Securing Open-Source Apps
Securing Open-Source Apps with API Scans and Observability Businesses building applications have always made great use of open-source software. The move to cloud-native applications, use of low code development, and embracement of composable architectures have made open-source use even more pervasive. As such, businesses need a way to ensure the composite apps are reliable, perform […]
Cloud Security Requires Shared Responsibility
The Growth of Public Cloud and the Need for Cloud Security Since 2006 when Amazon first introduced EC2 — the first public cloud service — cloud has become a major staple of enterprise information technology strategy. Both Infrastructure as a Service (IaaS) and newer cloud services continue to grow robustly. Enter the need for cloud security. […]
Securing Microservices Vs. Monolithic Apps
New requirements for Securing Microservices Vs. Monolithic Apps Enterprises are migrating from monolithic applications to microservices, hoping to accelerate software deployment and improve scalability. Security is sometimes glossed over in these transitions. Simple best practices like authenticating users and using SSL are still important to follow. But teams need to think through important differences between […]
Dependencies in Cloud-Native Apps can Amplify Risks
Hidden Dependencies in Cloud-Native Apps can Amplify Security Risks Cloud-native applications and modern development practices result in applications that are highly distributed and loosely coupled. In many cases, organizations have no control over or little insight into the different elements and software entities they use in their applications. The result often is hidden dependencies that […]
The Shopify Breach: Why Authz Exploits Slip by Most Security Defenses
What Happened As part of a bug bounty, the security researcher Uzsunny found a critical vulnerability on the Shopify platform. The vulnerability allowed the attacker to assign himself as a “collaborator” to any store on Shopify without approval from the store’s manager. Collaborators have full access to perform any action on the store, including reading […]
Why Was Facebook Vulnerable to an Authentication Exploit?
What Happened: As part of a bug bounty program, the AppSecure cybersecurity research team found a vulnerability on the authentication mechanism of Facebook. It gave them the ability to potentially gain full control of the social media giant’s more than 1 billion users. The team won a $15,000 bounty for its discovery. This vulnerability was […]
The Uber API Authorization Vulnerability
What Happened In September 2019, a critical bug was discovered on Uber API, which allows merchants, service providers and others to offer ride-sharing services to customers. Uber had exposed a vulnerable application programming interface (API) endpoint that allowed attackers to steal valuable data, including personally identifiable information (PII) records and authentication tokens of riders and drivers. The leaked […]
Web Application Firewalls Aren’t Protecting Cloud-Native Apps
Your web application firewall (WAF) is humming at the edges of your network, faithfully blocking malicious attacks before they can do any harm. Better yet, it’s a next-generation WAF (NG-WAF). It consists of signatures, rules, and a sprinkle of machine learning to protect your applications (and user data) from harm. You’ve got it covered, correct? […]
The New Norm for Modern Apps: Security Observability
Observability has burst onto the scene across all types of operational and security-focused activities. Its need is being driven by increased demands for businesses to be more responsive to changes and more proactive when dealing with potential problems. In particular, security observability holds the promise to help reduce the time to detect a cyberattack. And […]
TraceAI : Machine Learning Driven App and API Security
API security Modern applications are mobile first and are built around cloud-native distributed microservices architectures. These architectures have become the basic building blocks for complex and reliable distributed web and mobile applications. Many of these distributed APIs expose the business logic directly over the web; hence the attack surface and attack vectors are very different […]
Safeguarding Composable Architecture Applications Based on API-enabled Components
The use of composable methodologies for application development is growing rapidly. The reason: It offers many benefits that speed the development process and opens up application creation to developers of all skill levels. However, the speed and ease-of-use benefits, via the reuse of pre-built components, can introduce new security risks that traditional security management solutions […]
What Runtime Application Self-Protection (RASP) Doesn’t Solve
RASP, or Runtime Application Self-Protection, is a modern security technology that protects web applications from attacks during runtime. The technology is an important complement to defense systems that focus on the perimeter, but RASPs also have weaknesses that can introduce their own vulnerabilities. What are RASP’s strengths and weaknesses in protecting against modern security threats? […]
Security Risks With No-Code/Low-Code Tools
As the popularity of no-code and low-code tools grows, so, too, do security concerns The demand for new applications is growing at a rapid rate. Many individuals and business units will not tolerate delays. As a result, citizen developers are stepping in, some of whom may be sanctioned by the company while essentially operating as […]
Use the OWASP API Top 10 to Secure Your APIs
The tools, languages, platforms, and methods used to build applications have changed drastically over the past decade. Application security practices have to change with them; otherwise, security professionals will be playing constant catch-up with attackers and cybercriminals. What Is the OWASP API Top 10? The increase of microservices and application programming interfaces (APIs) has given […]
Big Compass Practical Guide to API Security
DOWNLOAD the Free Report >> AWS Builder Community Hub
Application Security and API Security
DOWNLOAD the Free Report >> AWS Builder Community Hub
Why Businesses Need to Transform From DevOps to DevSecOps
The need for modern applications to support continuous integration, delivery and deployment spawned the need for DevOps. Increasingly, as cyberthreats evolve and grow and application development methods and time frames change, security now needs to be an integral part of today’s application life cycle. As a result, businesses should move from DevOps to DevSecOps. DevSecOps […]
Security Observability: Why Tracing?
Detecting a cyberattack can take more than 200 days. During this time, attackers might be exploiting your system while you are completely unaware. Cyberattacks can cost affected organizations as much as $13 million per year. What if we could reduce the time to detect a cyberattack all the way down to zero? How much money […]
Secure Kubernetes Architecture: Six Factors Essential to Success
Kubernetes has become the go-to container orchestration tool for businesses. Check out these telling stats [source: Enterpriser’s Project]: 84% of companies are using containers in production. Of those, 78% are using Kubernetes to manage their containers. 69% of companies have found security holes due to misconfiguration of their Kubernetes environment. Your Kubernetes architecture is like a […]
Web Application Security is not API Security
Do you follow the same procedures to secure a web application as you do an API? Is there a difference between the two? We’ve spoken about API security quite a bit in the past few months because we believe that there are critical differences between API security and traditional web application security. A lack of […]
Modern AppSec and Supply Chain Attacks – Three Challenges
The recent news about the SolarWinds breach has focused on the difficulty and challenges a supply chain attack presents. In the case of what Microsoft is calling “solorigate,” the attackers modified a dll deep inside a trusted application, which was then deployed into over 18,000 enterprises and government organizations, where it would then create a live back […]
The Evolution to Cloud-Native Applications and APIs
If you’ve spent any length of time in application development, you’re familiar with change. It’s the only constant. And along with how we build applications come changes in the techniques used to keep them secure. Securing modern applications requires more diligence than ever before. A review of how application development has changed over the past […]