A Secrets Management Maturity Model
Maturity models may be a controversial topic, but used properly we believe they can help leaders understand their capabilities and develop a roadmap for improvement.
Hardcoded Secrets
Cycode Integration with JFrog Pipelines and Artifactory
JFrog and Cycode created an integration that will improve the security of our customers’ digital assets and dependencies.
AWS CloudFormation Security: 8 Best Practices
AWS CloudFormation gives organizations the ability to easily manage a collection of AWS resources by automating the initialization, provisioning, and…
7 Terraform Security Best Practices
Terraform, developed by Hashicorp, is an infrastructure as code (IaC) framework that allows for declarative resource provisioning…
8 Infrastructure as Code (IaC) Best Practices for Security
Infrastructure as Code (IaC) is a rapidly growing technique of provisioning infrastructure with software, utilizing software…
Why Developers are Hackers’ New Targets (and What to do About it)
Compromised credentials are a tried-and-true tactic for hackers looking to gain access to secured systems, including personal accounts, corporate networks, SaaS applications and even development environments.
How to Setup Branch Protection Rules in Azure DevOps
Branch protection rules are a crucial part of securing source control management systems. Branch protection rules enable administrators…
The Codecov Breach – Development Infrastructure is the Weakest Link & its Now Rapidly Being Exploited
On April 15th, Codecov disclosed a major breach when an attacker compromised its infrastructure allowing to export sensitive information like…
ESLint: Compromising the Build using Supply Chain Attack
A supply-chain attack is an indirect attack which targets the tools, automatic software updates or supply chain in general, in order to introduce malicious code or dependencies into existing software, without the developers being aware.
A Unique Supply Chain Attack: The 2020 Sawfish
For attackers targeting technology businesses, the goal is often stealing intellectual property and other data, which can either be sold for profit…