InfoQ Homepage Security Vulnerabilities Content on InfoQ

Articles

RSS Feed

Newer Older

Java

Dealing with Java CVEs: Discovery, Detection, Analysis, and Resolution

This article delves into the importance of integrating Software Composition Analysis (SCA) in CI/CD pipelines for security. It highlights the need for human oversight to accurately assess vulnerability impact and cautions against "alert fatigue." The article also recommends specialized tools for effective vulnerability management.

Lukas Krecan
on Sep 11, 2023
DevOps

Strategies for Assessing and Prioritizing Security Risks Such as Log4j

The evolving threat landscape requires a comprehensive approach to mitigation. An effective strategy is built on visibility, assessing vulnerabilities in context, effective use of filtering technologies, and monitoring for evidence of intrusion.

Owen Garrett
on Mar 28, 2022
Mobile

How to Harden Applications against IIoT Security Threats

This article will explore two sides of the IIoT security equation: understanding how and why IIoT systems can become vulnerable to hacking attempts, and which solutions and strategies are available to harden them. It will provide also a set of best practices to address IoT security concerns.

Martin Giess
on Nov 03, 2021
DevOps

Virtual Panel: DevSecOps and Shifting Security Left

Recent attacks, that targeted SolarWinds, Colonial Pipeline, and others, have shown that development environments come ever more frequently on the radar of malicious actors. A virtual panel on the value of shifting left security, how to take responsibility for it, and the time-to-market pitfalls.

Brian Fox Jyoti Bansal Kevin Bocek Sergio De Simone
on Oct 01, 2021
Culture & Methods

Q&A on the Book Cybersecurity Threats, Malware Trends and Strategies

The book Cybersecurity Threats, Malware Trends and Strategies by Tim Rains provides an overview of the threat landscape over a twenty year period. It provides insights and solutions that can be used to develop an effective cybersecurity strategy and improve vulnerability management.

Ben Linders Tim Rains
on Dec 07, 2020
Architecture & Design

Three Major Cybersecurity Pain Points to Address for Improved Threat Defense

Three pain points every company must address when addressing cybersecurity include threat volume and complexity, a growing cybersecurity skills gap, and the need for threat prioritization. This article describes each of these in some detail, and includes recommendations for corporations to deal with them.

Jonathan Zhang
on Oct 15, 2019
Culture & Methods

Q&A on the Book Real-World Bug Hunting

The book Real-World Bug Hunting by Peter Yaworski is a field guide to finding software vulnerabilities. It explains what ethical hacking is, explores common vulnerability types, explains how to find them, and provides suggestions for reporting bugs while getting paid for doing so.

Ben Linders Peter Yaworski
on Oct 14, 2019
Development

How to Deal with Open Source Vulnerabilities

Despite the shockwaves following the Equifax hack in September 2017, the industry still has a long way to go in protecting their products. A key area to focus on is the open source components that comprise 60-80% of the code base in modern applications. Learn how to detect vulnerable open source components and keep your products secure.

Rami Sass
on May 30, 2018
DevOps

A 4-Step Guide to Building Continuous Security into Container Deployment

Containers face security risks at every stage, from building to shipping to the run-time production phases. Securing them requires a layered strategy throughout the stack and the deployment process.

Fei Huang
on Sep 30, 2017
Beyond Blacklisting: Cyberdefense in the Era of Advanced Persistent Threats

In this article, authors discuss the security vulnerabilities in software applications and how whitelisting approach has advantages over blacklisting. They also talk about how to implement the whitelisting security policies and cost involved with it.

Kyle Salous Aaron Beuhring
on Mar 17, 2015
Employing Enterprise Architecture for Applications Assurance

In this article, authors discuss how enterprise, software, and security architects can improve software assurance by using the enterprise architecture to promulgate the software security controls. They also talk about other security model components like threat modeling, attack trees, secure design patterns, and misuse cases.

Walter Houser
on Feb 26, 2015
How Well Do You Know Your Personae Non Gratae?

In this article, author discusses three techniques to defend against malicious users in software systems. These techniques includes creating personas to think strategically about the mischief a malicious user might attempt, misuse cases used to determine how the software should respond to unintended use, and activity diagrams annotated with security concerns.

Jane Cleland-Huang
on Nov 27, 2014