Dependency Checking Your Ruby Application

Dependency Checking Your Ruby Application Checking your application’s dependencies for known vulnerabilities is a critical, relatively low effort step you should take to secure your application, which you may have read about in another recent article: What is SCA? Compared to the wealth of tools used for dependency checking in, for example JavaScript,  there’s not […]

Read more
Database Security – A Pentester’s Notes
Padlock on a green door

One of the most prevalent issues that continue to vex application developers is weaknesses in database security that open us to exploit.  Database security is a broad subject, and I will not cover all the security issues here but want to provide context and understanding around some of the more comment vulnerabilities. In this blog, […]

Read more
What is WAF?
WAF

Before diving into WAF security, it’s important to note the difference between web servers and application servers. A web server is internet facing on the front end, while an application server is where the code resides and is not internet facing. Between the web server and app server, all the HTTPs encrypted data is decrypted […]

Read more
What is SCA?
SCA

SCA stands for Software Composition Analysis. It’s a technique where you try to analyze the dependencies that your application includes to make sure that they don’t have any known vulnerabilities. In fact, up to 80% of the components that we include in our applications have some known vulnerability in them which can expose our applications […]

Read more
Using a Green Screen / Chroma Keying

So you want an interesting and professional background when you present online? Given how increasingly prevalent online presentation is, you might want to consider the possibility of using a technique called Chroma Keying, also known as green-screen.   What you’ll need: Green material – fabric or screen or poster board. Vivid and flat color works best. […]

Read more
What is RASP?
RASP

RASP stands for Runtime Application Self Protection. Like IAST it’s agent based, so it watches your software run and tries to determine if something is attacking it. The goal of IAST is to try to determine if something’s attacking it by a certain behavior. RASP adds a layer to that by recognizing something’s attacking it […]

Read more
What is IAST?
IAST

IAST stands for Interactive Application Security Testing. The basic idea is that you have software that watches your application running, usually in a Java or .NET world that uses what’s called the profiling API, and it watches everything that happens in your application and tries to determine if that activity is somehow attacking the software. […]

Read more
5 Tips to Ensure A Successful Remote Daily Scrum
Working from home

As I mentioned in my previous post, this is a challenging time for agile teams as we are transitioning to being fully remote. Many are struggling to follow the agile principles, especially those that promote co-location and face-to-face communication. But even though we now find ourselves in a situation where these principles are challenging, it […]

Read more
What is DAST?
DAST

DAST stands for Dynamic Application Security Testing, and it’s a blackbox suite of tools that really look at web applications on the front end. DAST looks at a running application looking for potential security vulnerabilities, architectural weaknesses, SQL injection, and cross-site scripting, among other security risks in the OWASP Top Ten. How is SAST different […]

Read more
X