Tag: DZone Security Zone

A Practical Guide to Securing NodeJS APIs With JWT

NodeJS is a very popular platform for building backend services and creating API endpoints. Several large companies use NodeJS in their microservices tech stack, which makes it a very useful platform to learn and know, similar to other popular languages…

Demystifying Kubernetes in 5 Minutes

Kubernetes is not new and has been a de-facto standard of deployments and CI/CD at most companies for a while. The goal of this article is to make you familiar with all the terms and jargon that Kubernetes experts use,…

Advanced CI/CD Pipeline Optimization Techniques Using GitHub Actions

Continuous Integration and Continuous Deployment (CI/CD) pipelines are crucial for modern software development. This article explores advanced techniques to optimize these pipelines, enhancing efficiency and reliability for enterprise-level operations. Parallelization Using Matrix Builds GitHub Actions CI tests using the matrix…

Using AUTHID Parameter in Oracle PL/SQL

In Oracle, the AUTHID clause is a powerful option to manage DB security and access control. It defines who is considered a current user for execution purposes within stored procedures and functions. This article explores the basics of AUTHID, different…

12 Expert Tips for Secure Cloud Deployments

According to the Thales 2024 Cloud Security Study, 31% of cyberattacks prioritize SaaS applications, followed closely by 30% targeting cloud storage and 26% aimed at cloud management infrastructure. Cloud resources have become the prime targets for hackers — no surprise,…

Implement Hibernate Second-Level Cache With NCache

In this tutorial, we’ll explore implementing a second-level cache in Hibernate using NCache. We’ll set up a Java application with Hibernate. Then we’ll configure NCache as the second-level cache. Finally, we’ll test the implementation to see how caching reduces the…

Secure Golden Images: A Blueprint for Vulnerability Management

In environments with AWS Cloud workloads, a proactive approach to vulnerability management involves shifting from traditional patching to regularly deploying updated Secure Golden Images. This approach is well-suited to a modern Continuous Integration and Continuous Delivery (CI/CD) environment, where the…

Acting Like We Care About Security

This will be my last entry on the topic for a while. For context, I introduced the idea that folks don’t care about security, they care about outcomes in this post; and then I began exploring ways we, as IT…

Data at Rest Encryption: Protecting Stored Data

Securing sensitive information is more critical than ever. One of the key defenses in data protection is data at rest encryption, a method that safeguards information stored on devices such as hard drives, databases, and servers. Unlike data in transit,…

Decoding DORA: EU’s Unified Approach to ICT Risk Governance

As financial services become increasingly digitized, the need for robust operational resilience has grown more critical. The Digital Operational Resilience Act (DORA), set to take effect on January 17, 2025, aims to establish a unified framework for Information and Communication…

An Overview of TCPCopy for Beginners

With the rapid development of Internet technology, server-side architectures have become increasingly complex. It is now difficult to rely solely on the personal experience of developers or testers to cover all possible business scenarios. Therefore, real online traffic is crucial…

Starting to Care About Security

In my last post, I discussed the issue of getting people to care about security, and how it’s largely due to a focus on security behaviors rather than security outcomes. In this post, I’m picking up where I left off,…

Secret Management and Rotation

Secrets are the keys to manage and enhance the security of a software application. Secret keys play a pivotal role in the authentication, authorization, encryption/decryption, etc. of data flowing through the application. There are various types of secrets and few…

Network Sniffing: A Critical Concept in Network Security

What Is Network Sniffing? Sniffing includes the passive interception of data packets crossing a network with further analysis. Initially, sniffing was developed to help network administrators troubleshoot connectivity problems, and since then, it has evolved into an important technique of…

Why Haven’t You Upgraded to HTTP/2?

From a Java perspective, I’ve been the beneficiary of some pretty amazing features over the years: Generics (Java 5) Streams and Lambda Expressions (Java 8) Enhanced Collection Functionality (Java 9) Sealed Classes (Java 17) As key features become available, I’ve…

Is Spring AI Strong Enough for AI?

In recent years, there has been a significant surge in the adoption of artificial intelligence (AI) and machine learning (ML) technologies across a wide range of industries. Frameworks such as TensorFlow, PyTorch, and Scikit-learn have emerged as popular choices for…

Exploring the Sidecar Pattern in Cloud-Native Architecture

Distributed services have indeed revolutionized the design and deployment of applications in the modern world of cloud-native architecture: flexibility, scalability, and resilience are provided by these autonomous, loosely coupled services. This also means that services add complexity to our systems,…

Reducing Infrastructure Misconfigurations With IaC Security

Infrastructure as Code (IaC) became the de facto standard for managing infrastructure resources for many organizations. According to Markets and Markets, a B2B research firm, the IaC market share is poised to reach USD 2.3 Billion by 2027.  What Is Infrastructure as…

10 Security Best Practices for SaaS

In this article, we’ll discuss the importance of guarding your SaaS and the SaaS Security best practices you must implement in your Security checklist to ensure the proper functioning of your app. The seemingly unstoppable growth of SaaS platforms in the…

Navigating the Regulatory Maze: Simplifying Data Compliance

In an era of increasingly complex regulatory landscapes, IT professionals face unprecedented challenges in managing data compliance. The evolving nature of regulations across various industries demands a proactive and sophisticated approach to data management. I spoke with Steve Leeper, VP…

Nobody Cares About Security

Nobody cares about security. There. I said it. I said the thing everyone feels, some people think, but very few have the temerity to say out loud. But before you call me a blasphemous heathen, I will ask for just…

AI and Technical Debt: Balancing Innovation and Sustainability

As artificial intelligence (AI) continues to revolutionize the tech industry, developers, engineers, and architects face a new challenge: managing the technical debt that comes with rapid AI adoption. Jeff Hollan, Head of Apps and Developer Tools at Snowflake, shares invaluable…

The Critical Role of Data at Rest Encryption in Cybersecurity

Securing information is crucial as cyber-attacks are getting more sophisticated. Data residing in an unprotected state at rest (databases, stored files, and backups) pose one of the most significant risks. Data at rest encryption is necessary to guarantee that information…

Designing a Secure Architecture for Distributed Systems

Securing distributed systems is a complex challenge due to the diversity and scale of components involved. With multiple services interacting across potentially unsecured networks, the risk of unauthorized access and data breaches increases significantly. This article explores a practical approach…

Modern Authentication on .NET: OpenID Connect, BFF, SPA

As web technologies continue to advance, so do the methods and protocols designed to secure them. The OAuth 2.0 and OpenID Connect protocols have significantly evolved in response to emerging security threats and the growing complexity of web applications. Traditional…

Principles of Modern Data Infrastructure

< section> < article> The evolution of the internet over the past few decades has undeniably impacted how our societies function. From facilitating globalization to making new technology like social media and consumer apps available to nearly every person on…

5 Steps To Integrate Istio With OPA

Authentication and Authorization are big parts of the security puzzle that need to be solved by cloud architects and DevOps engineers. In this blog, we will specifically look at how to achieve authorization/access control; i.e., what actions the authenticated entity…

Workload Protection in the Cloud: Why It Matters More Than Ever

The swift progress in cloud technology has made data and application security an important requirement rather than just a preference. As more customer businesses are moving their operations to the cloud, safeguarding their cloud workloads — referring to all deployed applications and…

Best Practices for Salesforce Data Management and Security

Effective Salesforce data management and security are crucial for organizations aiming to maximize their CRM potential while safeguarding sensitive information. As Salesforce continues to be a cornerstone for customer relationship management, ensuring data integrity, accessibility, and security becomes increasingly vital.…

From Transparency to the Perils of Oversharing

TL; DR: Why Too Much Transparency Can Have a Detrimental Effect While transparency is often touted as essential in Agile, too much can have negative consequences. Oversharing can lead to micromanagement, misinterpretation, and loss of trust within the team. Examples…

Zero Trust and Its Impact on Cybersecurity

According to Forbes, 1 out of 5 people are working remotely. With a more distributed workforce, enterprises have significantly changed their operation style, encompassing shifts in company culture, meeting structures, and a surge in Virtual and Augmented Reality. Along with them, the…

The Enterprise Guide to Cloud Security Posture Management

Editor’s Note: The following is an article written for and published in DZone’s 2024 Trend Report, Enterprise Security: Reinforcing Enterprise Application Defense. Many companies wrongly believe that moving to the cloud means their cloud provider is fully responsible for security. However,…

High Fidelity Data: Balancing Privacy and Usage

The effective de-identification algorithms that balance data usage and privacy are critical. Industries like healthcare, finance, and advertising rely on accurate and secure data analysis. However, existing de-identification methods often compromise either the data usability or privacy protection and limit…

Advanced Techniques in Automated Threat Detection

In the fast-paced and constantly evolving digital landscape of today, bad actors are always looking for newer and better methods to launch their attacks. As cybercriminal tactics evolve, they develop more sophisticated malware, more convincing scams, and attacks that are…

Securing Federal Systems

Computer systems in the federal government must demonstrate that they are secure. The process is known as accreditation and the goal is to receive an Authority to Operate (ATO). The ATO allows the system to be put into production for…

Black Hat 2024, Day 2: Charting the Future of Cybersecurity

The 2024 Black Hat conference in Las Vegas brought together some of the most influential voices in cybersecurity, offering critical insights for security professionals navigating an increasingly complex digital landscape. From the philosophical underpinnings of software development to practical strategies…

How Data Encryption Can Simplify Infrastructure Architecture

Product and infrastructure engineering teams are not always aligned with the interests of security engineering teams. While product and infrastructure focus on driving business value and delivering practical solutions, security focuses on detection, prevention, and remediation, which can seem less…

Data Security Solution for US Federal Customers

Federal agencies manage highly classified sensitive data, including personal information, medical records, and tax and income details of all U.S. residents. In some cases, temporary visitor data are also retained. They also handle national security information, including susceptible documents, intergovernmental…

API Security: The Cornerstone of AI and LLM Protection

As artificial intelligence and large language models (LLMs) continue to reshape the technological landscape, the importance of API security has never been more critical. In a recent interview at Black Hat 2024, Tyler Shields, Vice President of Product Marketing at…

What Is SQL Injection and How Can It Be Avoided?

SQLi is one of the code injection techniques that may enable an attacker to modify the queries that the application provides to the database. By far the most frequent and severe web application security threats always hide in web applications that…

The Relationship Between Performance and Security

The software landscape has undergone a profound transformation over the past two decades. In the past, a substantial portion of software was designed for local desktop use. However, today, the norm for computer users is to access web-based software services…

Creating Effective Exceptions in Java Code [Video]

This article will explore the critical topic of creating effective exceptions in your Java code. Exceptions are crucial in identifying when something goes wrong during code execution. They are instrumental in managing data inconsistency and business validation errors. We will…