Data Safety and Information Security

Outlining how my thinking has evolved after working with various cloud deployment types and integrating security into many kinds of apps.

Adds infosec regulation coming to more industries but with a light touch, more collaboration

GraphQL is a friendly alternative to REST APIs. But there are some security repercussions of adopting GraphQL developers need to know.

Computer security only happens when software is kept up to date. That should be a basic tenet for business users and IT departments. Apparently, it isn’t. At least for some Linux users who ignore installing patches, critical or otherwise.

Do you worry that a CVE will hurt the reputation of your project? In reality, CVEs are a tracking number, and nothing more. Here's how we think of them at GitHub.

Making security every team’s problem and recruiting those most interested to formalize their involvement is a solid cultural approach.

This online session shows you what constant vigilance should look like

Amazon Web Services (AWS) Lambda, serverless computing's poster child, is over seven years old and only now has experienced the first malware specifically targeting Lambda, Denonia

While QR codes hold significantly more data than bar codes, they are also more prone to phishing attacks.

When few developers see security it as their responsibility, how do you build a culture to support a zero trust strategy in your organization? #security #DevSecOps #zerotrust

PKI has created a global trust framework for the web. But the war in Ukraine has shone a light on its weaknesses. Hierarchies are not good architectures for building robust, trustworthy, and stable digital systems.

We contain multitudes that each want a different login

Surveying Your Cybersecurity Landscape

It takes only a second to crack the handful of weak keys. Are there more out there?

Provisional authenticity and confidentiality can help us manage the trade offs between privacy and authenticity to support online accountability along with functional privacy.

Both application and infrastructure security are required to keep a cloud native system safe. A single solution can integrate both to foil hackers. #DevSecOps #security

At Slim.AI, the cloud-native startup I founded with my longtime colleague and creator of the DockerSlim open-source project Kyle Quest, we believe we must address the problem of WHAT gets shipped to production, not just how fast or how frequently teams can deploy.

As their cities suffered more intense bombardment by Russian military forces this week, Ukrainian Internet users came under renewed cyberattacks, with one Internet company providing service there saying they blocked ten times the normal number of phishing and malware attacks…

Authenticity and privacy are usually traded off against each other. The tradeoff is a tricky one that can lead to the over collection of data.

Three stories here last week pored over several years’ worth of internal chat records stolen from the Conti ransomware group, the most profitable ransomware gang in operation today. The candid messages revealed how Conti evaded law enforcement and intelligence agencies,…

Part I of this series examined newly-leaked internal chats from the Conti ransomware group, and how the crime gang dealt with its own internal breaches. Part II explored what it's like to be an employee of Conti's sprawling organization. Today's…

Earlier this week, a Ukrainian security researcher leaked almost two years’ worth of internal chat logs from Conti, one of the more rapacious and ruthless ransomware gangs in operation today. Tuesday’s story examined how Conti dealt with its own internal…

At the API Security Summit, security leaders will discuss how to increase API security fluency across an organization.

Ukrainian ISP Triolan has been most affected.

Learn how to develop a simple Zip File password cracker, which uses a password list to brute force the encrypted file also known as a…

Developer-first AppSec is the future; here's how organizations can evaluate tools that will help them adopt a developer-first approach.