Tag: DZone Security Zone

SBOMs in Action: Securing Your Golden AMIs From Build to Runtime

Golden Amazon Machine Images (AMIs) are the foundation for launching consistent and efficient instances in your AWS cloud environment. Ensuring their security and immutability is paramount. This guide delves into how Software Bill of Materials (SBOMs), cryptographic signing, and runtime…

Penetration Testing for Beginners: A Step-By-Step Guide

In an era where digital transformation is rapidly advancing, the importance of cybersecurity cannot be overstated. One of the essential aspects of maintaining robust security is penetration testing, commonly known as pentesting. This guide aims to provide beginners with a…

Create JWT Using DataWeave JWT Library

Recently in one of my projects, there was a requirement to create JWT within the MuleSoft application and send that as an OAuth token to the backend for authentication. After doing some research, I got to know several ways to…

regreSSHion: Should We Panic About the New OpenSSH Vulnerability?

What Is the regreSSHion Vulnerability (CVE-2024-6387)? regreSSHion is a newly discovered vulnerability in OpenSSH that affects glibc-based Linux systems. regreSSHion (CVE-2024-6387) may allow arbitrary code execution with root privileges on systems with default configurations. Why Is Everyone Worried About the…

How DevSecOps Can Combat Zero-Day Threats

Zero-day threats are becoming more dangerous than ever. Recently, bad actors have taken over the TikTok accounts of celebrities and brands through a zero-day hack. In late May to early June, reports of high-profile TikTok users losing control over their…

Enhancing Security With ZTNA in Hybrid and Multi-Cloud Deployments

Today’s network infrastructure is rapidly changing with the adoption of hybrid and multi-cloud architectures to leverage the benefits of flexibility, scalability, and redundancy. These advantages come with their own set of challenges, particularly in securing access to resources and users spread…

Exploring Cross-Chain Compatibility in dApp Development

The use of Blockchain technology is growing rapidly. The creation of decentralized applications is rising. The issues that need solving include cross-chain interoperability. It lets dApps easily connect and work with different blockchains. Improvement of the dApps is also needed.…

Understanding and Mitigating IP Spoofing Attacks

Spoofing is a type of cyber-attack used by hackers to gain unauthorized access to a computer or a network, IP spoofing is the most common type of spoofing out of the other spoofing method. With IP Spoofing the attacker can…

Enhance IaC Security With Mend Scans

Whether on the cloud or setting up your AIOps pipeline, automation has simplified the setup, configuration, and installation of your deployment. Infrastructure as Code(IaC) especially plays an important role in setting up the infrastructure. With IaC tools, you will be…

Addressing the Challenges of Scaling GenAI

Generative AI (GenAI) has shown immense potential in transforming various sectors, from healthcare to finance. However, its adoption at scale faces several challenges, including technical, ethical, regulatory, economic, and organizational hurdles. This paper explores these challenges and proposes prompt decomposition…

Understanding Properties of Zero Trust Networks

Zero Trust is a well-known but ‘hard-to-implement’ paradigm in computer network security. As the name suggests, Zero Trust is a set of core system design principles and concepts that seek to eliminate the practice of implicit trust-based security. The core…

Data Governance: Data Integration (Part 4)

What Is Data Governance? Data governance is a framework that is developed through the collaboration of individuals with various roles and responsibilities. This framework aims to establish processes, policies, procedures, standards, and metrics that help organizations achieve their goals. These…

Cybersecurity Essentials for Software Developers

Software development is becoming complex, and a new approach is being used to create cross-functional hybrid teams.  This means some developers work on-site while others develop parts of software code remotely. While this approach has benefited agility, speed, and scalability,…

The Role of Kubernetes in Data Privacy and Protection

Kubernetes is a de facto platform for managing containerized applications. It provides a rich ecosystem for deployment, scaling, and operations with first-class support (tons of ready configs and documentation) on the Google Cloud platform. Given the growing importance of data…

IoT Needs To Get Serious About Security

This headline came across my email the other day, and it really got me thinking:  “Number of vulnerable IoT devices increases 136%” This article has been indexed from DZone Security Zone Read the original article: IoT Needs To Get Serious…

Building Resilient Security Systems: Composable Security

Traditional cybersecurity measures may not be enough to protect organizations from new and emerging threats in today’s fast-paced digital world. Security systems need to be advanced along with technology and also should be flexible and adaptable. Composable security is an…

Securing the Future: The Role of Post-Quantum Cryptography

As they evolve, quantum computers will be able to break widely used cryptographic protocols, such as RSA and ECC, which rely on the difficulty of factoring large numbers and calculating discrete logarithms. Post-quantum cryptography (PQC) aims to develop cryptographic algorithms…

Exploring the Role of Data Analytics in SOC Alert Tuning

Security Operations Centers (SOCs) play a crucial role in detecting, responding to, and mitigating security threats in an increasingly complex threat landscape. One fundamental aspect of SOC efficiency is the tuning of alerts to ensure accurate and timely threat detection…

Why Choose Bug Bounty Programs? (Benefits and Challenges Explained)

Diligent software developers must follow secure development practices, industry standards, and regulatory requirements when handling software vulnerabilities. Handling vulnerabilities is a complex, multi-step process that involves various methods and stages. One effective approach to finding vulnerabilities is through Bug Bounty…

Analysis of Flubot Malware on Android OS

Every day, the use of smartphones increases, together with the advancement of the operating system of Android. Subsequently, there have been reports of malicious individuals and hackers capitalizing on the exploits that Android has to offer to gain access to…

Embracing Responsible AI: Principles and Practices

Today we use AI to offer simpler solutions to intricate problems in various sectors such as education, transportation, finance, and healthcare. Due to this reason, it is very important to adhere to best practices and standards. Adhering to AI principles…

Dependency Injection

Dependency Injection is one of the foundational techniques in Java backend development, helping build resilient and scalable applications tailored to modern software demands. DI is used to simplify dependency management by externalizing dependencies from the class itself, streamlining code maintenance,…

Protecting PII Data With JWT

The Challenge JWT tokens are widely used for securing APIs through authentication and authorization. When an API request arrives, the resource server decodes and verifies the JWT token, typically validating the signature for authentication and checking claims or scopes for…

Security Considerations When Building SaaS

There is no well-defined pattern or framework for building a managed SaaS. Building a well-managed SaaS involves solving a wide variety of problems. Some of these problems are common across different kinds of SaaS, and some are very specific to…

Modern Digital Authentication Protocols

Digital authentication is no longer a new term in today’s technology-driven society. It is a critical security mechanism that helps to protect our cyberspace from various types of fraud and identity theft. It is used to enable electronic transactions that…

Getting Started With NCache Java Edition (Using Docker)

NCache Java Edition with distributed cache technique is a powerful tool that helps Java applications run faster, handle more users, and be more reliable. In today’s world, where people expect apps to work quickly and without any problems, knowing how…

Role-Based Multi-Factor Authentication

Multi-factor authentication (MFA) is a method of computer access control in which a user is granted access only after successfully presenting several separate pieces of evidence to an authentication mechanism — typically at least two of the following categories: knowledge…

Exploring the Comprehensive World of Burp Suite

Nowadays, with the prevalence of digital risks, it is crucial to make sure online applications are secure. To detect vulnerabilities and provide a strong defense against future cyberattacks, security testing is essential. Burp Suite is one of the many tools…

Remote Work Security Tips for Developers

Remote working arrangements are popular perks for developers. Many appreciate that they can do their jobs without daily commutes. Hiring managers and other decision-makers also like how remote work removes the geographical limitations of physical offices, making it possible to…

DevSecOps: Bridging the Gap Between Speed and Security

In the ever-evolving landscape of software development, where speed and security often seem to be at odds, DevSecOps emerges as a pivotal strategy. It’s a methodology that integrates security practices within the DevOps process. As a Chief Architect with extensive…

SOC 2 Audits as a Pillar of Data Accountability

In a digitally-driven world where organizations are entrusted with increasing volumes of sensitive data, establishing trust and credibility is non-negotiable. Regular auditing and accountability play pivotal roles in achieving these goals. An audit is like a comprehensive health check that…

Secure Your Heroku Apps With SSL

If you’re building an application that needs to go toward production, you’ll undoubtedly need to serve it up securely with SSL. What that entails varies from provider to provider, and you’ll encounter differing levels of complexity (and cost) in getting…

Design Principles-Building a Secure Cloud Architecture

To navigate the digital landscape safely, organizations must prioritize building robust cloud infrastructures, and sanctuaries for their valuable data. The foundation of a secure cloud architecture requires steadfast principles and guiding decisions like invisible forces that form a resilient structure.…

10 Commandments of API-First Development

In the realm of software development, Application Programming Interfaces (APIs) are akin to a magic glue that binds different systems together, allowing them to communicate and work in harmony. An API acts as the user interface for API consumers and…

Secure Your API With JWT: Kong OpenID Connect

Good Old History: Sessions Back in the old days, we used to secure web applications with sessions. The concept was straightforward: upon user authentication, the application would issue a session identifier, which the user would subsequently present in each subsequent…

Rethinking DevOps in 2024: Adapting to a New Era of Technology

As we advance into 2024, the landscape of DevOps is undergoing a transformative shift. Emerging technologies, evolving methodologies, and changing business needs are redefining what it means to implement DevOps practices effectively. This article explores DevOps’s key trends and adaptations…

Initializing Services in Node.js Application

While working on a user model, I found myself navigating through best practices and diverse strategies for managing a token service, transitioning from straightforward functions to a fully-fledged, independent service equipped with handy methods. I delved into the nuances of…

Understanding the 2024 Cloud Security Landscape

With technology and data growing at an unprecedented pace, cloud computing has become a no-brainer answer for enterprises worldwide to foster growth and innovation. As we swiftly move towards the second quarter of 2024, predictions by cloud security reports highlight…

Building a Sustainable Data Ecosystem

Generative Artificial Intelligence (AI) has emerged as a transformative technology with vast potential for innovation across various sectors. However, the widespread adoption of generative AI raises significant concerns regarding privacy, fairness, and accountability, particularly in data sharing.  This article explores…

Four Common CI/CD Pipeline Vulnerabilities

The continuous integration/continuous delivery (CI/CD) pipeline represents the steps new software goes through before release. However, it can contain numerous vulnerabilities for hackers to exploit. 1. Vulnerabilities in the Code Many software releases get completed on such tight time frames…

7 Essential Practices for Secure API Development

In the interconnected realm of modern software architecture, Application Programming Interfaces (APIs) are the fundamental building blocks that allow disparate systems, applications, and services to communicate with each other. They facilitate the exchange of data and functionality, enabling a seamless…

Navigating the Shift: Mastering Pod Security in Kubernetes

In the rapidly evolving landscape of Kubernetes, security remains at the forefront of concerns for developers and architects alike. Kubernetes 1.25 brings significant changes, especially in how we approach pod security, an area critical to the secure deployment of applications.…

OWASP Top 10 Explained: SQL Injection

Cyberattacks are a common and permanent threat. This paper is the first in a series about cybersecurity. The aim is to provide software engineers with an understanding of the main threats and how to address them. Most exploits are based…

Introduction to Modern Data Stack

The modern data stack represents the evolution of data management, shifting from traditional, monolithic systems to agile, cloud-based architectures. It’s designed to handle large amounts of data, providing scalability, flexibility, and real-time processing capabilities. This stack is modular, allowing organizations…

Setup With Pritunl

Overview This documentation provides a comprehensive guide to setting up a Virtual Private Network (VPN) server using Pritunl, a popular open-source VPN server management platform. By following these steps, users can establish a secure and private network infrastructure suitable for…

Mitigating Adversarial Attacks: Strategies for Safeguarding AI Systems

Artificial intelligence (AI) offers transformative potential across industries, yet its vulnerability to adversarial attacks poses significant risks. Adversarial attacks, in which meticulously crafted inputs deceive AI models, can undermine system reliability, safety, and security. This article explores key strategies for…

Incident Management: Checklist, Tools, and Prevention

What Is Incident Management? Incident management is the process of identifying, responding, resolving, and learning from incidents that disrupt the normal operation of a service or system. An incident can be anything from a server outage, a security breach, a…

iOS Application Security for Beginners

This article provides a brief overview of techniques that can be used in your mobile iOS application to keep it secure enough for the vast majority of cases. If you are a junior or middle iOS developer and have not…