AppSec Blog: Category - Secure SDLC

Taking Control of Your Application Security

Application security is hard. Finding the right people to perform application security work and manage the program is even harder. The application security space has twice as many job openings as candidates. Combined that with the fact that for every 200 software engineers there is only 1 security professional, how do we staff a … Continue reading Taking Control of Your Application Security


Threat Modeling: A Hybrid Approach

Editor's Note: Today's post is from Sriram Krishnan. Sriram is a Security Architect at Pegasystems. In this post, Sriram introduces a hybrid threat modeling white paper addressing the limitations in traditional threat modeling methodologies. In the face of increasing attacks at the application layer and enterprise applications moving towards the cloud, organizations must look at … Continue reading Threat Modeling: A Hybrid Approach


Continuous Integration: Live Static Analysis with Roslyn

Early in 2016, I had a conversation with a colleague about the very, very limited free and open-source .NET security static analysis options. We discussed CAT.NET, which released back in 2009 and hasn't been updated since. Next came FxCop, which has a few security rules looking for SQL Injection and Cross-Site Scripting included in the … Continue reading Continuous Integration: Live Static Analysis with Roslyn


Securing the SDLC: Dynamic Testing Java Web Apps

Editors Note: Today's post is from Gregory Leonard. Gregory is an application security consultant at Optiv Security, Inc and a SANS instructor for DEV541 Secure Coding in Java/JEE. Introduction The creation and integration of a secure development lifecycle (SDLC) can be an intimidating, even overwhelming, task. There are so many aspects that need to … Continue reading Securing the SDLC: Dynamic Testing Java Web Apps


Static Analysis and Code Reviews in Agile and DevOps

Editors Note: Today's post is from Jim Bird. Jim is the co-founder and CTO of a major U.S.-based institutional trading service, where he is responsible for managing the company's technology organization and information security program. In this post, Jim covers how to perform secure code analysis in an Agile development lifecycle. More and more … Continue reading Static Analysis and Code Reviews in Agile and DevOps