Implementing SLSA Source Requirements to Improve Software Supply Chain Security
SLSA source requirements help mitigate threats originating from source control management.
Code Tampering
Cycode Integration with JFrog Pipelines and Artifactory
JFrog and Cycode created an integration that will improve the security of our customers’ digital assets and dependencies.
Google SLSA Framework: Key Takeaways
In light of recent, multi-billion dollar cyber attacks, Google has introduced a framework to help developers improve software supply chain security. This proposed solution is…
Understanding the Trojan Source Attack and How to Defend Against It
There’s little doubt that 2021 has been the year of the software supply chain attack, with many notable breaches that include Solarwinds…
8 Infrastructure as Code (IaC) Best Practices for Security
Infrastructure as Code (IaC) is a rapidly growing technique of provisioning infrastructure with software, utilizing software…
Why Developers are Hackers’ New Targets (and What to do About it)
Compromised credentials are a tried-and-true tactic for hackers looking to gain access to secured systems, including personal accounts, corporate networks, SaaS applications and even development environments.
Vendor vs. Developer: Codecov Lessons on AppSec Responsibility
The Codecov breach is an example of a classic software supply chain attack, in which attackers gain organization access by compromising 3rd…
Exploring the Chainjacking Attack
Several forms of supply chain attack have recently emerged that allow for attackers to insert themselves between developers and the dependencies they utilize.
How to Setup Branch Protection Rules in Azure DevOps
Branch protection rules are a crucial part of securing source control management systems. Branch protection rules enable administrators…
The Codecov Breach – Development Infrastructure is the Weakest Link & its Now Rapidly Being Exploited
On April 15th, Codecov disclosed a major breach when an attacker compromised its infrastructure allowing to export sensitive information like…