Tag: DZone Security Zone

How Artificial Intelligence Is Transforming Cybersecurity

As the use of artificial intelligence (AI) grows more widespread, it is finding its way into cybersecurity. According to research from Markets and Markets, global organizations are projected to spend $22.4 billion on AI solutions for cybersecurity this year. Usama…

Keep Your Application Secrets Secret

There is a common problem most backend developers face at least once in their careers: where should we store our secrets? It appears to be simple enough, we have a lot of services focusing on this very issue, we just…

Make Your Security Policy Auditable

Last week, I wrote about putting the right feature at the right place. I used rate limiting as an example, moving it from a library inside the application to the API Gateway. Today, I’ll use another example: authentication and authorization.…

What Is APIOps? And How to Be Successful at APIOps

Since the first introduction of the term DevOps, it seems that new ‘Ops” related terms pop up as quickly as technology trends. For example: AIOPs: Enhance and automate various IT processes with AI. MLOps: Develop, deploy, and manage machine learning.…

Please Pick a Number

On Randomness in Data Picking a random number might seem to be a no-brainer for us humans. We just close our eyes and say the first number that comes to our minds. But is this really the case for computers?…

Readability in the Test: Exploring the JUnitParams

Making the test readable and maintainable is a challenge for any software engineer. Sometimes, a test scope becomes even more significant when we need to create a complex object or receive information from other points, such as a database, web…

IAM Best Practices

IAM stands for “Identity and Access Management.” IAM provides answers to the fundamental question in DevOps: “Who can access what?” The roots of IAM go back to the early days of computing, where users of UNIX systems needed a username…

How To Handle Secrets in Python

We live in a world where applications are used to do everything, be it stock trading or booking a salon, but behind the scenes, the connectivity is done using secrets. Secrets, such as database passwords, API keys, tokens, etc., must…

Is Observability Replacing Testing?

Testing is a best-case scenario to validate the system’s correctness. But, it doesn’t predict the failure cases that may occur in production. Experienced engineering teams would tell you that production environments are not uniform and full of exciting deviations. The…

15 Best Practices on API Security for Developers

APIs (Application Programming Interfaces) are used to connect software applications, allowing them to share data and functionality. APIs are an essential part of modern software development, enabling developers to create more powerful and complex applications. However, APIs can also pose…

The Impact of AI on Telecoms Fraud Protection Strategies

Telecoms fraud is a prevalent and ever-evolving issue that affects both business and individual customers in the telecommunications industry. It encompasses a range of fraudulent and abusive activities that can cause significant financial damage to companies and individuals alike. Ranging…

Angular vs. React: Which JS Framework Is Better?

Where It Started: History of Angular and React Angular  AngularJS was developed by Google (by Igor Minar, a former Google employee) as an open-source framework for developing Single Page Applications (SPA).  Other companies such as Netflix, Microsoft, PayPal, and more…

Keep Your Application Secrets Secret

There is a common problem most backend developers face at least once in their careers: where should we store our secrets? It appears to be simple enough, we have a lot of services focusing on this very issue, we just…

Distributed Tracing: A Full Guide

What Is Distributed Tracing? The rise of microservices has enabled users to create distributed applications that consist of modular services rather than a single functional unit. This modularity makes testing and deployment easier while preventing a single point of failure…

Security Architecture Review on a SASE Solution

Vendor security assessments can be very complex, especially when it comes to analyzing modern solutions. Obsolete threat modeling principles and frameworks become extremely unreliable and tricky as complexity increases. Security analysis also becomes further intricate as it is not limited…

What Is API-First?

API-First is an approach to software development that emphasizes designing and developing the API as the primary focus of development. This approach offers many benefits, including increased flexibility, reduced development time, increased reliability, and easier testing. By developing the API…

How to Obtain EV Code Signing Certificate for Azure?

Microsoft offers an Azure Key Vault, which is responsible for storing and managing secrets, keys, and certificates. All of them are present in a Hardware Security Module (HSM) that adheres to the standards of the industry. This suggests that “EV Code…

Configure Kubernetes Health Checks

Kubernetes is an open-source container orchestration platform that helps manage and deploy applications in a cloud environment. It is used to automate the deployment, scaling, and management of containerized applications. It is an efficient way to manage application health with…

DevSecOps: The Broken or Blurred Lines of Defense

With the modern patterns and practices of DevOps and DevSecOps, it’s not clear who the front-line owners are anymore. Today, most organizations’ internal audit processes have lots of toils and low efficacy. This is something John Willis, in his new…

Setting Up an SSL in a Spring Boot Application

This article will describe how to set up an SSL in a Spring Boot application. Almost all articles recommend you create a Keystore file using the Java key tool, and it still could make sense, but something new came up.  This…

Integrating AWS Secrets Manager With Spring Boot

In a microservices architecture, it’s common to have multiple services that need access to sensitive information, such as API keys, passwords, or certificates. Storing this sensitive information in code or configuration files is not secure because it’s easy for attackers…

Understanding Static Code Analysis

Static code analysis is a method of debugging that involves reviewing source code prior to running a program. It is accomplished by comparing a set of code against one set or several sets of coding rules. Static code analysis is…

Dynatrace Perform: Day One

I attended Dynatrace Perform 2023. This was my sixth “Perform User Conference,” but the first over the last three years. Rick McConnell, CEO of Dynatrace, kicked off the event by sharing his thoughts on the company’s momentum and vision. The…

HTTP 1 vs. HTTP 1.1 vs. HTTP 2: A Detailed Analysis

HTTP 1 vs. HTTP 1.1 vs. HTTP 2: Key Differences Between the Three HTTP Versions Comparisons are common, and it is nothing different in the cybersecurity world. One such technology is hypertext transfer protocol (HTTP). This is why there is…

Deploy a Nodejs App to AWS in an EC2 Server

There are multiple ways you can deploy your Nodejs app, be it On-Cloud or On-Premises. However, it is not just about deploying your application, but deploying it correctly. Security is also an important aspect that must not be ignored, and…

A Guide to Implementing Passwordless Login

Passwordless authentication is becoming an increasingly popular choice for developers. Even notable names like Slack, Notion, and PayPal are all transitioning to SMS, email, or social logins for their authentication. A driving factor for its increasing adoption is that it’s…

Exploring the Architecture of Amazon SQS

What Is Amazon SQS? Amazon SQS (Simple Queue Service) is a message queue service that enables application components to communicate with each other by exchanging messages. This is widely used to build event-driven systems or decouple services on AWS. Features…

Angular vs. React: What To Choose for Your Blockchain App?

Innovative technologies are rapidly evolving, and blockchain is one such out-of-the-box invention. It helps users to transact securely and safely. Hence, the demand for blockchain application development is increasing. And this is when the app development frameworks come into play.…

Top 10 Practices for Secure Software Development

Because of the increasing number of cyberattacks, security has become an integral element of SDLC (Software Development Lifecycle). Secure software development is a requirement to protect software from cybercriminals and hackers, minimize any vulnerabilities, and maintain users’ privacy. In this…

Web Components: Everything You Need to Know

Currently, and for quite a while now, most developments are done under the umbrella of a framework. If we focus on the front end and JavaScript, we can find dozens of frameworks. It is challenging to reuse graphical interface elements…

How To Run a Docker Container on the Cloud: Top 5 CaaS Solutions

In the past few years, there has been a growing number of organizations and developers joining the Docker journey. Containerization simplifies the software development process because it eliminates dealing with dependencies and working with specific hardware. Nonetheless, the biggest advantage…

Mobile App Development Trends and Best Practices

Introduction Mobile app development is an evolving field, with new trends and technologies emerging every year. In other words, it’s rapidly changing and evolving and taking a key role. In recent years, there has been a significant increase in the…

What Is IoT Gateway? Is It Important

An IoT (Internet of Things) gateway is a device that acts as a bridge between connected IoT devices and other networks, such as the Internet. It provides a centralized platform for managing and processing data from multiple IoT devices and…

Open Policy Agent With Kubernetes: Part 2

In my previous articles, we discussed what Policy-as-Code is, why we need it, and how to use the Open Policy Agent (OPA) tool. If you haven’t read the introduction yet, please take some time to read it first here.  Following…

Open Policy Agent With Kubernetes: Part 1

As Kubernetes has become the de-facto platform to orchestrate containerized workloads, more users have begun to look for ways to control and secure their Kubernetes clusters. Hardening is a thing for sure, but what about enforcing policies inside a cluster?…

Thwarting the Theft of Resource Credentials

Cyberattacks targeting resource credentials such as session tokens are on the rise.  Recent high-profile cases such as the source code leaks of Slack’s GitHub repositories in January 2023, CircleCI in January 2023, and before that, GitHub accounts in April 2022…

What’s DevOps, SRE, Shift Left, and Shift Right?

I had the opportunity to catch up with Andi Grabner, DevOps Activist at Dynatrace, during day two of Dynatrace Perform. I’ve known Andi for seven years, and he’s one of the people that has helped me understand DevOps since I…

Data Governance Is Ineffective Without Automation

Data governance is one of the most important undertakings for businesses today. Regulations like the GDPR and CCPA require organizations to have thorough insight and control over their data, and the costs of poor-quality information keep climbing. An effective governance…

7 Benefits of Cloud Automation for Streamlined IT Operations

Cloud automation refers to the process of using technology to automate the deployment, management, and scaling of applications and infrastructure in a cloud computing environment. This can include tasks such as provisioning and configuring virtual machines, managing storage and networking…

Testing Challenges Related to Microservice Architecture

If you are living in the same world as I am, you must have heard the latest coding buzzer termed “microservices”—a lifeline for developers and enterprise-scale businesses. Over the last few years, microservice architecture emerged to be on top of…

Deploy a Kubernetes Application With Terraform and AWS EKS

When it comes to infrastructure provisioning, including the AWS EKS cluster, Terraform is the first tool that comes to mind. Learning Terraform is much easier than setting up the infrastructure manually. That said, would you rather use the traditional approach…

Dynatrace Perform: Day Two

The second day of Dynatrace Perform kicked off with a great discussion between Kelsey Hightower, distinguished developer advocate at Google Cloud Platform, and Andi Grabner, DevOps evangelist at Dynatrace. The theme of their discussion was redefining the boundaries of people, processes, and…

How To Test IoT Security

Though the Internet of Things (IoT) has redefined our lives and brought a lot of benefits, it has a large attack surface area and is not safe until it is secure. IoT devices are an easy target for cybercriminals and…

Identity Federation and SSO: The Fundamentals

In many software organizations, terms like authentication, SSO, and SAML are heard pretty often. Admittedly, many people will run away when hearing these terms, trying to avoid doing any authentication-related work.  In this article, we will go over SSO fundamentals…

Security in Game Development

The gaming industry has seen tremendous growth in recent years, with millions of players engaging in online games daily. As the industry grows, so does the need for secure game development practices. Cyberattacks are becoming more sophisticated and frequent, making…

GKE Security: Top 10 Strategies for Securing Your Cluster

Security is one of the key challenges in Kubernetes because of its configuration complexity and vulnerability. Managed container services like Google Kubernetes Engine (GKE) provide many protection features but don’t take all related responsibilities off your plate. Read on to…

Backup Vs. Disaster Recovery: What Are the Key Differences?

Backup and disaster recovery are two critical components of a comprehensive data management strategy for businesses of all sizes. However, while both terms are often used interchangeably, they refer to two distinct processes. This article will examine the key differences…

Top 10 Resources for Learning Solidity

If you want to become a smart contract developer on Ethereum, then you need to learn Solidity. Whether your goal is DeFi, blockchain gaming, digital collectibles (NFTs), or just web3 in general, Solidity is the foundational language behind the innovative…

Open-Source Authorization as a Service

Background Information The story starts back in 2007 when our founders, Omri Gazitt and Gert Drapers, were working on what would eventually become Azure Active Directory. At that time, Active Directory was a keystone workload for Windows Server. It enabled…

How To Reduce the Impact of a Cloud Outage

Can you prevent a cloud outage from negatively impacting your business? It isn’t always possible to anticipate cloud outages, but there are steps you can take to minimize their impact on your team. How can you get started preparing for…

GraphQL vs Protobuf: Differences, Similarities, and Uses

Both GraphQL and Protocol Buffers (Protobuf) are types of formats for transferring data between client and server. Each has its own set of advantages and disadvantages, and are used in different contexts, depending on the specific requirements of an application.…

Security in Game Development

The gaming industry has seen tremendous growth in recent years, with millions of players engaging in online games daily. As the industry grows, so does the need for secure game development practices. Cyberattacks are becoming more sophisticated and frequent, making…

Identity Federation and SSO: The Fundamentals

In many software organizations, terms like authentication, SSO, and SAML are heard pretty often. Admittedly, many people will run away when hearing these terms, trying to avoid doing any authentication-related work.  In this article, we will go over SSO fundamentals…

How to Debug Websites Using Safari Developer Tools

Safari is the default browser on iPads, Macbooks, and iPhones. It lies second on browser preferences, right after Chrome. Its 250+ features offer users striking benefits that set it apart from other most popular browsers like Chrome and Firefox. Building on that,…

Decentralized Data Mesh With Apache Kafka in Financial Services

Digital transformation requires agility and fast time to market as critical factors for success in any enterprise. The decentralization with a data mesh separates applications and business units into independent domains. Data sharing in real-time with data streaming helps provide…

Data Engineering Practices to Avoid

Data engineers are increasingly in high demand, especially as more company leaders realize it’s necessary to use reliable information for better decision-making. However, even the most skilled and experienced professionals can make mistakes. Here are some of them and how…

Powering Manufacturing With MLOps

Machine learning is one of the most disruptive technologies across industries today. Despite this versatility and potential, many organizations struggle to capitalize on this technology’s full potential, especially in sectors like manufacturing that lack widespread ML skills and knowledge. High…

Generative AI for DevOps: A Practical View

The concept of generative AI describes machine learning algorithms that can create new content from minimal human input. The field has rapidly advanced in the past few years, with projects such as the text authorship tool ChatGPT and realistic image creator DALL-E2…

The Evolution of Cloud-Native Authorization

Authentication in the Age of SaaS and Cloud Let’s start with the differences between authentication and authorization. People tend to lump these concepts together as auth, but they’re two distinct processes. Authentication describes the process of finding out that you are…

Securing the Clouds: An Evaluation of Cloud Security Solutions

Cloud security is an ever-evolving challenge, as organizations must consider the security of the cloud provider, the configuration of the services they offer, and the security of their own internal systems that store and access cloud-based data. Organizations must continuously…

Which Type of MFA Is Most Secure?

More and more people are adopting multi-factor authentication today to protect themselves from increasing rates of hacking and data theft. Several popular options are available for MFA, but which is the most secure and effective?  1. Social Media Login One…

What Is Browser Sandboxing?

With a rapidly changing business landscape, security is one of the biggest challenges for developers and testers in their modern web development cycle. The complexity of building and deploying modern web apps leads to more security vulnerabilities. As per a…

Securing Admin Access to Apache APISIX

API Gateways are critical components in one’s infrastructure. If an attacker could change the configuration of routes, they could direct traffic to their infrastructure. Consequences could range from data theft to financial losses. Worse, data theft could only be noticed…

How to Secure Your Website in 10 Easy Steps

A website for your business is essential for reaching a wider audience and establishing a solid online presence. However, security should be a top priority when creating a website to protect your business and customers from cyber threats.  Securing a…