Application Security March 3, 2014

Application Security Risk Management and the NIST Cybersecurity Framework

5 min read - What value can the NIST Framework for Improving Critical Infrastructure Cybersecurity bring to my industry and my organization from a software security perspective? Understand how risk-based application security management intersects with the framework.

Software Vulnerabilities February 20, 2014

How do you know if a hardware or software vendor can be trusted?

3 min read - How do you know if the vendor providing hardware or software can be trusted? How do you know if their processes can be trusted to supply your organization with hardware and software that has not been maliciously tainted? This is…

Application Security February 5, 2014

Think SQLi is Old News? Attackers Don’t!

4 min read - What can we do to help developers learn about preventing incidence of SQLi vulns in their production applications? And what can we do about SQLi in legacy web applications or newer apps that were developed with SQLi vulnerabilities? This is…

Application Security January 27, 2014

How do I know my Cloud Service Provider’s (CSP) Applications are secure?

5 min read - How do I know my Cloud Service Provider's (CSP) Applications are secure? While it's a simple question, the answer is fairly complex. What organizations should consider when looking at their CSP's application security profile. This is a weekly post where…

Software Vulnerabilities January 15, 2014

Help! Our Dev Team Hates the Software Security Testing Team

4 min read - How can we foster cooperation to help our Development and Security Teams work together? Often, our dev team hates the software security testing team. What can we do about that? This is a weekly post where we address questions of…

Application Security December 13, 2013

What is the difference between PCI DSS and PA DSS?

4 min read - What is the difference between PCI DSS and PA DSS? If I'm not a payment application vendor, what value does the PA DSS have for me? Addressing the top questions of interest to the Application Information Security Community.

Application Security November 27, 2013

Mobile Apps: Which are More Secure Android or iOS?

2 min read - This is a weekly post where we address questions of interest to the Application Information Security Community. Which Apps are More Secure Android or iOS? Are Mobile Application Reputation Services valuable to Enterprises?

Application Security November 22, 2013

The Legal Landscape: Can vendors be sued without damages? What the heck is PII?

3 min read - This is a weekly post where we address questions of interest to the Application Information Security Community. Will the legal landscape change if software vendors can be sued without damages or loss being proven? What is PII - How much…

Application Security November 15, 2013

How Can I Secure Apps in the Cloud?

2 min read - This is a weekly post where we address questions of interest to the Application Information Security Community. How do we secure application vulnerabilities and code development, particularly for mobile and social applications that are built by business units or reside…

Application Security November 8, 2013

Who Should be Responsible for Application Security Testing?

2 min read - This is a weekly post where we address questions of interest to the Application Information Security Community. Who Should be Responsible for Application Security Testing? Can "generated code" be tested?