Application Security

Python GitHub token leak shows binary files can burn developers too

Scrubbing tokens from source code is not enough, as shown by the publishing of a Python Software Foundation access token with administrator privileges to a container image on Docker Hub.

By Lucian Constantin

Jul 11, 20245 mins

DevSecOpsApplication SecuritySoftware Development

Articles

Where in the world is your AI? Identify and secure AI across a hybrid environment

As AI becomes integral to systems brought into the enterprise ecosystem it is increasingly critical for security teams to know where it is and reduce its risks.

By Deb Radcliff

Apr 17, 2024 9 mins

Application SecurityCloud SecurityNetwork Security

What is identity fabric immunity? Abstracting identity for better security

CISOs struggling to manage a diverse and complex identity access management infrastructure should start thinking about identity fabric immunity.

By Matthew Tyson

Apr 03, 2024 11 mins

CSO and CISOApplication SecurityIdentity and Access Management

Software supply chain attack impacts repo of large Discord bot community

The incident shows the snowball effect a single malicious package can have on the open-source development ecosystem.

By Lucian Constantin

Mar 27, 2024 6 mins

DevSecOpsMalwareSupply Chain

Teams, Slack, and GitHub, oh my! – How collaborative tools can create a security nightmare

Some of today’s most popular and useful information-sharing platforms can leave a lot to be desired from a security standpoint. Here are some of the issues and how to mitigate them.

By Susan Bradley

Mar 19, 2024 7 mins

Windows SecurityApplication SecurityCloud Security

New Kubernetes vulnerability allows privilege escalation in Windows

Attackers can abuse YAML configuration files to execute malicious commands in Windows hosts.

By Lucian Constantin

Mar 13, 2024 6 mins

DevSecOpsApplication SecurityVulnerabilities

Tool sprawl is hurting application security, US CSOs say

Security teams are managing many independent security tools and are able to fully review only half of major code changes, a new survey has found.

By Shweta Sharma

Feb 13, 2024 5 mins

Application Security

How to strengthen your Kubernetes defenses

Kubernetes-focused attacks are on the rise. Here is an overview of the current threats and best practices for securing your clusters.

By David Strom

Feb 13, 2024 8 mins

DevSecOpsApplication SecurityIdentity and Access Management

Deprecated npm packages that appear active present open-source risk

A significant percentage of the 50,000 most-downloaded npm packages are deprecated or have a deprecated dependency but provide no warning.

By Lucian Constantin

Jan 19, 2024 5 mins

DevSecOpsApplication SecurityOpen Source

The OWASP AI Exchange: an open-source cybersecurity guide to AI components

This open-source collaborative effort to share global AI security standards, regulations, and knowledge aims to mitigate risk and boost AI cybersecurity for all.

By Chris Hughes

Jan 16, 2024 9 mins

DevSecOpsApplication SecuritySecurity Practices

Understanding the NSA’s latest guidance on managing OSS and SBOMs

Open-source software is ever vulnerable to malicious actors, but software bills of material can help mitigate the threat. NSA guidance sets a solid foundation for managing the ecosystem.

By Chris Hughes

Dec 25, 2023 9 mins

Application SecurityOpen SourceSecurity Practices

Atlassian patches critical remote code execution vulnerabilities in multiple products

The company also releases advisories for high-severity data leaks and denial-of-service issues across multiple products, including Jira and Confluence.

By Lucian Constantin

Dec 12, 2023 6 mins

DDoSApplication SecurityVulnerabilities

Snyk unveils new ASPM offering to help DevSecOps manage cloud application risks

Snyk AppRisk provides an ASPM workbench for the developers and security teams to discover assets, and analyze business and security context to quantify risks.

By Shweta Sharma

Dec 12, 2023 3 mins

Application Security