InfoQ Homepage Application Security Content on InfoQ
-
/articles/cell-based-architecture-application-security/en/smallimage/cba-security-small-1729762783227.jpeg)
Securing Cell-Based Architecture in Modern Applications
Securing cell-based architecture is essential to fully capitalize on its benefits while minimizing risks. To achieve this, comprehensive security measures must be put in place. Organizations can start by isolating and containing cells using sandbox environments and strict access control mechanisms like role-based and attribute-based access control.
-
/articles/securing-linux-applications/en/smallimage/proactive-approaches-security-linux-logo-small-1727870445556.jpg)
Proactive Approaches to Securing Linux Systems and Engineering Applications
Maintaining a strong security posture is challenging, especially with Linux. An effective approach is proactive and includes patch management, optimized resource allocation, and effective alerting.
-
/articles/secure-resilient-delivery-pipelines/en/smallimage/GettyImages-1281740358-small-1715175157819.jpg)
Delivering Software Securely: Techniques for Building a Resilient and Secure Code Pipeline
Your CI/CD pipeline can potentially expose sensitive information. Project teams often overlook the importance of securing their pipelines. This article covers approaches and techniques for securing your pipelines.
-
/articles/risk-first-compliance/en/smallimage/from-compliance-first-to-risk-first-small-1703233223207.jpg)
From Compliance-First to Risk-First: Why Companies Need a Culture Shift
Transitioning from a "Compliancе-First" approach to a "Risk-First" mindset rеcognizеs that compliancе should not be viеwеd in isolation, but as a componеnt of a broadеr risk managеmеnt strategy.
-
/articles/dealing-with-java-cves/en/smallimage/dealing-with-Java-CVEs-discovery-detection-analysis-and-resolution-small-1694161273156.jpg)
Dealing with Java CVEs: Discovery, Detection, Analysis, and Resolution
This article delves into the importance of integrating Software Composition Analysis (SCA) in CI/CD pipelines for security. It highlights the need for human oversight to accurately assess vulnerability impact and cautions against "alert fatigue." The article also recommends specialized tools for effective vulnerability management.
-
/articles/devops-security-best-practices/en/smallimage/when-DevOps-meets-security-to-protect-software-small-1680083278523.jpg)
When DevOps Meets Security to Protect Software
Security can no longer be an afterthought in the software development process. Collaboration between security and development needs to happen early to be effective.
-
/articles/secure-software-development-gitops/en/smallimage/accelerating-secure-software-delivery-lifecycle-with-GitOps-small-1679658720410.jpg)
Accelerating the Secure Software Delivery Lifecycle with GitOps
Building secure software can be complicated and time-consuming. By employing a GitOps model, security can be safely separated from development, simplifying the delivery process and increasing velocity.
-
/articles/data-protection-federal/en/smallimage/logo-1673874259012.jpg)
Data Protection Methods for Federal Organizations and beyond
The Federal Data Strategy describes a plan to “accelerate the use of data to deliver on mission, serve the public, and steward resources while protecting security, privacy, and confidentiality." This article covers what it is and how it can be applied to any organization.
-
/articles/api-security-zero-trust/en/smallimage/logo-1669651461014.jpg)
API Security: from Defense-in-Depth (DiD) to Zero Trust
Nearly all companies have experienced security incidents but few have an API security policy that includes dedicated API testing and protection. A defense-in-depth approach that includes boundary defense, observability, and authentication is recommended.
-
/articles/anatomy-code-obfuscation/en/smallimage/logo-1667849003893.jpg)
Who Moved My Code? An Anatomy of Code Obfuscation
In this article, we introduce the topic of code obfuscation, with emphasis on string obfuscation. Obfuscation is an important practice to protect source code by making it unintelligible. Obfuscation is often mistaken with encryption, but they are different concepts. In the article we will present a number of techniques and approaches used to obfuscate data in a program.
-
/articles/integrating-dast-ci-cd/en/smallimage/logo-1666174011486.jpg)
Successfully Integrating Dynamic Security Testing into Your CI/CD Pipeline
Dynamic security testing tools don’t require advanced cybersecurity knowledge to operate. Integrating DAST into your CI/CD pipeline should be done in stages by focusing on the riskiest areas first.
-
/articles/zero-trust-developer-guide/en/smallimage/logo-1659560035351.jpg)
What Developers Must Know about Zero Trust
Zero trust solves the problem of open network access by allowing access only to the resources a user should be allowed to access. This article covers how to start working with zero trust principles and ideas.