product, you’re potentially adding new vulnerabilities. As part of the risk management process in software engineering, you need to work with cybersecurity professionals throughout the software development life cycle (SDLC) to create a mature security profile.

Way back in around the 2010 / 2011 timeframe Wendy Nather coined the phrase "The Security Poverty Line" in which she hypothesised that organisations, for one reason or another (usually lack of funds), can't afford to reach an effective level of information security. Nearly a decade on, and while the term has sunk into frequent usage within the information security community, are we any better at solving the issue now that we've identified it?

Kubernetes Pod Security Policy is a mechanism to enforce best security practices in Kubernetes. In this tutorial, we will explain how to enable Kubernetes Pod Security Policy across your cluster using kube-psp-advisor to address the practical challenges of building an adaptive and fine-grained security policy on Kubernetes in production.

Ponemon’s 2019 State of Password and Authentication Security Behaviors Report highlights how inappropriate use of privileged password can give insiders the access they need. Ultimately, the malicious insider needs one thing to perform an act that hurts the organization – access.