Tag: DZone Security Zone

Distributed PKI vs Traditional PKI

Read the original article: Distributed PKI vs Traditional PKI With the rise of cryptocurrency, blockchain technology has grown from an obscure niche solution to one of the most hyped new technologies of the last decade. Enthusiasts are claiming blockchain will…

API Security Weekly: Issue #86

Read the original article: API Security Weekly: Issue #86 Vulnerability: Sign In With Apple Sign in with Apple is an OAuth-like social logon system from Apple. It is widely used, and in fact, Apple mandate the inclusion of Sign in…

Zero Day Attacks – A Sleeping Disaster

Read the original article: Zero Day Attacks – A Sleeping Disaster ‘Zero-day attack’ is a phrase used for describing the threat of an unknown security vulnerability in computer software or application that a patch has not been released – or…

Accuracy in AppSec Is Critical to Reducing False Positives

Read the original article: Accuracy in AppSec Is Critical to Reducing False Positives According to a new report from the Neustar International Security Council (NISC), over one-quarter of security alerts fielded within organizations are false positives. Surveying senior security professionals…

Container and Kubernetes Security: A 2020 Update

Read the original article: Container and Kubernetes Security: A 2020 Update Security has always been a big issue in the fast-paced world of DevOps, Continuous Integration, and Continuous Delivery. Despite the multitude of tools and tech currently available for integrating…

Simplified Blockchain Part One: Theory

Read the original article: Simplified Blockchain Part One: Theory Blockchain in Two Words You can interpret blockchain as a distributed database, each node of which is launched on the client side. All nodes synchronize (validate and confirm) all transactions among…

What Is a Sniffing Attack?

Read the original article: What Is a Sniffing Attack? Introduction In this article, we will be discussing what is a sniffing attack and how you can save yourself or an organization from a sniffing attack. We will also cover some…

Traditional AppSec Code Halts Kill DevOps Release Cycles

Read the original article: Traditional AppSec Code Halts Kill DevOps Release Cycles In recent years, the application security (AppSec) field has not advanced as rapidly as the software development discipline. While developers are under constant pressure to push code, legacy…

OAuth 2.0 vs Session Management

Read the original article: OAuth 2.0 vs Session Management There seems to be a lot of misinformation on when OAuth 2.0 (henceforth referred to as OAuth) is appropriate for use. A lot of developers confuse OAuth with web session management…

SecureSDLC – The Next Gen SDLC

Read the original article: SecureSDLC – The Next Gen SDLC People with exposure to software development space will very well understand SDLC (Software Development Life Cycle). Still, let’s do a quick recap. The SDLC framework defines the processes used by…

Using Amazon CloudWatch Synthetics and Service Lens

Read the original article: Using Amazon CloudWatch Synthetics and Service Lens Real-time monitoring is invaluable in today’s market. Everyone is trying to deliver the best user experience, so there is a higher need for capable and reliable cloud services to…

Secure PHP Programming: Two Common Mistakes to Avoid

Read the original article: Secure PHP Programming: Two Common Mistakes to Avoid PHP (Hypertext Preprocessor) is a server-side scripting language that has matured over the years — it was first released in 1995! The latest stable version of the language,…

How to Create Your Own Cryptocurrency Blockchain in Python

Read the original article: How to Create Your Own Cryptocurrency Blockchain in Python Cryptocurrencies and their underlying blockchain technology have taken the world by surprise —from their humble beginnings a few years ago to current everyday conversation point. Typically, a…

API Security Weekly: Issue #85

Read the original article: API Security Weekly: Issue #85 Vulnerability: Google Cloud Deployment Manager Google Cloud Deployment Manager is an infrastructure management service that makes it simple to create, deploy, and manage Google Cloud Platform resources. Ezequiel Pereira found an…

What Is PKCE?

Read the original article: What Is PKCE? PKCE is short for Proof Key for Code Exchange. It is a mechanism that came into being to make the use of OAuth 2.0 Authorization Code grant more secure in certain cases. Why…

Diffie Hellman Key Exchange

Read the original article: Diffie Hellman Key Exchange In early 70’s to send a secret message, both parties (sender and receiver) had to exchange the key to encrypt and decrypt the message. Exchanging the secret key may lead to compromising…

10 Node.js Security Practices

Read the original article: 10 Node.js Security Practices Web application security is rapidly becoming a major concern for companies as security breaches are becoming expensive by the day. The Open Web Application Security Project (OWASP) is a non-profit organization dedicated…

Direct EDI Software vs. EDI VAN

Read the original article: Direct EDI Software vs. EDI VAN Throughout the world, companies large and small alike are increasingly adding, expanding, and modernizing their electronic data interchange (EDI) communications. If you need to meet partner EDI mandates or wish…

How to Overcome File Transfer Security Risks

Read the original article: How to Overcome File Transfer Security Risks Individuals are constantly transferring files to their colleagues and trading partners, whether those files are Word documents, reports and spreadsheets, or shipping notices and acknowledgments. Most of the time,…

API Security Weekly: Issue #84

Read the original article: API Security Weekly: Issue #84 Vulnerability: Google Firebase Google Firebase is a development platform for mobile apps. It claims to be used in over 1.5 million mobile apps to provide standard platform functions like authentication, cloud…

Two-Way SSL Authentication Setup in Mule

Read the original article: Two-Way SSL Authentication Setup in Mule What is Two-Way SSL? Two-way SSL means that a client and a server communicates on a verified connection with each other. The verifying is done by certificates to identify. A…

Getting Started With Infura’s Ethereum API

Read the original article: Getting Started With Infura’s Ethereum API A step-by-step tutorial to help you get set-up with Infura and start using the Infura Ethereum API. Hey there! Infura provides developers and enterprises with simple, reliable access to Web3…

All You Need to Know About User Session Security

Read the original article: All You Need to Know About User Session Security What follows is a two-part series on session management  —  inspired by extensive conversations with over 70 developers and our own intensive research. We will explore different…

Deep Dive Into NPM Security

Read the original article: Deep Dive Into NPM Security The Node Package Manager, abbreviated as NPM, is the premier registry for software packages in the Node.js ecosystem and has become one of the largest registries for software packages in the…

Securing Hazelcast With Cert-Manager

Read the original article: Securing Hazelcast With Cert-Manager Cert-Manager became a standard way of issuing and rotating certificates in Kubernetes and OpenShift environments. Simple to install. Simple to use. Well integrated with Vault and other secret managers. No surprise it’s…

Container and Kubernetes Security: A 2020 Update

Read the original article: Container and Kubernetes Security: A 2020 Update Security has always been a big issue in the fast-paced world of DevOps, Continuous Integration, and Continuous Delivery. Despite the multitude of tools and tech currently available for integrating…

Are You Using JWTs for User Sessions Correctly?

Read the original article: Are You Using JWTs for User Sessions Correctly? JSON Web Tokens (or JWTs) have become incredibly popular, and you’ve likely heard of them before. What you may not have heard is that JWTs were originally designed…

Cryptography Module in Mule 4

Read the original article: Cryptography Module in Mule 4 Steps to Use JCE Encrypt and JCE Decrypt Connectors Check if Crypto module is available in Mule Palette. If not, download it from exchange. Then, search for JCE in the Mule…

All You Need to Know About Browser Fingerprints

Read the original article: All You Need to Know About Browser Fingerprints Unlike the static websites of the past, today’s websites are honed to be able to identify your device through a set of parameters and using a range of…

Generating OAuth Tokens Part 1

Read the original article: Generating OAuth Tokens Part 1 We will talk about how to generate OAuth tokens. When using OAuth tokens, passwords are not shared between services. Instead, tokens are used for authentication. Here, we will create a basic…

How AI Is Improving Privacy in 2020

Read the original article: How AI Is Improving Privacy in 2020 If you’re like everyone else around the world, privacy is a big deal. We regularly upload our personal information to websites when we make purchases, we also add customer…

Infrastructure as Code Security

Read the original article: Infrastructure as Code Security Infrastructure as Code and the bigger concept of DevOps for business applications are accelerating the utilization of cloud computing. Businesses are moving their solutions, data, and processes to the cloud and leveraging…

Incident Response Requires a New AppSec Model

Read the original article: Incident Response Requires a New AppSec Model Incident response found its way into our technological vernacular back in 1988 when the first internet worm — dubbed “The Morris Worm” — was released. In response, the Computer…

What Is PKCE?

Read the original article: What Is PKCE? PKCE is short for Proof Key for Code Exchange. It is a mechanism that came into being to make the use of OAuth 2.0 Authorization Code grant more secure in certain cases. Why…

API Security Weekly: Issue #83

Read the original article: API Security Weekly: Issue #83 Vulnerability: India’s Coronavirus Tracing App Elliot Alderson discovered API flaws in India’s COVID-19 tracking app, Aarogya Setu. In certain regions, the app is mandatory, and not having it installed can lead…

Two-Factor Authentication in Spring Webflux REST API

Read the original article: Two-Factor Authentication in Spring Webflux REST API Multi-factor authentication became common practice for many cases, especially for enterprise applications or those that deal with sensitive data (like finance apps). Moreover, MFA is enforced (especially in the…

Configuring SSL/TLS Connection Made Easy

Read the original article: Configuring SSL/TLS Connection Made Easy Setting up encryption for your application, how hard can it be? I thought it should be easy, as all communication with modern web applications should be encrypted, right? Well, my expectations…

SSL Offloading: A Solution For a Slow Website

Read the original article: SSL Offloading: A Solution For a Slow Website SSL offloading is a great solution for enterprises that wish to improve website performance without compromising security — here’s how it works. SSL offloading is a solution that…

API Security Weekly: Issue #82

Read the original article: API Security Weekly: Issue #82 Opinion: The 5 Most Common Vulnerabilities in GraphQL Although the adoption of GraphQL is still fairly limited, it is undeniably on the rise. GraphQL is different from the traditional REST APIs:…

3 Rewarding Programs for Blockchain Devs

Read the original article: 3 Rewarding Programs for Blockchain Devs Looking for a chance to learn more about blockchain, build cool solutions with it, and share your knowledge with others?  Even better, want to see some money for your time…

Secure Communication with Token-based RSocket

Read the original article: Secure Communication with Token-based RSocket RSocket provides a message-driven communication mechanism, by using the reactive streaming framework, and supports most of the protocols (TCP/WebSocket/HTTP 1.1&HTTP 2). Furthermore, it’s program language-agnostic interaction models (REQUEST_RESPONSE/REQUEST_FNF/REQUEST_STREAM/REQUEST_CHANNEL) cover most communication…

Privacy vs Convenience: Is There a Middle Ground?

Read the original article: Privacy vs Convenience: Is There a Middle Ground? Enjoying the benefits of the myriad online services we use every day is incredibly convenient. In fact, it’s so convenient that we’re ready to accept terms and conditions…

Easy OAuth 2.0 Single Sign-on in Java

Read the original article: Easy OAuth 2.0 Single Sign-on in Java Different applications need different permissions. Although you might have a single resource server providing data to multiple apps, it’s often the case that you don’t want all users of…

Implementing Aqua Security to Secure Kubernetes

Read the original article: Implementing Aqua Security to Secure Kubernetes Despite the maturity of the platform, security is still a big challenge for Kubernetes users. While Kubernetes offers maximum flexibility, modularity, and ease of use in other areas, the complex…

Deep Dive Into NPM Security

Read the original article: Deep Dive Into NPM Security The Node Package Manager, abbreviated as NPM, is the premier registry for software packages in the Node.js ecosystem and has become one of the largest registries for software packages in the…

EC Private and Public Key Pair

Read the original article: EC Private and Public Key Pair An EC (Elliptic Curve) key-pair is a pair of a private and public key constructed from a given subgroup generator in a given elliptic curve group. Here are the steps…

Rules of Thumb for Certificate Monitoring

Read the original article: Rules of Thumb for Certificate Monitoring The enforcement of HTTPS by web browsers has introduced the pain of certificate management to small and medium businesses. Here are my rules of thumb to make your life much…

13 Ways to Secure Your Cloud VPS

Read the original article: 13 Ways to Secure Your Cloud VPS Choosing to host your Virtual Private Server (VPS) in the cloud opens a world of possibilities to share new content with your customers. No matter which operating system you…

API Security Weekly: Issue #81

Read the original article: API Security Weekly: Issue #81 This week, we check out how Microsoft Teams could be breached with a single GIF image sent in a chat, and Auth0 by changing the case of a single character. In…

Azure and HIPAA Compliance: What You Need to Know

Read the original article: Azure and HIPAA Compliance: What You Need to Know What is HIPAA? The Health Insurance Portability and Accountability Act (HIPAA) is a landmark piece of US legislation that was introduced in 1996, in order to safeguard…

5 Real-World Applications of Blockchain Technology

Read the original article: 5 Real-World Applications of Blockchain Technology Blockchain technology has garnered a significant amount of digital ink in recent years. In fact, it is as big of a game changer as the Internet was back in the…

8 Popular Security Tools You Should Try Right Now

Read the original article: 8 Popular Security Tools You Should Try Right Now Hackers today are on the rage and more organizations are falling victim to them. We are hearing reports of data leaks and website hacks more frequently than…

Secure Software Development Principles

Read the original article: Secure Software Development Principles There is growing evidence that criminals, terrorists, and other malicious actors view vulnerabilities in software systems as a tool to reach their goals. Today, software vulnerabilities are discovered at a higher rate…

API Security Weekly: Issue #80

Read the original article: API Security Weekly: Issue #80 Vulnerability: IBM Data Risk Manager Pedro Ribeiro found a bunch of security vulnerabilities in IBM Data Risk Manager (IDRM). This is a control center that helps to locate, analyze, and visualize…

Kafka SSL Client Authentication in Multi-Tenancy Architecture

Read the original article: Kafka SSL Client Authentication in Multi-Tenancy Architecture Apache Kafka is the key product for not only messaging transformations but also real-time data processing, in addition to many other use cases. Architectures hosted inside the cloud claim…

Cyber Insurance in 2020

Read the original article: Cyber Insurance in 2020 Cyber insurance has emerged as a response to the rapidly increasing cyber-attacks across the world and the extent of damage these attacks cause to businesses. Recent trends indicate there is a continual…

4 Key Strategies for Open PGP

Read the original article: 4 Key Strategies for Open PGP Numerous high-profile data breaches have shined a spotlight on the need to protect sensitive data. Encryption is a popular solution that locks away files such that even if they are…

API Security Weekly: Issue #79

Read the original article: API Security Weekly: Issue #79 This week, unprotected APIs have allowed hackers to compile to put on sale a list of 1.4 million of US doctors, and GitLab has published details on the API vulnerability they…

Securing APIs With WSO2 Microgateway

Introduction APIs handle practically every function in modern organizations. From booking a movie ticket to processing complex bank transactions, APIs play an important role. Organizations expose their services via APIs to the public and also internally in order to expand…

Ethereum RPCs, Methods, and Calls

JSON RPC, methods, calls, requests — what does it all mean?! When you start building an app on the Ethereum blockchain, you’re introduced to a host of new concepts, request methods, and naming conventions to employ. It can be overwhelming.…

API Security Weekly: Issue #78

This week, we check out the API vulnerabilities in the WordPress Rank Math plugin, Tapplock smartlock, and TicTocTrack, another kids’ smartwatch. In addition, an update to VS Code OpenAPI extension that adds static application security testing (SAST) for composite API…

8 Steps to Keep Remote Development Teams Secure

There is no doubt that the world’s workforce is becoming more remote, particularly in tech as developers can now work from any location in the world. But there are a large number of new obstacles that come with this. The…

A Brief History of EDR Security

Endpoint Detection and Response (EDR) solutions were developed to fill security gaps left by other tools. The need for EDR can be traced to the early 2010s, but the term EDR was officially coined in 2013. In this article, you’ll…

API Security Weekly: Issue #77

This week, GitLab has fixed several vulnerabilities, including API vulnerabilities, and the draft for OAuth 2.1 has been released. If you find yourself stuck at home with extra time in your hands, why not check out the free course on…

API Security Weekly: Issue #76

This week, new security issues have been reported in a US election app, Voatz, and an API vendor has leaked 8 million shopping records in UK. In addition, ESG have shared some of their findings on API security and DevSecOps,…

Configuring SSL/TLS Connection Made Easy

Setting up encryption for your application, how hard can it be? I thought it should be easy, as all communication with modern web applications should be encrypted, right? Well, my expectations were wrong… While setting it up, I encountered a…

11 Cybersecurity Predictions for 2020

It’s been another eventful year for cyber attacks. More than 4 billion records have been breached so far – and we’re not even to the end of the year yet! But is behind us. It’s now time to look forward…