Being a backend developer and having worked for years in the jungle of authentication and identity management, I can attest to the fact that implementing seamless SSO is often way more complex than it seems. I have witnessed how organizations…
Tag: DZone Security Zone
A Practical Guide to Securing NodeJS APIs With JWT
NodeJS is a very popular platform for building backend services and creating API endpoints. Several large companies use NodeJS in their microservices tech stack, which makes it a very useful platform to learn and know, similar to other popular languages…
Demystifying Kubernetes in 5 Minutes
Kubernetes is not new and has been a de-facto standard of deployments and CI/CD at most companies for a while. The goal of this article is to make you familiar with all the terms and jargon that Kubernetes experts use,…
Building Secure Containers: Reducing Vulnerabilities With Clean Base Images
In today’s fast-paced development environment, containerized applications have become the go-to solution for many organizations. They offer scalability, portability, and efficiency. However, containerized environments also bring their own set of challenges, particularly when it comes to security vulnerabilities. One of…
Data Governance Essentials: Glossaries, Catalogs, and Lineage (Part 5)
What Is Data Governance, and How Do Glossaries, Catalogs, and Lineage Strengthen It? Data governance is a framework that is developed through the collaboration of individuals with various roles and responsibilities. This framework aims to establish processes, policies, procedures, standards,…
4 Essential Strategies for Enhancing Your Application Security Posture
The rapidly evolving cybersecurity landscape presents an array of challenges for businesses of all sizes across all industries. The constant emergence of new cyber threats, including those now powered by AI, is overwhelming current security models. A 2023 study by…
Compliance Automated Standard Solution (COMPASS), Part 7: Compliance-to-Policy for IT Operation Policies Using Auditree
(Note: A list of links for all articles in this series can be found at the conclusion of this article.) In Part 4 of this multi-part series on continuous compliance, we presented designs for Compliance Policy Administration Centers (CPAC) which…
Unifying SecOps and Observability for Enhanced Cloud Security in Azure
As someone who has worked in various areas of Azure for almost a decade, I have witnessed its constant evolution and the rise of increasingly sophisticated security risks. This calls for a unified approach to modern cloud security, where integrating…
Advanced CI/CD Pipeline Optimization Techniques Using GitHub Actions
Continuous Integration and Continuous Deployment (CI/CD) pipelines are crucial for modern software development. This article explores advanced techniques to optimize these pipelines, enhancing efficiency and reliability for enterprise-level operations. Parallelization Using Matrix Builds GitHub Actions CI tests using the matrix…
Using AUTHID Parameter in Oracle PL/SQL
In Oracle, the AUTHID clause is a powerful option to manage DB security and access control. It defines who is considered a current user for execution purposes within stored procedures and functions. This article explores the basics of AUTHID, different…
12 Expert Tips for Secure Cloud Deployments
According to the Thales 2024 Cloud Security Study, 31% of cyberattacks prioritize SaaS applications, followed closely by 30% targeting cloud storage and 26% aimed at cloud management infrastructure. Cloud resources have become the prime targets for hackers — no surprise,…
Accelerating Connection Handshakes in Trusted Network Environments
In this article, I aim to discuss modern approaches used to reduce the time required to establish a data transmission channel between two nodes. I will be examining both plain TCP and TLS-over-TCP. What Is a Handshake? First, let’s define…
How Federal Agencies Are Achieving Zero Trust With Automation
“Never trust, always verify.” This key principle has been ingrained into the cybersecurity lexicon since Forrester first popularized the concept of zero trust in 2009. Since then, zero trust has emerged as one of the most important frameworks in modern…
Implement Hibernate Second-Level Cache With NCache
In this tutorial, we’ll explore implementing a second-level cache in Hibernate using NCache. We’ll set up a Java application with Hibernate. Then we’ll configure NCache as the second-level cache. Finally, we’ll test the implementation to see how caching reduces the…
How to Implement Client-Side Load Balancing With Spring Cloud
It is common for microservice systems to run more than one instance of each service. This is needed to enforce resiliency. It is therefore important to distribute the load between those instances. The component that does this is the load…
How to Secure Your Raspberry Pi and Enable Safe, Resilient Updates
The venerable Raspberry Pi has been around for over a decade (officially created in 2009) and it has become a standard in many robotics, home automation, and other types of uses, especially for “makers” and other tinkerers. But it has…
How To Secure Your Raspberry Pi and Enable Safe, Resilient Updates
The venerable Raspberry Pi has been around for over a decade (officially created in 2009) and it has become a standard in many robotics, home automation, and other types of uses, especially for “makers” and other tinkerers. But it has…
Securing Cloud-Native Applications: A CISO’s Perspective on Broken Access Control
When we talk about security in cloud-native applications, broken access control remains one of the most dangerous vulnerabilities. The OWASP Top 10 lists it as the most prevalent security risk today, and for good reason: the impact of mismanaged permissions…
Secure Golden Images: A Blueprint for Vulnerability Management
In environments with AWS Cloud workloads, a proactive approach to vulnerability management involves shifting from traditional patching to regularly deploying updated Secure Golden Images. This approach is well-suited to a modern Continuous Integration and Continuous Delivery (CI/CD) environment, where the…
GitHub Copilot Security and Privacy Concerns: Understanding the Risks and Best Practices
AI-powered code completion tools like GitHub Copilot, co-developed by GitHub and OpenAI, likely need no introduction. Developers are rapidly embracing this evolving technology to aid them in their work. Copilot and other Large Language Model (LLM) based coding assistants suggest…