Software Vulnerabilities August 9, 2022

Controlling the Source: Abusing Source Code Management Systems

13 min read - For full details on this research, see the X-Force Red whitepaper “Controlling the Source: Abusing Source Code Management Systems”. This material is also being presented at Black Hat USA 2022. Source Code Management (SCM) systems play a vital role within…

Data Protection December 6, 2021

Public Wi-Fi Security: Is It Safe to Use for Business?

4 min read - Let’s say you need to send an urgent email to a client while you’re at the store. Or, you’re traveling and need to take a Zoom call at your hotel. Maybe you need to access sensitive client data or employee…

Risk Management October 8, 2021

The Case for Cybersecurity Education for Engineers

2 min read - Engineering and cybersecurity are two distinct disciplines, each demanding its own rigorous education and training. But should there be crossover? Should engineers or engineering students invest in cybersecurity education as well? What are the opportunities for engineers to gain expertise…

Risk Management September 27, 2021

DevSecOps: How Engineers Benefit From Cybersecurity Education

2 min read - Digital security incidents involving operational technology (OT) can have big impacts on the physical world. Why are these OT security incidents happening? A lack of understanding of how the different elements of DevSecOps fit together can contribute. This also shows…

Software Vulnerabilities September 16, 2021

How DevSecOps Can Secure Your CI/CD Pipeline

2 min read - Many companies today automate their software development life cycle with continuous integration and continuous delivery (CI/CD). It’s part of the broader DevOps movement to speed software development while reducing errors. Continuous integration builds and tests code automatically, while continuous delivery…

Zero Trust June 1, 2021

How the Rise of the Remote SOC Changed the Industry

4 min read - What does the rise of remote security operations centers (SOCs) mean for cybersecurity jobs? The longer people work from home during the pandemic, the more they rate remote working a success for their companies. While companies of all sizes are…

Application Security May 12, 2021

DevSecOps: Closing the Security Gap With Developers

2 min read - We talk a lot about building a culture in which every employee and department puts digital safety first. Everyone pitching in a little bit means the job gets done more thoroughly. Bringing developers, IT operations and security together in a…

Intelligence & Analytics April 2, 2021

Software Composition Analysis: Developers’ Security Silver Bullet

4 min read - Security experts are always looking for a silver bullet. New products promise to resolve all your issues. Typically, these products overpromise to expand market share. Most attacks we see these days occur not because of genius attacks. Instead, they’re due…

Cloud Security March 29, 2021

Are Cloud-Native IAM Controls Good Enough for Your Enterprise?

3 min read - Organizations of every type and size are looking to the cloud for a multitude of benefits, including agility, quick time-to-value, cost savings and scalability. But enterprise-scale deployments can make this process complex, more so as it relates to identity and…

Application Security March 3, 2021

Don’t Speed Past Better Cloud App Security

3 min read - They say you can only have two of three — fast, good and cheap. When it comes to developing cloud-based applications, I think that a fourth criteria should be added: secure. But, I honestly don’t think that this common advice…