Devsecops
Devsecops | News, how-tos, features, reviews, and videos
GitHub begins 2FA rollout for code contributors
GitHub’s 2FA rollout seeks to enhance the security of developer accounts and protect the software supply chain.
Gitpod flaw shows cloud-based development environments need security assessments
The quickly fixed flaw could have allowed attackers to take over accounts in the CDE and perform remote code execution.
Malicious package flood on PyPI might be sign of new attacks to come
The PyPI package flood is just the latest in a string of attacks on public repositories with the intent to plant malicious code.
Descope launches authentication and user management SaaS
Descope’s first product allows developers to build authentication and user management functions in applications.
New “MITRE ATT&CK-like” framework outlines software supply chain attack TTPs
The OSC&R Framework aims to help security professionals better understand and measure software supply chain risk.
PyTorch suffers supply chain attack via dependency confusion
A rogue packet on the machine learning framework allowed the attacker to exfiltrate data, including SSH keys.
Log4Shell remains a big threat and a common cause for security breaches
Log4Shell is likely to remain a favored vulnerability to exploit as organizations lack visibility into their software supply chains.
MTTR “not a viable metric” for complex software system reliability and security
Verica Open Incident Database Report suggests mean time to resolve should be retired and replaced with other metrics more appropriate for software systems and networks.
How Cisco keeps its APIs secure throughout the software development process
Cisco’s API-for-an-API project unifies API security tools and weaves security through all stages of the software process.
GitHub releases new SDLC security features including private vulnerability reporting
GitHub also announces CodeQL support for Ruby programming language and coverage/risk overviews to help users secure the software development lifecycle.
Rezilion expands SBOM to support Windows environments
Organizations can now apply Rezilion’s SBOM to Windows environments to manage software vulnerabilities and meet regulatory standards.
Qualys previews TotalCloud FlexScan for multicloud security management
Agentless security management system aims to simplify vulnerability management for security teams and developers in cloud and hybrid cloud environments.
![Digital bugs amid binary code. [security threats / malware / breach / hack / attack]](https://images.idgesg.net/images/article/2020/09/digital_bugs_amid_binary_code_security_threats_malware_breach_hack_attack_by_whatawin_gettyimages-1188254819_2400x1600-100858616-small.3x2.jpg?auto=webp&quality=85,70)
Azul detects Java vulnerabilities in production apps
Azul Vulnerability Detection promises to eliminate false positives without impacting performance, by drawing on monitoring and detection capabilities inside the Azul JVM.
The OSPO – the front line for secure open-source software supply chain governance
An open-source program office (OSPO) can act as both gatekeeper and evangelist in an organization’s struggle to ensure ubiquitous open-source components – incredibly useful but vulnerable to bad actors and misuse – are deployed safely...
Supply chain attacks increased over 600% this year and companies are falling behind
Most companies believe they are using no open-source software libraries with known vulnerabilities, but new research finds them in 68% of selected enterprise applications.
GitGuardian adds IaC scanning to code security platform to protect SDLC
Vendor says new infrastructure-as-code (IaC) scanning features will help teams develop and run secure code as software development and supply chain security continues to be high on the agenda.
Enterprises embrace devsecops practices against supply chain attacks
Healthy developer-team culture and adherence to devsecops best practices to protect against supply chain attacks are surprisingly commonplace in today’s security environment, according to a report from Google Cloud's DORA research...