Wednesday, September 18, 2024

Security Boulevard

The Home of the Security Bloggers Network

Community Chats Webinars Library

Home
Security Creators Network
Webinars
Events
- Upcoming Events
- On-Demand Events
Sponsored Content
Chat
Library
Related Sites
Media Kit
About
Sponsor

Analytics
AppSec
CISO
Cloud
DevOps
GRC
Identity
Incident Response
IoT / ICS
Threats / Breaches
More
Humor

Hot Topics

Post-Quantum Cryptography: The Future of Secure Communications and the Role of Standards
10 Best Attack Surface Management Tools
Analysis Identifies Web Servers as Weakest Cybersecurity Link
SpyCloud Unveils Massive Scale of Identity Exposure Due to Infostealers, Highlighting Need for Advanced Cybersecurity Measures
INE Security Wins 2024 SC Excellence Award

AppSec

Ukraine’s President Zelenskyy

Russian ‘WhisperGate’ Hacks: 5 More Indicted

Richi Jennings | September 6, 2024 | Cadet Blizzard, Ember Bear, Frozenvista, GRU, GRU Unit 29155, NATO, NATO Member State, Ransomware, Russian GRU, SB Blogwatch, UAC-0056, Ukraine, ukraine conflict, Ukraine Cyber Attacks, Ukraine Cyber War, Ukraine cyberattack, Ukraine-Russia War, UNC2589, WhisperGate Wiper

Eaten by a GRU: Fake ransomware created by Russian GRU Unit 29155 attacked Ukraine and NATO—a month before the full scale invasion ...

Security Boulevard

A Chinese flag flies on a high pole

China Cyberwar Coming? Versa’s Vice: Volt Typhoon’s Target

Richi Jennings | August 28, 2024 | CenturyLink, china, china espionage, China-linked Hackers, China-nexus cyber attacks, China-nexus cyber espionage, CVE-2024-39717, Lumen, Lumen Technologies, Peoples Republic of China, SB Blogwatch, Versa Director, Versa Neworks, VersaMem, Volt Typhoon

Xi whiz: Versa Networks criticized for swerving the blame ...

Security Boulevard

Sign reads, “Danger: High Voltage!”

‘Terrorgram’ Telegram Terrorists Trash Transformers — Grid in Peril

Richi Jennings | August 27, 2024 | Anti-Terrorism, Child Abuse, child exploitation, Child Online Safety, child porn, child pornography, Child protection, Child Safety, child sexual exploitation, childpornography, Counter-Terrorism, counterterrorism, CSAM, Data encryption, E2EE, encryption, end-to-end encryption, extremism, france, ICS, ICS/SCADA systems, Pavel Durov, Privacy, Russia, SB Blogwatch, Telegram, Telegram app, Terrorgram, Terrorism, terrorist, terrorist attack, Terrorist attacks

Should’ve listened to Edison: After the arrest of Pavel Durov—the Telegram CEO—comes news of domestic extremists using the chat app to organize ...

Security Boulevard

A pair of work boots

Patch Tuesday not Done ’til LINUX Won’t Run?

Richi Jennings | August 21, 2024 | CVE-2022-2601, Dual boot, GRUB2 Bootloader Secure Boot Bypass, Linux, Microsoft, Microsoft Patch Tuesday August 2024, Microsoft Windows, Patch Tuesday, SB Blogwatch, SBAT, secure boot, Secure Boot Advanced Targeting, Windows

Redmond reboot redux: “Something has gone seriously wrong.” You can say that again, Microsoft ...

Security Boulevard

The word “Tuesday” in cutout paper letters on a textured background

August Patch Pileup: Microsoft’s Zero-Day Doozy Dump

Richi Jennings | August 14, 2024 | Adobe patch, august patch tuesday, CVE-2024-21302, CVE-2024-38106, CVE-2024-38107, CVE-2024-38178, CVE-2024-38189, CVE-2024-38193, CVE-2024-38199, CVE-2024-38200, CVE-2024-38202, CVE-2024-38213, Microsoft patch tuesday, Microsoft Patch Tuesday August 2024, Patch Tuesday, SB Blogwatch

See These CVEs: Patch Tuesday—ten zero-days, seven Critical vulns, zero time to waste ...

Security Boulevard

Mobile Guardian CEO Patrick Lawson

Student Devices Wiped — Mobile Guardian Hacked AGAIN

Richi Jennings | August 7, 2024 | Blackmail, cybersecurity education, Cybersecurity in education, DevOps Education, DevSecOps Education, MDM, Mobile Device Management (MDM), Mobile Guardian, Ransomware, SB Blogwatch, singapore

Hackers ate my homework: MDM software for schools is breached for second time this year—13,000 devices wiped in Singapore alone ...

Security Boulevard

TikTok Abuses Kids, say DoJ and FTC

TikTok Abuses Kids, say DoJ and FTC

Richi Jennings | August 5, 2024 | Bytedance, children, Children and smartphones, Children's Online Privacy Protection Act (COPPA), china, chinese government, Coppa, Privacy, SB Blogwatch, social media, spyware, TikTok, TikTok Ban, Won’t somebody think of the children?

For You Plague: U.S. Justice Dept. and Federal Trade Commission file lawsuit, alleging TikTok broke the COPPA law, plus a previous injunction ...

Security Boulevard

Prisoner Swap: Huge Russian Hackers Freed — Seleznev and Klyushin

Prisoner Swap: Huge Russian Hackers Freed — Seleznev and Klyushin

Richi Jennings | August 2, 2024 | cyber attacks russia, Putin, Roman Seleznev, Russia, russia hacker, russia-based, Russian hacker, Russian hackers, Russian hacking, SB Blogwatch, Vladimir Putin, Vladislav Klyushin

Pragmatic politics: Anger as Putin gets back two notorious cybercriminals ...

Security Boulevard

David Boies, founding partner and chairman of Boies Schiller Flexner, LLP

CrowdStrike Sued? — Delta Dials David Boies

Richi Jennings | July 31, 2024 | CrowdStrike, CrowdStrike Falcon, CrowdStrike incident;, Delta Airlines, falcon, SB Blogwatch

Is Delta the First of Many? Airline calls in attorneys Boies Schiller Flexner to claw back its cash ...

Security Boulevard

A person looking confused

WTH? Google Auth Bug Lets Hackers Login as You

Richi Jennings | July 29, 2024 | G Suite, Google Apps, Google Apps for Work, Google Workspace, OAuth, oauth 2.0, oauth abuse, Oauth Application Abuse, SB Blogwatch, securing oauth

G Suite Sours: Domain owners flummoxed as strangers get Google for their domains ...

Security Boulevard

Techstrong TV

Click full-screen to enable volume control

Watch latest episodes and shows

Edge Field Day

Upcoming Webinars

Accelerate FedRAMP Compliance on Amazon EKS with Anchore

The Last Great Cloud Transformation:Securing Your Hybrid Workforce

AppSec for the Win: Proven Best Practices that Work

The AI Efficiency Edge: Empowering Your Teams with Okta & Amazon Q

The Last Great Cloud Transformation — Strengthening Security Through Consolidation

Podcast

Listen to all of our podcasts

Press Releases

GoPlus's Latest Report Highlights How Blockchain Communities Are Leveraging Critical API Security Data To Mitigate Web3 Threats

GoPlus’s Latest Report Highlights How Blockchain Communities Are Leveraging Critical API Security Data To Mitigate Web3 Threats

C2A Security’s EVSec Risk Management and Automation Platform Gains Traction in Automotive Industry as Companies Seek to Efficiently Meet Regulatory Requirements

C2A Security’s EVSec Risk Management and Automation Platform Gains Traction in Automotive Industry as Companies Seek to Efficiently Meet Regulatory Requirements

Zama Raises $73M in Series A Lead by Multicoin Capital and Protocol Labs to Commercialize Fully Homomorphic Encryption

Zama Raises $73M in Series A Lead by Multicoin Capital and Protocol Labs to Commercialize Fully Homomorphic Encryption

RSM US Deploys Stellar Cyber Open XDR Platform to Secure Clients

RSM US Deploys Stellar Cyber Open XDR Platform to Secure Clients

ThreatHunter.ai Halts Hundreds of Attacks in the past 48 hours: Combating Ransomware and Nation-State Cyber Threats Head-On

ThreatHunter.ai Halts Hundreds of Attacks in the past 48 hours: Combating Ransomware and Nation-State Cyber Threats Head-On

Subscribe to our Newsletters

Most Read on the Boulevard

Apple Seeks to Drop Its Lawsuit Against Spyware Maker NSO

After CrowdStrike Crash, Microsoft Mulls New Windows Security Tools

Five Tools That Can Help Organizations Combat AI-powered Deception

Why Are So Many Public Sector Organizations Getting Attacked?

Email Security Breaches Rampant Among Critical Infrastructure Organizations

New Office of the CISO Paper: Organizing Security for Digital Transformation

Fundamentals of GraphQL-specific attacks

SquareX: The Future of BYOD Security for Enterprises

CVE-2024-28986 – SolarWinds Web Help Desk Security Vulnerability – August 2024

Randall Munroe’s XKCD ‘Monocaster’

Industry Spotlight

Cloud Security Cybersecurity Data Security DevOps Featured Industry Spotlight Mobile Security Network Security News Security Boulevard (Original) Social - Facebook Social - LinkedIn Social - X Spotlight Threat Intelligence

After CrowdStrike Crash, Microsoft Mulls New Windows Security Tools

September 16, 2024 Jeffrey Burt | 1 day ago 0

AI and Machine Learning in Security AI and ML in Security Cybersecurity Featured Industry Spotlight Marketing InSecurity Podcast News Security Awareness Security Boulevard (Original) Social - Facebook Social - LinkedIn Social - X

Tines Leverages LLMs to Simplify Security Automation

September 12, 2024 Michael Vizard | Sep 12 0

Analytics & Intelligence Cybersecurity Data Privacy Data Security Deep Fake and Other Social Engineering Tactics Editorial Calendar Endpoint Featured Governance, Risk & Compliance Humor Incident Response Industry Spotlight Most Read This Week Network Security News Popular Post Securing the Edge Security at the Edge Security Awareness Security Boulevard (Original) Security Challenges and Opportunities of Remote Work Security Operations Social - Facebook Social - LinkedIn Social - X Social Engineering Software Supply Chain Security Spotlight Threat Intelligence Threats & Breaches Vulnerabilities Zero-Trust

Microsoft Fixes Four 0-Days — One Exploited for SIX YEARS

September 11, 2024 Richi Jennings | Sep 11 0

Top Stories

Cybersecurity Featured News Security Awareness Security Boulevard (Original) Social - Facebook Social - LinkedIn Social - X Spotlight

Analysis Identifies Web Servers as Weakest Cybersecurity Link

September 18, 2024 Michael Vizard | 1 hour ago 0

Cybersecurity Featured News Security Awareness Security Boulevard (Original) Social - Facebook Social - LinkedIn Social - X Spotlight Threat Intelligence Threats & Breaches

Email Security Breaches Rampant Among Critical Infrastructure Organizations

September 17, 2024 Nathan Eddy | Yesterday 0

Cybersecurity Data Security Featured News Security Awareness Security Boulevard (Original) Social - Facebook Social - LinkedIn Social - X Spotlight

AppOmni Surfaces Configuration Flaw in ServiceNow SaaS Platform

September 17, 2024 Michael Vizard | Yesterday 0

Download Free eBook

Managing the AppSec Toolstack

Join the Community

Add your blog to Security Creators Network
Write for Security Boulevard
Bloggers Meetup and Awards
Ask a Question
Email: [email protected]

Useful Links

About
Media Kit
Sponsor Info
Copyright
TOS
DMCA Compliance Statement
Privacy Policy

Related Sites

Techstrong Group
Cloud Native Now
DevOps.com
Digital CxO
Techstrong Research
Techstrong TV
Techstrong.tv Podcast
DevOps Chat
DevOps Dozen
DevOps TV

Powered by Techstrong Group

Copyright © 2024 Techstrong Group Inc. All rights reserved.

Application Security Check Up

Step 1 of 7

14%

Does someone in your organization write software?(Required)

Yes

No

What portion of your cyber risk is Application Security (AppSec)? (Select one)(Required)

We over-focus on AppSec

We focus on AppSec to match the risk

We under-focus on AppSec

What are the biggest challenges you face implementing a robust AppSec strategy? (Select all that apply)

Lack of budget

Insufficient skilled personnel

Complexity of integrating security into the development lifecycle

Resistance from development teams

Keeping up with evolving security threats

Lack of executive buy-in

Other (please specify)

Other

Which DevSecOps practices are widely used for actively developed projects (not legacy) (Select all that apply):(Required)

Automated unit and functional tests for quality run in the pipeline with merge blocking

Automated application security testing (AST) in development and (SAST/IAST) runs in the pipeline

Automated AST tools to find vulnerabilities in the code you import (SCA) run in the pipeline

Merge blocking at current policy level for AST checks

Secrets management so no secrets stored in source code repositories

How do you assess and mitigate risk of For NON actively developed products (legacy) (Select all that apply):

In-production scans using DAST products like Qualys, Nessus, etc.

Periodic penetration testing

Periodic running of AST tools

Manual code reviews by security specialists

Use of third-party security assessment services

No assessment or mitigation effort is happening

How do you resolve the security issues found? (Select all that apply):(Required)

Findings are manually triaged

Findings are communicated to engineering via mostly manual processes

Finding above a certain severity automatically populate engineering backlogs

Service level agreements (SLAs) are enforced based on severity

An exception process exists to allow the business to accept risk

The exception process is rarely used and must be renewed periodically

Which best describes security training for your developers? (Select all that apply)(Required)

Monthly

Quarterly

Annually

As part of onboarding

Just-in-time via integration with AST tools when a vulnerability is found

No formal training provided

Δ