Category: DZone Security Zone

iOS Application Security for Beginners

This article provides a brief overview of techniques that can be used in your mobile iOS application to keep it secure enough for the vast majority of cases. If you are a junior or middle iOS developer and have not…

Cybersecurity in the Cloud: Integrating Continuous Security Testing Within DevSecOps

Cloud computing has revolutionized software organizations’ operations, offering unprecedented scalability, flexibility, and cost-efficiency in managing digital resources. This transformative technology enables businesses to rapidly deploy and scale services, adapt to changing market demands, and reduce operational costs. However, the transition…

Secure Your API With These 16 Practices With Apache APISIX (Part 2)

Last week, we listed 16 practices to help secure one’s APIs and described how to implement them with Apache APISIX. Authentication: Verifies the identity of users accessing APIs. Authorization: Determines permissions of authenticated users. Data Redaction: Obscures sensitive data for…

Guarding the Gates of GenAI: Security Challenges in AI Evolution

Generative AI (GenAI) represents a significant leap in artificial intelligence, enabling the creation of novel and realistic data, from text and audio to images and code. While this innovation holds immense potential, it also raises critical concerns regarding data security…

Maximizing Feedback for Developers With Continuous Testing

Developers need feedback on their work so that they know whether their code is helping the business. They should have “multiple feedback loops to ensure that high-quality software gets delivered to users”[1]. Development teams also need to review their feedback…

The Role of Penetration Testing in Strengthening Cyber Defenses

Digital security has become a significant worry for organizations of different sizes in today’s fast-paced world. With the rate at which digital threats continue to develop, enhancing security measures is very important to protect vulnerable data and infrastructure. This defense…

Top 5 Common Cybersecurity Attacks MSPs Should Know in 2024

As Managed Service Providers (MSPs) continue to play a crucial role in managing IT services for businesses, understanding the landscape of cybersecurity threats becomes paramount. The year 2024 is no exception, with cybercriminals employing more sophisticated methods to breach defenses.…

Critical Infrastructure Protection in the Age of Cyber Threats

Critical Infrastructure Protection is the need to safeguard a nation/region’s important infrastructures, such as food, agriculture, or transportation. Critical infrastructures include transportation systems, power grids, and communication systems. Critical infrastructure protection is important to communities because any damage to these…

Explore Salesforce OAuth Authorization Flows and Its Use Cases

Have you authorized an application to access Salesforce without giving your credentials to that application? Then, you must have used a Salesforce OAuth authorization flow. OAuth is a standard for authorization. Salesforce uses several OAuth flows, and all these flows…

Unveiling the Power of Virtual Private Networks (VPNs)

Concerns about internet privacy and security are more common than ever in the quickly changing digital environment. As individuals and organizations participate in a variety of online activities, the necessity to protect sensitive information has resulted in the widespread use…

Best Practices To Secure Stateless REST Applications

Statelessness in RESTful applications poses challenges and opportunities, influencing how we manage fundamental security aspects such as authentication and authorization. This blog aims to delve into this topic, explore its impact, and offer insights into the best practices for handling…

Build a Flow Collectibles Portal Using Cadence (Part 2)

Welcome to the final step in creating your Collectibles portal! (for part 1, see here). In this part, we’ll focus on building the front end — the last piece of the puzzle. Here’s what we’ll achieve: This article has been…

Security Best Practices for Docker Images

Docker images play a pivotal role in containerized application deployment. They encapsulate your application and its dependencies, ensuring consistent and efficient deployment across various environments. However, security is a paramount concern when working with Docker images. In this guide, we…

Web Application Security: The Ultimate Guide to Coding Best Practices

Web applications have become deeply integrated into business operations and everyday life. However, this reliance also introduces major security risks if applications are not properly coded and configured. Implementing secure coding practices is, therefore, essential for any web application. Not…

The Art of Ethical Hacking: Securing Systems in the Digital Age

In today’s world, where everything is connected to the internet, cybersecurity is more significant than ever. Cyberattacks can cause serious damage to individuals, businesses, and governments by stealing data, disrupting services, or compromising systems. To prevent these attacks, we must…

Secure Your API With These 16 Practices With Apache APISIX (Part 1)

A couple of months ago, I stumbled upon this list of 16 practices to secure your API: Authentication: Verifies the identity of users accessing APIs. Authorization: Determines permissions of authenticated users. Data redaction: Obscures sensitive data for protection. Encryption: Encodes data…

Exploring the Nexus Between DevSecOps and Cybersecurity

DevSecOps, short for Development, Security, and Operations, is an approach to software development that integrates security practices into the DevOps (Development and Operations) process. The main goal of DevSecOps is to ensure that security is an integral part of the…

Hiding Data in DB2

In this article, we’ll talk about fine-grained access control in DB2 – hiding data that is, in fact, present in the database, but should not be accessible to certain users. Fine-grained access control is usually done in the database itself…

Common Cybersecurity Threats and How To Protect Yourself

Cybersecurity threats are acts performed by people with hurtful expectations, whose objective is to take information, do harm or disrupt computing systems. Normal classes of cyber threats include malware, social engineering, man-in-the-middle (MitM) attacks, denial of service (DoS), and injection…

Safe Clones With Ansible

I started research for an article on how to add a honeytrap to a GitHub repo. The idea behind a honeypot weakness is that a hacker will follow through on it and make his/her presence known in the process.  My…

Cybersecurity: A Trojan Horse in Our Digital Walls?

The rapid advancement of artificial intelligence (AI) in cybersecurity has been widely celebrated as a technological triumph. However, it’s time to confront a less discussed but critical aspect: Is AI becoming more of a liability than an asset in our…

NIST AI Risk Management Framework: Developer’s Handbook

The NIST AI RMF (National Institute of Standards and Technology Artificial Intelligence Risk Management Framework) provides a structured framework for identifying, assessing, and mitigating risks associated with artificial intelligence technologies, addressing complex challenges such as algorithmic bias, data privacy, and…

The Noticeable Shift in SIEM Data Sources

SIEM solutions didn’t work perfectly well when they were first introduced in the early 2000s, partly because of their architecture and functionality at the time but also due to the faults in the data and data sources that were fed…

K8s Network Policy Automation in Falco Talon

Setting up robust network security in Kubernetes is a challenge that demands both precision and adaptability. NetworkPolicy offers the potential for highly specific network configurations, enabling or blocking traffic based on a comprehensive set of criteria. However, the dynamic nature…

Integration Security and Safety When Connecting With External Systems

Any organization with interconnected systems must prioritize integration security in order to safeguard sensitive business and customer information. But with so many options for securing integrations, picking the right combination of features and protocols could make or break your security.…

Designing for Security

Security is an important aspect of any software application. Often, it is the least priority and is overlooked while designing a system. The main focus is emphasized on functional and non-functional requirements to design our system for end users. However,…

How to Onboard and Protect Remote Teams With Secure Cloud Environments

How Secure Cloud Development Addresses the Challenge of Working Securely With Remote Teams The landscape of software development is constantly changing, and secure Cloud Development Environments (CDEs) have brought about a remarkable transformation in secure project management and execution when…

Security Considerations in Kubernetes

Kubernetes is a robust container orchestration technology that is extensively used for containerized application deployment, scaling, and management. While Kubernetes provides a number of capabilities for protecting containerized workloads, it is critical to understand and handle numerous security aspects in…

Securing Your AWS RDS Instances: Best Practices and Examples

Amazon Web Services (AWS) Relational Database Service (RDS) simplifies the setup, operation, and scaling of a relational database in the cloud. It provides cost-efficient and resizable capacity while automating time-consuming administration tasks such as hardware provisioning, database setup, patching, and…

VPN Log vs. Zero-Log Policy: A Comprehensive Analysis

Data, often referred to as the lifeblood of modern businesses, enables organizations to embrace innovations that further enhance productivity. However, harnessing this power comes with great risks. Increasing reliance on data being collected comes with the challenges of safeguarding this…

The Impact of Open-Source Software on Public Finance Management

Many government bodies have historically been averse to open-source software (OSS). Now that OSS has gained popularity and shown what it can do in the private sector, that’s changing. The open-source movement holds significant potential for public agencies, too, especially…

Combating Malware Threats

In the digital age, the security landscape is continually evolving, with malicious actors developing and deploying a variety of sophisticated malware to exploit systems, steal data, and disrupt operations. Understanding the diverse array of malware types is crucial for individuals,…

Hardening Apache APISIX With the OWASP’s Coraza and Core Ruleset

The Open Worldwide Application Security Project is an online community that produces freely available articles, methodologies, documentation, tools, and technologies in the fields of IoT, system software and web application security. The OWASP provides free and open resources. It is…

Good Application Security Posture Requires Good Data

The term ‘security posture” is used to describe the state of an organization’s overall security and response readiness. Multiple solutions are emerging that aggregate findings to provide a holistic view of enterprise security risks. Security posture can also be seen…

Best Practices To Create Highly Secure Applications in Mule 4

In this blog, I would like to share a few best practices for creating highly secure applications in Mule 4 (security at various levels/layers — application, data, etc.) for all deployment options. Most of the configuration details (relevant to security)…

A Comprehensive Guide To Achieving SOC 2 Compliance

Data security and privacy are one of the top priorities for organizations and their clients in the current digital era. Industry standards and regulatory frameworks have been developed to make sure that businesses manage sensitive data appropriately. The SOC (System…

Composability in Flow: Unlocking Technical and Business Opportunities

Composability in blockchains refers to a framework that permits the interaction and interconnection of discrete elements, especially smart contracts. This kind of modular ecosystem is important as it helps programmers utilize existing components to build advanced systems very quickly. In…

Choosing the Right SMB Backup Solution

In today’s digital age, data is the lifeblood of small and medium-sized businesses (SMBs). Whether it’s customer records, financial data, or intellectual property, the loss of critical information can be disastrous. To safeguard against such potential disasters, SMBs must invest…

Patch Management and Container Security

What Is Patch Management? Patch management is a proactive approach to mitigate already-identified security gaps in software. Most of the time, these patches are provided by third-party vendors to proactively close the security gaps and secure the platform, for example.…

The Trusted Liquid Workforce

Remote Developers Are Part of the Liquid Workforce The concept of a liquid workforce (see Forbes, Banco Santander, etc.) is mostly about this: A part of the workforce is not permanent and can be adapted to dynamic market conditions. In…

Data Lineage in Modern Data Engineering

Data lineage is the tracking and visualization of the flow and transformation of data as it moves through various stages of a data pipeline or system. In simpler terms, it provides a detailed record of the origins, movements, transformations, and…

The Role of DevOps in Enhancing the Software Development Life Cycle

Software development is a complex and dynamic field requiring constant input, iteration, and collaboration. The need for reliable, timely, and high-quality solutions has never been higher in today’s fiercely competitive marketplace. Enter DevOps, a revolutionary approach that serves as the…

Top 4 Developer Takeaways From the 2024 Kubernetes Benchmark Report

We already know that Kubernetes revolutionized cloud-native computing by helping developers deploy and scale applications more easily. However, configuring Kubernetes clusters so they are optimized for security, efficiency, and reliability can be quite difficult. The 2024 Kubernetes Benchmark Report analyzed over…

Simplifying Data Management for Technology Teams With HYCU

Managing data across complex on-premise, multi-cloud, and SaaS environments is an increasingly difficult challenge for technology developers, engineers, and architects. With data now spread across over 200 silos on average, most organizations are struggling to protect business critical information residing…

DLP: AI-Based Approach

DLP, or Data Loss Prevention, is a proactive approach and set of technologies designed to safeguard sensitive information from unauthorized access, sharing, or theft within an organization. Its primary goal is to prevent data breaches and leaks by monitoring, detecting,…

From Chaos to Control: Nurturing a Culture of Data Governance

The evolving nature of technology, increased data volumes, novel data regulations and compliance standards, and changing business landscapes in the last decade are resulting in data chaos and inconsistency for many enterprises, and that is resulting in enterprises going towards…

Legal and Compliance Considerations in Cloud Computing

Cloud computing has transformed software development and management, facilitating unparalleled scalability, flexibility, and cost efficiency. Nevertheless, this paradigm change has faced challenges, primarily legal and compliance issues. Data, services, and infrastructure often reside in a nebulous space, not directly owned…

SIEM Volume Spike Alerts Using ML

SIEM stands for Security Information and Event Management.  SIEM platforms offer centralized management of security operations, making it easier for organizations to monitor, manage, and secure their IT infrastructure. SIEM platforms streamline incident response processes, allowing security teams to respond…

Rethinking Data Governance: Metrics for Meaningful Outcomes

For years, data governance has been obsessed with a metric that feels more like accounting than strategic decision-making: coverage. Data Governance tool vendors educated a generation of governance professionals to diligently track the percentage of documented data, chasing a completion…

Device and Data Security in Embedded Systems

Embedded systems are at the core of our modern-age technology, powering everything from smart electronic devices to connected applications. These systems have become crucial in various industries enabling advanced applications. However, the security of these devices has become a major…

Edge Security for IoT: Protecting Data at the Edge

The Internet of Things (IoT) has rapidly expanded the landscape of connected devices, revolutionizing industries ranging from healthcare to manufacturing. However, as the number of IoT devices continues to grow, so do the security challenges. One crucial aspect of IoT…

Data Governance and DevOps

In the age of information, “data is treasure.” With trillions of datasets encapsulating the world, data is fragile. Safeguarding data is imperative, and data governance ensures data is managed, safe, and in compliance. Data Governance Data governance overlooks data. It…

TPM Chips and the Use of TPM in Virtualization Technology

The Trusted Platform Module (TPM) is an important component in modern computing since it provides hardware-based security and enables a variety of security features. TPM chips have grown in relevance in both physical and virtual contexts, where they play a…

Securing the Digital Frontier

In an era where digitalization permeates every facet of our lives, the interplay between technology, society, and regulations becomes increasingly critical. As we navigate through a world brimming with data, understanding the evolving landscape of data protection is not just…

How To Implement Supply Chain Security in Your Organization

In the ever-evolving landscape of digital innovation, the integrity of software supply chains has become a pivotal cornerstone for organizational security. As businesses increasingly rely on a complex web of developers, third-party vendors, and cloud-based services to build and maintain…

Monitoring Dynamic Linker Hijacking With eBPF

Extended Berkeley Packet Filter (eBPF) is a programming technology designed for the Linux operating system (OS) kernel space, enabling developers to create efficient, secure, and non-intrusive programs. Unlike its predecessor, the Berkeley Packet Filter (BPF), eBPF allows the execution of…

Maven Dependency Scope Applied

To get started, we are going to take an example of a typical three-layer app to analyze the module boundaries and the challenges faced in managing them. This specific architecture has been intentionally chosen, assuming that it is familiar to…

Building Decentralized Applications With Node.js and Web 3.0

This new era is characterized by the rise of decentralized applications (DApps), which operate on blockchain technology, offering enhanced security, transparency, and user sovereignty. As a full-stack developer, understanding how to build DApps using popular tools like Node.js is not…

Private Cloud’s Deployment

Public clouds are designed for everyone but there are a lot of customers that need a private version of the cloud. Sometimes, they need physically isolated data centers and networks located in their own country. These private clouds offer Platform-as-a-Service…

The Need for Secure Cloud Development Environments

The use of Cloud Development Environments (CDEs) allows the migration of coding environments online. Solutions range from using a self-hosted platform or a hosted service. In particular, the advantage of using CDEs with data security, i.e., secure Cloud Development Environments,…