Insights from experts shaping secure development

操作系统命令注入攻击可以由入门级和技能较低的黑客执行，这使其成为安全团队最常见的漏洞之一。值得庆幸的是，有很多非常有效的方法可以防止他们取得成功。

会话是使用网络时获得良好用户体验的关键。但是，不当管理会话会导致安全漏洞，攻击者可以利用这些漏洞。

你不认为是时候改头换面了吗？这就像改变对话然后让一切变得更积极一点一样简单（更不用说有趣了！）对于双方，尤其是开发团队。

虽然对于另类摇滚乐队来说，Padding Oracle 听起来像是一个非常糟糕的名字，但它实际上是一个漏洞，攻击者可以在不知道加密密钥的情况下利用它来解密信息。

当恶意用户可以操纵 LDAP 查询时，可能会出现问题。这样做可能会诱使接收服务器执行通常不允许的无效查询，甚至向没有密码的无效或低安全性用户授予高级或管理员访问权限。

我们面临的真正战斗不是针对剧本小子或危险的有组织网络犯罪集团... 而是要让更多的人关心数据泄露的发生。

在网络安全领域，攻击者可以快速利用任何被允许支持不受限制文件上传的应用程序或程序。结果可能是毁灭性的。

NoSQL 数据库越来越受欢迎。很难否认它们处理非结构化数据的速度和便捷性，但是随着使用的普及，越来越多的漏洞不可避免地浮出水面。

CSRF 攻击相当复杂，需要多层才能成功。换句话说，必须破坏很多有利于攻击者的东西才能起作用。尽管如此，它们还是非常受欢迎、利润丰厚的攻击载体。

攻击者正在使用 SQL 注入，这是最古老的注入之一（自 1998 年以来！）还有最讨厌的数据漏洞——窃取和更改全球数百万个数据库中可用的敏感信息。

当在线隐私试图在没有安全的情况下存在时，混乱就会占据上风。问问罗斯·乌尔布里希特就行了。

观察：金融机构在提高开发人员安全编码技能方面的创新和领导地位不断提高。

有一种众所周知的理论认为，蟑螂基本上可以在任何情况下存活下来，即使是核爆炸也是如此。

有许多解决方案可以发现代码中的漏洞，但是安全性需要更加重视教导开发人员遵循安全准则，以防止他们从一开始就犯这些错误。

我们必须努力改变对话方式，使安全成为每个开发人员工作生活中不可或缺的一部分。我认为做到这一点的最佳方法之一是通过游戏化等在安全方面赋予开发人员权力，并与他们互动。

我们必须停止将安全视为公司创新道路上的刺激性障碍。

我以为我最终会从事基础设施或服务支持类的职业，然后在研究生课程中获得了发展机会。原来那正是我需要去的地方。

让开发人员从一开始就能够编写安全代码，这为首席信息安全官提供了从安全困境中抓住一些主动控制的机会，也有可能为安全和开发团队带来快速、简单和可衡量的改进。

调查人员说，防止爆炸的唯一因素是攻击者的计算机代码错误。

我们的愿景是通过提高安全性，为开发人员提供从一开始就编写安全代码的技能和工具，使他们成为组织中的第一道防线。

如果没有人教过开发人员为什么安全代码很重要，不安全代码的后果，最重要的是，如何防止在各自的编程框架中写入这些漏洞，那么开发人员应该如何编写安全代码？

XML 和 XML 架构的规范包括多个安全漏洞。同时，这些规范提供了保护 XML 应用程序所需的工具。尽管我们使用 XML 架构来定义 XML 文档的安全性，但它们仍可用于执行各种攻击。

我们可以将一个文件注入到一个名称前缀为 zip 的 zip

更改一台航空电子设备上的一行代码的成本为100万美元，实施需要一年的时间。对于其机队以波音737为基础的西南航空来说，它将 “破产”

节目 139：Matias Madou 讨论安全开发培训和软件安全测试研究

Android 全设备加密可安全保存所有数据并将其写入存储空间，只有在设备解锁后才能看到。向安全代码勇士学习。

有时，应用程序必须能够在用户完全知情和同意的情况下验证操作是否正在执行

通过定义自定义权限范围，应用程序可以与其他应用程序共享其资源和功能。

大约 95,000 个应用程序中的近 300,000 名开发人员使用 BSIMM8 来帮助规划、执行和衡量他们的软件安全计划 (SSI)。

用户名枚举是指黑客使用暴力攻击来获取用户名和密码信息。使用安全代码勇士学习如何避免用户名枚举。

关于如何推出有效的开发人员安全培训的 5 条重要课程

这项工作的意义在于，我们为大量令人震惊的安全编码问题提供了经验证据，这些问题以前从未报告过

该错误仍然存在。这不是可以立即修复的问题。在过去的几个月中，作为漏洞赏金计划的一部分，我联系了数十家公司和受影响的供应商，以修复他们的设置。

随着首席信息官积极建立企业敏捷能力，安全编码技能将成为创新的武器，没有这些技能将是一种破坏工具。

无论你是对高管进行网络安全培训，还是帮助开发人员掌握 JAVA 或 C# 安全编程技能，都有创造力、游戏化和乐趣的地方。

如果开发人员在使用 JavaScript 编码时写入了跨站脚本错误，并且他们能够在创建该漏洞后的几分钟内检测到该错误

每个开发者都需要问一个问题，无论你是毕业生还是资深人士。答案很重要。

上周我正在研究 Java Spring 中的漏洞，以更新我们的安全编码指南。

根据一位名为x0rz的研究人员的推文，向前跳到2016年，一位安全研究人员在Equifax的主要网站上发现了一个称为跨站脚本（XSS）的常见漏洞。

该漏洞与 Struts 如何解析此类数据并将其转换为 Java 编程语言可以解释的信息有关。

数据剩余是以某种方式被删除的数据的剩余物理表现形式。

再一次，Equifaxblackeach客攻击的根本原因是网络应用程序漏洞。这个类的漏洞已经存在了十多年，但今天确实非常棒。

Post-quantum cryptography (PQC) is critical for protecting data from quantum computing threats. Learn how “harvest now, decrypt later” exposes risk and how developers can prepare for quantum-safe security.

Recently we interviewed some of the future leaders in the secure development or “DevSec” world and found their individual career paths into cybersecurity fascinating. For those of you out there wishing to become a security champion, jump into the elusive AppSec realm, or even just learn more about secure coding, here are the stories from three security professionals with a background in development, about how they got interested in security and the security lessons they wish every organization would follow.

Kamer van Koophandel shares how it embedded secure coding into everyday development through role-based certifications, Trust Score benchmarking, and a culture of shared security ownership.

See how Paysafe's partnership with Secure Code Warrior led to a 45% boost in developer productivity and a major reduction in code vulnerabilities.

DigitalOcean's use of Secure Code Warrior training has significantly reduced security debt, allowing teams to focus more on innovation and productivity. The improved security has strengthened their product quality and competitive edge. Looking ahead, the SCW Trust Score will help them further enhance security practices and continue driving innovation.

Explore the Devlympics 2023 results in this report. Dive into developer engagement, tech stack and languages trends in each industry that participated, and key vulnerabilities and CWEs covered in the annual global event hosted by Secure Code Warrior.

Discover how Sage enhanced security with a flexible, relationship-focused approach, creating 200+ security champions and achieving measurable risk reduction.

Discover how Workday transformed developer training with agile learning through Secure Code Warrior. By empowering developer with hands-on, language-specific education, Workday reduced vulnerabilities early in the SDLC. See their impressive results and key takeaways to build a secure code culture.

In this case study, learn how Thales has developed people, process, and technology approaches for an agile secure code learning program in order to engage developers to become active security champions.

Discover how retail giant Colgate-Palmolive reshaped its application security during its digital transformation journey. Facing challenges in secure coding, they innovated their approach by integrating bite-sized, in-context learning into the developer workflow.

Learn how Blue Prism, the global leader in intelligent automation for the enterprise, used Secure Code Warrior's agile learning platform to create a security-first culture with their developers, achieve their business goals, and ship secure code at speed

IAG Group is the name behind many of the leading insurancecompanies in the Asia-Pacific region, underwriting policies formillions of customers to the tune of approximately AUD $11.4 Billionin premiums per annum.

Learn how they created an in-house technology education initiative, aimed at supporting thousands of employees to learn practical, cutting-edge skills in a number of disciplines, including machine learning and cybersecurity.

Explore this comprehensive case study to learn more about how they utilized Secure Code Warrior's tournaments to engage developers, increase awareness of key vulnerabilities affecting automotive software, and gain metrics across multiple languages and frameworks.

AI's proficiency at creating software code won't put developers out of a job, but the job will change to one focused on security, collaboration, and "mentoring" AI models.

CISOs are under the microscope to prove they can reduce vulnerabilities in the software development life cycle -- particularly, that they can do so from the start of code creation. As such, CISOs are searching for the most effective way to ensure the security awareness of their developers before they take on the responsibility of writing and introducing code.

The Federal Government’s recent mandate, PSPF Direction 002-2024, aims to significantly bolster cybersecurity measures within Australian Government entities by requiring them to identify and actively manage risks tied to vulnerable technologies. The announcement has sparked reactions from key figures in the cybersecurity industry, who have shared their insights on its implications and potential impacts.

CISA’s Secure by Design movement has gained significant momentum, with governments around the world—like Australia, New Zealand, Canada, Singapore, Japan, Germany and the U.K.—contributing to its creation or following it directly as part of their own publicized cybersecurity strategies.

Developers, it appears, will not be replaced by artificial intelligence – at least not yet, anyway. What they will need to do is learn or improve their skills in providing templates for AI, become masters of fixing problems in AI-generated code, and actually learn the best uses for AI in software development.

Cyber threats remain high, but demand for cybersecurity workers in Australia has dipped.

New SCW Trust Agent facilitates a Secure-by-Design approach for enterprises; equips security leaders with unparalleled visibility into their organisations’ software security posture.

New SCW Trust Agent facilitates a Secure-by-Design approach for enterprises; equips security leaders with unparalleled visibility into their organizations’ software security posture.

Secure Code Warrior introduced SCW Trust Agent – a solution that assesses the specific security competencies of developers for every code commit.

The SCW Trust Agent can be deployed on any Git-based code repository, including Github, Gitlab and Atlassian Bitbucket to ensure that only developers that have only developers that have attained a specific security rating are allowed to make a commit. Those ratings are based on more than 20 million data points collected from 250,000 developers around the world.

Secure Code Warrior unveils technology designed to help CISOs and AppSec teams ensure their projects remain safe and free of coding errors and vulnerabilities – a big issue following the CrowdStrike incident.

The cybersecurity industry has responded to the Australian Government’s Protective Security Policy Framework (PSPF) Direction 002-2024, issued on July 8, 2024. The directive requires Australian Government entities to identify and actively manage the risks associated with vulnerable technologies they manage for themselves and others.

Running a successful SME requires juggling many hats. But one area that can’t be overlooked is cybersecurity. Data breaches and cyberattacks are on the rise, and even small businesses are attractive targets.

Software is the foundation of virtually every modern enterprise, yet our reliance on potentially vulnerable open-source components in critical systems represents an extreme risk in the software supply chain. It’s an ailment for which we must find an appropriate cure.

One of the most challenging aspects of integrating AI tools into business operations is determining which outputs are trustworthy, which tools you can trust to become part of your tech stack, the strengths and weaknesses of each tool, and how you can ensure consistent results if different tools or processes are being used.

AI coding tools can assist the defence capabilities of developers, enabling an easier pathway to a ‘security-first’ mindset. However, like any new and potentially impactful innovation, they also raise potential questions that teams and organisations need to explore.

When it comes to enterprise cybersecurity, nothing is set in stone. With a constantly shifting threat landscape on one hand and evolving tools on the other, security teams can often feel overworked and overwhelmed.

Few technological advances have captured widespread attention as quickly as Artificial Intelligence (AI). In less than two years, AI has evolved from being a technical novelty into a powerful tool, and its rate of evolution shows no sign of slowing.

Demand is high for professionals with knowledge of AI, but do such talents really get implemented on the job?

The 2024 SD Times 100: 'Best in Show' in Software Development, Developer Experience category featuring Secure Code Warrior.

Here’s a look at the most interesting products from the past month.

IBRS analysis sheds light on the importance of continuous measurement of secure coding skills and industry benchmarks for cybersecurity readiness.

Pieter Danhieux on the Benefits of Trust Score for CISOs and Developers.

Peter Danhieux shares three best practices to consider when developing an internal upskilling programme.

Industry pundits across retail and technology have welcomed the Australian Federal Budget for 2024-25 and its particular focus on easing cost-of-living pressures as well as digital and cyber investments - even though several were hoping for more action.

Code created by AI can be rife with vulnerabilities and flaws, but AI-assisted coding tools can still be helpful if paired with security-aware, human developers.

As AI becomes an integral part of code delivery in banks and other FSIs, the volume of code produced will increase, and so will the number of errors, flaws and vulnerabilities – unless these are corrected early in the software development lifecycle. The responsibility to run those quality checks will initially fall squarely on development teams to execute.

The Australian government announced its 2024-25 federal budget and CSO has selected highlights that indicate how much will go towards cybersecurity and in what areas.

Secure Code Warrior has announced the introduction of its SCW Trust Score, the industry's first benchmark that gauges the security posture of organisations' developer teams.

Secure Code Warrior, the global, developer-driven security leader, today unveiled SCW Trust Score, the industry’s first benchmark that quantifies the security posture of organisations’ developer teams.

New benchmark leverages over 20 million learning data points from more than 250,000 developers around the world