Application Security News and Articles


Building secure AI with MLSecOps

In this Help Net Security interview, Ian Swanson, CEO of Protect AI, discusses the concept of “secure AI by design.” By adopting frameworks like Machine Learning Security Operations (MLSecOps) and focusing on transparency, ...

Policy as code in Kubernetes: security with seccomp and network policies

The dynamic world of Kubernetes and cloud security is constantly evolving. As we explore this complicated ecosystem, it’s The post Policy as code in Kubernetes: security with seccomp and network policies appeared first on ARMO. The post Policy ...

Evolving cybercriminal tactics targeting SMBs

A recent Todyl report revealed a 558% increase in BEC (Business Email Compromise), AiTM (Adversary-in-the-Middle), and ATO (Account Takeover) attacks in 2024. In this Help Net Security video, David Langlands, Chief Security Officer at Todyl, ...

Aranya: Open-source toolkit to accelerate secure by design concepts

SpiderOak launched its core technology platform as an open-source project called Aranya. This release provides the same level of security as the company’s platform, which is already in use by the Department of Defense. The Aranya project marks ...

Should the CISOs role be split into two functions?

84% of CISOs believe the role needs to be split into two functions – one technical and one business-focused, to maximize security and organizational resilience, according to Trellix. Regulatory demands pose a growing challenge for CISOs The ...

BSides Exeter – Ross Bevington’s Turning The Tables: Using Cyber Deception To Hunt Phishers At Scale

via Friend of the Blog Trey Blalock From VerficationLabs.com Permalink The post BSides Exeter – Ross Bevington’s Turning The Tables: Using Cyber Deception To Hunt Phishers At Scale appeared first on Security Boulevard.

Ransomware Rising – Understanding, Preventing and Surviving Cyber Extortion

Over the past 6 months I have been researching ransomware, and not even from the technical angle (which would very tempting and no doubt, enlightening in it’s own right), but from a strategic perspective. This approach resonated with many, and ...

USENIX NSDI ’24 – Reasoning About Network Traffic Load Property at Production Scale

Authors/Presenters:Ruihan Li, Fangdan Ye, Yifei Yuan, Ruizhen Yang, Bingchuan Tian, Tianchen Guo, Hao Wu, Xiaobo Zhu, Zhongyu Guan, Qing Ma, Xianlong Zeng, Chenren Xu, Dennis Cai. Ennan Zhai Our sincere thanks to USENIX, and the Presenters & ...

DEF CON 32 – AppSec Considerations From The Casino Industry

Authors/Presenters:Aleise McGowan, Tennisha Martin Our sincere appreciation to DEF CON, and the Presenters/Authors for publishing their timely []DEF CON 32]2 erudite content. Originating from the conference’s events located at the Las Vegas ...

Week in review: 87k+ Fortinet devices still open to attack, red teaming tool used for EDR evasion

Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: 87,000+ Fortinet devices still open to attack, are yours among them? (CVE-2024-23113) Last week, CISA added CVE-2024-23113 – a critical ...

Key Metrics for Shift-Left Security: Metrics Organizations Should Track

Measuring Shift-Left Success: Key MetricsContinue reading on Medium »

USENIX NSDI ’24 – Crescent: Emulating Heterogeneous Production Network at Scale

Authors/Presenters:Zhaoyu Gao, Anubhavnidhi Abhashkumar, Zhen Sun, Weirong Jiang, Yi Wang Our sincere thanks to USENIX, and the Presenters & Authors for publishing their superb 21st USENIX Symposium on Networked Systems Design and ...

USENIX NSDI ’24 – A High-Performance Design, Implementation, Deployment, and Evaluation of The Slim Fly Network

Authors/Presenters:Nils Blach, Maciej Besta, Daniele De Sensi, Jens Domke, Hussein Harake, Shigang Li, Patrick Iff, Marek Konieczny, Kartik Lakhotia, Ales Kubicek, Marcel Ferrari, Fabrizio Petrini, Torsten Hoefler Our sincere thanks to USENIX, ...

Managing Foreign Government Information (FGI) on a Network

If you’re a firm that works with foreign governments, in addition to certifications like ISO 27001 that you will generally need to achieve, you will also have to have processes in place for handling foreign government information or FGI. It’s ...

Pentesting Authentication

Pentesting authentication is a critical step of any gray-box pentest. Here we review steps of how a pentest should assess these controls. The post Pentesting Authentication appeared first on Virtue Security. The post Pentesting Authentication ...

Get an Untrusted Security Advisor! Have Fun, Reduce Fail!

Many organizations are looking for trusted advisors, and this applies to our beloved domain of cyber/information security. If you look at LinkedIn, many consultants present themselves as trusted advisors to CISOs or their teams. Untrusted ...

Is End-User Cybersecurity Training Useless? Spoiler Alert: It’s Not!

Chris Clements, VP of Solutions Architecture Because of the frequency of phishing attacks landing in user mailboxes and the severity of the consequences of a user falling for a lure, any improvement at all can make the difference between an ...

USENIX NSDI ’24 – MESSI: Behavioral Testing of BGP Implementations

Authors/Presenters:Rathin Singha, Rajdeep Mondal, Ryan Beckett, Siva Kesava Reddy Kakarla, Todd Millstein, George Varghese Our sincere thanks to USENIX, and the Presenters & Authors for publishing their superb 21st USENIX Symposium on ...

AI-Generated Personas: Trust and Deception

And the Ethical Dilemma of Using AI to Create Fake Online Personalities In recent years, advancements in artificial intelligence (AI) have given rise to powerful tools like StyleGAN and sophisticated language models such as ChatGPT. These ...

Seceon at GITEX Global 2024: Driving Cybersecurity Innovation with Tech First Gulf

In today’s ever-evolving cybersecurity landscape, organizations are grappling with a delicate balance: safeguarding their digital environments while managing costs and ensuring compliance. At GITEX Global 2024, Seceon proudly joined our partner ...