Application Security News and Articles


Navigating the compliance labyrinth: A CSO’s guide to scaling security

Imagine navigating a labyrinth where the walls constantly shift, and the path ahead is obscured by fog. If this brings up a visceral image, you’ve either seen David Bowie’s iconic film or are very familiar with the real-world challenge of ...

Transforming code scanning and threat detection with GenAI

In this Help Net Security interview, Stuart McClure, CEO of Qwiet AI, discusses the evolution of code scanning practices, highlighting the shift from reactive fixes to proactive risk management. McClure also shares his perspective on the future ...

Why It’s Time to Leave Twitter

In episode 355, Tom discusses his decision to deactivate his Twitter accounts due to privacy concerns with Twitter’s new AI policy and changes in the blocking features. He outlines the steps for leaving Twitter, including how to archive and ...

Evaluating GRC tools

According to Gartner, the broad range of pricing for government, risk, and compliance (GRC) tools requires enterprise risk management (ERM) leaders to be well-versed in distinct pricing tiers of GRC solutions. In this Help Net Security video, ...

ScubaGear: Open-source tool to assess Microsoft 365 configurations for security gaps

ScubaGear is an open-source tool the Cybersecurity and Infrastructure Security Agency (CISA) created to automatically evaluate Microsoft 365 (M365) configurations for potential security gaps. ScubaGear analyzes an organization’s M365 tenant ...

How and where to report cybercrime: What you need to know

Cybercrime reporting mechanisms vary across the globe, with each country offering different methods for citizens to report cybercrime, including online fraud, identity theft, and other cyber-related offenses. Victims are usually instructed to ...

Analyzing JtR’s Tokenizer Attack (Round 1)

Introduction / Goals / Scope: This is a follow-up to my previous blog post looking at how to install/run the new John the Ripper Tokenizer attack [Link]. The focus of this post will be on performing a first pass analysis about how the Tokenizer ...

DEF CON 32 – Process Injection Attacks With ROP

Authors/Presenters: Bramwell Brizendine, Shiva Shashank Kusuma Our sincere appreciation to DEF CON, and the Presenters/Authors for publishing their erudite DEF CON 32 content. Originating from the conference’s events located at the Las Vegas ...

Connecting, Collaborating, and Celebrating: Our Global Team Seminar in the South of France

Last September, GitGuardian brought together its 150 Guardians from around the world for a three-day seminar on the beautiful Giens Peninsula in the south of France. The post Connecting, Collaborating, and Celebrating: Our Global Team Seminar in ...

Advanced Strategies for SAST Scanning in CI/CD Pipelines in the Age of AI

Optimising SAST scanning in CI/CD pipelines for greater security, agility, and developer productivityContinue reading on Medium »

Week in review: Microsoft patches actively exploited 0-days, Amazon and HSBC employee data leaked

Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: Microsoft fixes actively exploited zero-days (CVE-2024-43451, CVE-2024-49039) November 2024 Patch Tuesday is here, and Microsoft has dropped ...

DEF CON 32 – Sudos And Sudon’ts: Peering Inside Sudo For Windows

Authors/Presenters: Michael Torres Our sincere appreciation to DEF CON, and the Presenters/Authors for publishing their erudite DEF CON 32 content. Originating from the conference’s events located at the Las Vegas Convention Center; and via ...

Cyber Crisis Management Plan: Shield for Brand Reputation

Despite advances in security technology, cybersecurity attacks and data breaches are increasingly common as attackers keep discovering new vulnerabilities and infiltration methods. Organizations now understand that a cyberattack or data breach is ...

The SEC Cybersecurity Rule: Awareness Rises, Compliance Lags

Explore how the SEC Cybersecurity Rule has raised boardroom awareness, but why achieving true resilience and transparency remains a critical challenge. The post The SEC Cybersecurity Rule: Awareness Rises, Compliance Lags appeared first on ...

The Value of Database Subsetting

Subsetting is the unsung hero of modern test data workflows. Today, we’re excited to spotlight several recent innovations in our subsetter that are making this powerful solution even more impactful. The post The Value of Database Subsetting ...

How to Create Realistic Test Data for Amazon Redshift

Learn how to create realistic test data for Amazon Redshift with Tonic! Safely generate realistic test data with our one-stop shop for synthetic data. The post How to Create Realistic Test Data for Amazon Redshift appeared first on Security ...

What is Data Subsetting? The Art and Science of Only Using the Data You Need

There’s one ring to rule them all when it comes to smaller and more efficient databases—and it’s called subsetting with Tonic. Read on to learn more. The post What is Data Subsetting? The Art and Science of Only Using the Data You Need ...

Build vs. Buy? Test Data Doesn’t Have to be Another In-House Project

After leading the deployment of Tonic at two companies and attempting to build similar solutions in-house, a DevOps and Engineering leader keeps coming back to Tonic for sourcing quality test data with a rapid time to value. The post Build vs. ...

How To Create Realistic Test Data For MySQL

We take a look at how to create realistic test data for MySQL! With Tonic's generators, your test data will act and look exactly like production data. The post How To Create Realistic Test Data For MySQL appeared first on Security Boulevard.

Life in the Swimlane with Connor Mansfield, Senior SDR

The post Life in the Swimlane with Connor Mansfield, Senior SDR appeared first on AI-Enhanced Security Automation. The post Life in the Swimlane with Connor Mansfield, Senior SDR appeared first on Security Boulevard.