There is a movement in the IT security world that is gaining traction, and it is based around the implementation of security within applications from the beginning. You may have heard buzzwords like “AppSec”, “DevSecOps” and “Shift Left”, but what do they actually mean? What does it take to “Shift Left” when developing a secure application? You can read about dealing with dependencies in our blog post.
The adoption of agile practices has resulted in the emergence of shift-lift testing, where testing is performed much earlier in the Software Development LifeCycle (SDLC). Traditional waterfall models performed testing to the right of, or following, development. The benefits of testing earlier and more often cannot be underestimated. However, where does this leave security and security testing?
It has been a tough few months for Microsoft. After the SolarWinds/NOBELLIUM attacks, Microsoft Exchange customers were afflicted with a slew of vulnerabilities. In March 2021, the ProxyLogon vulnerability emerged, followed by an exploit that surfaced in April 2021 called NSA Meeting. In August 2021, Orange Tsai released a series of new vulnerabilities called ProxyOracle and ProxyShell, followed by the discovery of another Proxy flaw, dubbed ProxyToken.
The Open Web Application Security Project (OWASP) is a not-for-profit organisation that aims, through community-led open-source projects, to improve the security of web-based software. OWASP develop and manage a public framework that documents the top 10 risks to application security, the OWASP Top 10. It provides developers and security professionals with the industry’s consensus on the most significant risks to web applications and recommends security controls to mitigate them.
HTTP/3 is the third and upcoming major version of the Hypertext Transfer Protocol (HTTP) used across the web.HTTP has been the main protocol on the internet since the 1990s, with the second release (HTTP/2) introduced in 2015 as a major update with many new features. Whilst request methods and status codes will remain the same, HTTP/3 makes a departure from its predecessors by not using the Transport Control Protocol (TCP) as the underlying transport layer.
Trusting the effectiveness of your IT security controls is crucial to mitigate risks and malicious access to your systems and the information they store. Penetration testing with a CREST-Approved provider is one of the most effective methods to gain assurance of your IT security. Initiating a penetration test will give you the ability to develop (or enhance an existing) security strategy and remediate your vulnerabilities.
Companies that move towards digital transformation can innovate more quickly, scale efficiently and reduce risk by implementing cloud security best practices. Businesses must keep up with growing customer expectations and the pace of innovation by adopting a digital-first business model. But for many businesses, digital transformation remains a huge challenge. Company culture and technology must align for a digital-first business model to be effective.
The cloud holds a lot of potential for organisations. Moving your IT environment to a secure cloud provides flexibility and agility. It allows your team to be more productive and focus on delivering value for your business. Protecting your assets, particularly your data, will help you remain secure while your organisation scales using the cloud. As you prepare for cloud migration, it’s crucial that you have the buy-in from your whole organisation.
2020 is the year that remote working exploded. Businesses and the general public had to quickly adapt to new ways of working caused by the pandemic. There was suddenly a heightened awareness of cyber security and its importance. The need for further education on cyber security highlights the important work Sentrium carries out every day. Sentrium’s commitment and passion for providing best-practice cyber security support helps businesses to gain assurance in the security of their assets.
We’re delighted to announce that Sentrium Security is now a CREST accredited company! This is an exciting achievement for us and it’s great to be recognised by the industry as a leading information security service provider. This is another great achievement for Sentrium following our award wins at the Cyber Security Excellence Awards 2021, where we won Best Cyber Security Company and Best Cyber Security Start Up (Europe, 1-9 employees).
