Session Management has always been one of the OWASP Top 10. Take a look of the most recent two OWASP Top 10s. Top 10, 2013: A2 – Broken Authentication and Session Management Top 10, 2017: A2 – Broken Authentication Under the description of A2 of Top 10, 2017, it says, “Application functions related to authentication […]
What is application security, or AppSec? Let’s talk about web application security first. OWASP was created in 2001 and has been known as the best community for web application security. Volumes of online resources for web application security defects, security testing, and security projects have been produced by OWASP. Yet web application security is only […]
(…and 1 that Doesn’t!) In my last blog post, I discussed why agile feedback is such an integral practice for high-performing teams. Feedback allows teams to effectively collaborate, communicate, and iterate to create a high-quality, polished product. While these qualities are always important, practice is even more invaluable during a time of physical distancing. When […]
In the current world climate of a global pandemic, many companies have transitioned to working from home. But there are many professionals, including myself, that have worked from home even before the emergence of COVID-19. Working from home can be a difficult transition, especially if it was sudden, but there are many tips and tricks […]
At a high level, maintainability defines the ease with which changes can be made correctly. Correctness in this sense means that the intended changes are made without introducing unexpected side effects. Code should be structured so as to be easily modifiable. Tests should be in place to prevent regression, ensuring that existing functionality is unaffected […]
Managing Consultant Brian Hicks shares some dos and don’ts of technical and process assessments for both formal and internal uses.
Dependency Checking Your Ruby Application Checking your application’s dependencies for known vulnerabilities is a critical, relatively low effort step you should take to secure your application, which you may have read about in another recent article: What is SCA? Compared to the wealth of tools used for dependency checking in, for example JavaScript, there’s not […]
One of the most prevalent issues that continue to vex application developers is weaknesses in database security that open us to exploit. Database security is a broad subject, and I will not cover all the security issues here but want to provide context and understanding around some of the more comment vulnerabilities. In this blog, […]
Executive Vice President Mike Sowers and Senior Training Manager Stephanie Fender discuss how to implement a culture of continuous learning through learning journeys in our next Coveros Conversation.
Before diving into WAF security, it’s important to note the difference between web servers and application servers. A web server is internet facing on the front end, while an application server is where the code resides and is not internet facing. Between the web server and app server, all the HTTPs encrypted data is decrypted […]
