Last year, I interviewed a number of coding bootcamp graduates who were taught the MEAN stack exclusively. When looking at their final projects, all of them had NoSQL injection vulnerabilities present, indicating that perhaps the schools were not teaching secure coding. When I asked them about this (gently, because it…
Companies selling "security scorecards" are on the rise, and have started to become a factor in enterprise sales. I have heard from customers who were concerned about purchasing from suppliers who had been given poor ratings, and in at least one case changed a purchasing decision based initially on the…
Today, I will walk through configuring a daily DAST scan against an application, using Jenkins and ZAP. The process can be used similarly with any DAST scanner, depending on how the specific scanner is setup.This is the second part of a series. In part one, I walked through initial…
In my last post, I talked about integrating security tools with an agile process, and mentioned some ways to automate security checks during development. In this article, I'll walk through a basic Jenkins setup for CI/CD, and integrate SonarQube and DependencyCheck for security scanning. In my next article, I'll…
Recently, a distant cousin reached out to me for help in researching a persons history. My cousin's father had met and gotten engaged to a woman who my cousin thought was trying to steal from him. After starting this relationship, he started to change his behavior - pushing away his…
Friends and family sometimes ask me for advice about security tools or practices they should use to improve their own security. Before long I had a decent set of canned responses for all levels of technical ability that I have compiled here.Because I value personal data privacy so highly,…
A lot of security advice I read tends to fall into two camps: tailored to enterprises with full time security and infrastructure teams, or rapid fire tool installation without context for solo web developers.In this article, we will tread a middle path, and look at some ways to manage…