AppSec alert fatigue: 4 ways to reduce burnout — and boost security
Tool sprawl is making alert fatigue a major problem for teams responsible for application security. Here are four ways to combat it in your organization.
AppSec alert fatigue: 4 ways to reduce burnout — and boost security
Malicious NuGet campaign uses homoglyphs and IL weaving to fool devs
Malware authors upped their game, using homoglyphs to impersonate a protected NuGet prefix and IL weaving to inject malicious code, RL researchers found.
The state of DevSecOps: Why upgrading your AppSec tooling is essential
Here's what's holding DevSecOps back — and why modernizing your application security tooling is critical in the software supply chain security era.
Three Pillars to Strengthen Software Supply Chain Security
In a new report, Gartner® is redefining software supply chain security and calling on enterprises to make some big changes.
The Polyfill.io vulnerability: Software supply chain attack lessons
The compromise of the widely used Polyfill.io CDN contains important lessons for organizations on trust.
OASIS Open's push for a software supply chain standard: All together now?
The aim is to build a unifying framework incorporating existing SBOM data models, including CSAF, CycloneDX, OpenVEX, and SPDX. Experts weigh in with key insights.
New Portal Helps Devs Spot Malicious Open Source Packages
RL's Spectra Assure Community offers free comprehensive risk assessment of more than 5 million npm, PyPi, and RubyGems packages.
Malicious npm package targets AWS users
The history of the package is a lesson in why tracking open source threats is such a challenge — and highlights the value of RL's new Spectra Assure Community.
The Power of Complex Binary Analysis
RL Spectra Assure’s AI-driven complex binary analysis delivers critical visibility into software binaries to flag malware and advanced software threats, closing the software supply chain security gap.
How platform engineering helps you get a good start on Secure by Design
Self-service portals for developers can help organizations overcome challenges to getting up and running with CISA's software security initiative.
How to secure mergers & acquisitions from software supply chain attacks
When engaging in M&A, acquiring firms often inherit a software stack that presents security concerns. Here’s how you can effectively manage these risks.
Top cybersecurity Substacks to follow
Get up to speed on the state of security operations and related cybersecurity practices by subscribing to these 10 expert-curated Substacks.
Why malware matters most: 6 ways to foil software threats faster
Making malware enemy No. 1 should be a top priority for AppSec teams. Here's why you need to shift your team's focus from vulnerabilities.
Verizon DBIR 2024: The rise in software supply chain attacks explained
Verizon's Data Breach Investigations Report marked a dramatic shift in threats. Learn about it from Verizon — and how to get ahead of risk — in this Webinar.
How to assess and manage commercial software risk
Major attacks show that commercial software is the principal attack surface. Here’s why – and how your team can mitigate its risks.