Read about application security, DevSecOps, license compliance, supply chain security, and malicious packages.
Renovate was originally created to scratch an internal itch, so we’ve been both enjoying its capabilities and testing them from day one. When people get started or get comfortable with using Renovate, it’s pretty understandable that they might look at the Renovate project itself as a reference user. We’ve put together this post to share how...
Software supply chain attacks are increasing. Learn what a software supply chain attack is, and about the recent attacks.
Whitesource Ponemon Research Report: "Reducing Enterprise Application Security Risks"
Taking a look at RASP basics: What is RASP? Why do developers need it? Does it live up to the hype?
We break down the basics of serverless security in this guide, helping your team to make the next move in the evolution of cloud computing.
Myths persist about the usage of open source components. The following are the top 3 concerns associated with open source use.
When you ask developers what they think of security, they will likely go into the situation without much enthusiasm as in their mind – security is slowing them down and holding them back from doing their “actual” job. But – it doesn’t necessarily have to be that way. The friction between developers and security teams...
As much as we love the benefits of using open source software components, they still come with risks. We're here to help you better understand these risks.
As part of their journey to Digital Transformation, Oil & Gas enterprises are shifting their focus on becoming agile through DevOps in order to provide efficiency and productivity. Because there is no single standard DevOps methodology, many companies are finding it challenging to manage security requirements, which contributes to a slow start, slow delivery, and...
The software world is alive with talk of shifting left – but what does it really mean? Theoretically, it means shifting responsibility for security & compliance to developers. In practice, it largely means enriching CI/CD processes to detect problematic licenses & vulnerabilities before they reach the main branch or production. Shiri Arad Ivtsan, Director of Product Management at WhiteSource will discuss...
Encompassing over two-thirds of the average commercial software, open-source has become an essential part of modern software development. Undermanaging the consumption and redistribution of Open source expose the enterprise to extensive legal and security risks and is no longer a viable option. Having an effective Open Source compliance program is a key differentiator marking industry-leading...
Learn about the gray box testing, how it’s done, its techniques and tools, its advantages and disadvantages, and more.
Why is microservices security important? Key principles and best practices to ensure your microservices architecture is secure.
The COVID-19 pandemic forced many organizations to shift to a remote workforce almost overnight, most of which were not prepared for the sudden change. In their efforts to ensure their employees could remain productive, a number of organizations relaxed their security policies and unwittingly exposed their networks to compromise. As the pandemic continues, security challenges...
API security is an essential part of application security in a digitally transformed world.
The Main Application Security Technologies to Adopt in 2021
what motivates white hat hackers to take the time to prod and probe our software, looking for bugs?
How to set up and implement an open source strategy that will ensure open source security and compliance.
What are CVEs and how are they published? What kind of information do CVEs offer about security vulnerabilities in publicly released software?
The top security conferences to visit in 2021, virtually or in-person.
To help you stay on top of your open source security, here is our list of top 10 open source security vulnerabilities in 2020.
What is application security testing orchestration and why it is crucial in helping organizations make sure all potential risks are tracked and addressed.
As a technology, containers have done much to advance software development. However, it’s not without its issues, particularly in regards to security. Container security challenges have delayed or halted deployments, impeding organizations’ process in their quest to produce better quality software, faster. In this webinar, we discuss the current state of container security and what...
The software world is alive with talk of shifting left – but what does it really mean? Theoretically, it means shifting responsibility for security & compliance to developers. In practice, it largely means enriching CI/CD processes to detect problematic licenses & vulnerabilities before they reach the main branch or production. Shiri Ivtsan, Director of Product...
Apache Struts vulnerabilities are causing users to consider migrating to competing frameworks. We list the reasons to stay or go.
Merge Confidence identifies and flags undeclared breaking releases based on analysis of test & release adoption data.
DevSecOps requires processes and tools that enable weaving security throughout the DevOps pipeline. It is much more than a buzzword, and if you’d ask most organizations, well – they believe they are in the process of adopting DevSecOps tools and practices. But – are they? In order to deeply understand the state of DevSecOps implementation...
Explore the changes in CVSS v3.1 vs. CVSS 3.0 and understand their importance. Learn how to use CVSS 3.1
Learn all about white box testing: how it’s done, its techniques, types, and tools, its advantages and disadvantages, and more.
Top tips for getting started with Mend Composition Analysis to ensure your implementation is successful.
How prioritization can help development and security teams minimize security debt and fix the most important security issues first.
All about Eclipse SW360 - an application that helps manage the bill of materials — and its main features.
Why you shouldn't track open source components usage manually and what is the correct way to do it.
What are the different types of black box testing, how is it different from while box testing, and how can black box testing help you boost security?
Application security should be a critical part of the DevOps process, as these days even the smallest vulnerability can wreak major havoc should they lead to failures or data breaches. As a result, however, application security and vulnerability scanning tools abound for every step of the software development life cycle, which means more tools to...
