Webappsec->General

0a8cae998f9c51e3b3c0ccbaddf521aa

Choosing the Right Entry Point for a Software Security Program

June 30, 2014 Added by:Rafal Los

The topic of software security, or AppSec, has once again cropped up recently in my travels and conversations so I thought it would be prudent to address that here on the blog.

Comments  (0)

219bfe49c4e7e1a3760f307bfecb9954

Software Security: An Imperative to Change

June 05, 2014 Added by:Rohit Sethi

Attention-grabbing exploits are becoming the norm. We hear about bugs like Heartbleed and IE 0days almost every week. Understandably the public is concerned about insecure technology. Yet for those of us who work in information security, this isn’t news at all. We have long known that insecure software is the root cause of most breaches.

Comments  (0)

B64e021126c832bb29ec9fa988155eaf

Quick and Easy Website Vulnerability Scans with OWASP-ZAP

June 05, 2014 Added by:Dan Dieterle

OWASP ZAP is a web application penetration testing tool that has some great features. It is a very easy to use scanner that allows you to do manual or automatic website security checks. In this tutorial we will learn how to use the automatic attack feature.

Comments  (0)

Bd07d58f0d31d48d3764821d109bf165

Proactively Hardening Systems: Application and Version Hardening

May 20, 2014 Added by:Tripwire Inc

If configuration hardening settings are “conditional,” meaning they must find and keep that balance between security and productivity, hardening against known vulnerabilities in applications and versions is much more black-and-white.

Comments  (0)

Bd07d58f0d31d48d3764821d109bf165

Heartbleed, Open Source and Open Sores

May 08, 2014 Added by:Tripwire Inc

Now that things are settling down after Heartbleed, I think about some of the conversations I’ve had about OpenSSL and open source software over the past couple of weeks.

Comments  (1)

Bd07d58f0d31d48d3764821d109bf165

Heartbleed Should Give You Cardiac Arrest

April 09, 2014 Added by:Tripwire Inc

Estimates are over 66% of active websites on the internet may be vulnerable to this bug, found in OpenSSL, an open source cryptographic library used in the Apache web server and ignx when creating communications with users.

Comments  (0)

7ddc1f3000a13e4dfec28074e9e7b658

Websites Must Use HSTS in Order to Be Secure

April 07, 2014 Added by:Electronic Frontier Foundation

So why haven't more websites enabled HSTS? The biggest reason, we fear, is that web developers just don't know about it.

Comments  (0)

B64e021126c832bb29ec9fa988155eaf

Getting a Remote Shell on an Android Device using Metasploit

February 19, 2014 Added by:Dan Dieterle

In this post we will show you how to get a remote shell on an Android by using Metasploit in Kali Linux.

Comments  (0)

9fb165a9b7dfef2a9f8ac7d69b22a42c

Vertical Password Guessing Attacks Part II

February 19, 2014 Added by:Vince Kornacki

Attackers utilize a variety of tools to automate password guessing attacks, including Hydra, Nmap in conjunction with the http-form-brute script, and homegrown scripts. In this post, Vince explains how to conduct Vertical Password Guessing Attacks.

Comments  (0)

39eb20ce0f68b66e0bd72c5d1e2954fe

Vulnerabilty Remediation Tips

January 29, 2014 Added by:Krishna Raja

Discovering vulnerabilities is often the main objective of security teams within large organizations. This is achieved through initiatives such as penetration testing and source code review. But as we know, this is only the first step towards a secure organization.

Comments  (2)

022aafe7eef823af1fa3931a5539ae49

How SAMM Addresses Outsourced Development

January 28, 2014 Added by:Nima Dezhkam

Despite SAMM’s comprehensive guidelines around establishing an organization-wide security program and integrating security into in-house software development life-cycle, it does not elaborate as much on third-party vendor security and outsourced software development.

Comments  (0)

219bfe49c4e7e1a3760f307bfecb9954

The NIST Cyber Security Framework Completely Misses the Mark

January 06, 2014 Added by:Rohit Sethi

The NIST Cyber Security Framework completely lacks any mention of application security. We predict that organizations will likewise adopt the framework with scant attention paid to secure software, which will lull them into a false sense of security.

Comments  (0)

219bfe49c4e7e1a3760f307bfecb9954

CMMI for Application Security - 4 High-Impact Implementation Considerations

December 02, 2013 Added by:Rohit Sethi

Ponemon Institute and Security Innovation recently made public the results of a research study they did to get an idea of the state of application security across organizations.

Comments  (0)

54b393d8c5ad38d03c46d060fa365773

Security Advisor Alliance, A Nonprofit of Elite CISOs giving back to the community.

November 12, 2013 Added by:Jason Clark

Security Advisor Alliance is a nonprofit group of Top security leaders from the Global 1000 who have come together to donate time each week to help our peers in any area of security as a pro-bono service.

Comments  (0)

219bfe49c4e7e1a3760f307bfecb9954

Why Manual Testing is Worth the Extra Buck: Weighing the Pros & Cons

November 12, 2013 Added by:Rohit Sethi

Businesses often ask for guidance on whether they need to do a manual penetration test for a specific application or if automated testing suffices. Here I try to briefly describe some of the advantages and disadvantages of each method and explain our preferred approach.

Comments  (1)

219bfe49c4e7e1a3760f307bfecb9954

Security Training Program – Fixed or Customized?

November 07, 2013 Added by:Rohit Sethi

Vishal Asthana, takes a closer look at key questions to ask when implementing a software developer security training program.

Comments  (0)

Page « < 1 - 2 - 3 - 4 - 5 > »