BT

Facilitating the Spread of Knowledge and Innovation in Professional Software Development

Write for InfoQ

Topics

Choose your language

InfoQ Homepage Security Content on InfoQ

  • Secure Delivery: Better Workflows for Secure Systems and Pain-Free Delivery

    The software delivery process has been transformed in the last decade; we’ve adopted well-understood workflows around functions such as testing, release management and operational support. In this article we'll explore the impact that security workflows have on software delivery, explain the root causes and share battle-proven techniques to show how we can make delivering secure software easier.

  • Data Protection Methods for Federal Organizations and beyond

    The Federal Data Strategy describes a plan to “accelerate the use of data to deliver on mission, serve the public, and steward resources while protecting security, privacy, and confidentiality." This article covers what it is and how it can be applied to any organization.

  • The Importance of Pipeline Quality Gates and How to Implement Them

    A quality gate is an enforced measure built into your pipeline that the software needs to meet before it can proceed. This article covers how to get the maximum benefit from quality gates. Making good use of quality gates not only can improve the quality of your software, but it can also improve your delivery speed.

  • API Security: from Defense-in-Depth (DiD) to Zero Trust

    Nearly all companies have experienced security incidents but few have an API security policy that includes dedicated API testing and protection. A defense-in-depth approach that includes boundary defense, observability, and authentication is recommended.

  • Who Moved My Code? An Anatomy of Code Obfuscation

    In this article, we introduce the topic of code obfuscation, with emphasis on string obfuscation. Obfuscation is an important practice to protect source code by making it unintelligible. Obfuscation is often mistaken with encryption, but they are different concepts. In the article we will present a number of techniques and approaches used to obfuscate data in a program.

  • Successfully Integrating Dynamic Security Testing into Your CI/CD Pipeline

    Dynamic security testing tools don’t require advanced cybersecurity knowledge to operate. Integrating DAST into your CI/CD pipeline should be done in stages by focusing on the riskiest areas first.

  • What Does Zero Trust Mean for Kubernetes?

    Zero trust is a powerful security model that’s at the forefront of modern security practices. It’s also a term that is prone to buzz and hype, making it hard to cut through the noise. So what is zero trust, exactly, and for Kubernetes, what does it mean in concrete terms? In this article, we’ll explore what zero trust is from an engineering perspective.

  • What Developers Must Know about Zero Trust

    Zero trust solves the problem of open network access by allowing access only to the resources a user should be allowed to access. This article covers how to start working with zero trust principles and ideas.

  • Managing Kubernetes Secrets with the External Secrets Operator

    Kubernetes doesn’t yet have the capabilities to manage the lifecycle of secrets, so sometimes we need external systems to manage this sensitive information. Once the amount of secret information we need to manage increases, we may need additional tools to simplify and better manage the process. In this article, we’ll take a detailed look at one of these tools, the External Secrets Operator.

  • Using DevOps Automation to Combat DevOps Workforce Shortages

    A focus on automation can help to combat the current staffing struggles many organizations have with DevOps roles. Effective automation can reduce the toil experienced by developers. Automation efforts should focus on security operations, deployments, continuous delivery, QA testing, and continuous integration.

  • The Parity Problem: Ensuring Mobile Apps are Secure across Platforms

    The problem of security parity is a big one, but it’s part of a larger problem: a general lack of security in mobile apps. By embracing automation for security implementation to the same or greater degree than it has been adopted for feature development, developers can ensure that every app they release for every platform will be protected from hackers, fraudsters, and cybercriminals.

  • Diving into Zero Trust Security

    The Zero Trust approach involves a combination of more-secure authentication approaches, such as MFA with profiling and posturing of the client device, along with some stronger encryption checks. This article shares some insights on Zero Trust Security for your organization and your customers, and how you can get started with it.

BT