Contributed By
Taylor Armerding, Software Security Expert, Synopsys Software Integrity Group
“If tools aren’t used correctly, at the right time, and in the right way, they can flag an overwhelming number of potential vulnerabilities, many of them insignificant or irrelevant to a particular project. And that can frustrate development teams to the point that they could start ignoring the warnings or even disabling the tools, undermining the security those tools are meant to enhance.”
That, according to Meera Rao, is one of the biggest challenges of embedding security into DevOps and yielding effective DevSecOps.
Rao, senior director for product management (DevOps solutions) at Synopsys, notes the reality that “at every stage in the pipeline or even in your SDLC, you have many security activities to perform, and each and every one of them gives you vulnerabilities. That can lead to defect overload.”
By now, that list of DevSecOps testing tools and other security tasks is fairly standard. At the start, security teams should conduct threat modeling and risk analysis based on what an application is expected to do and what kind of input, if any, it will handle. Obviously, a page on a website that accepts user input including personal and financial data needs more rigorous security than one that simply provides information, such as the locations of company offices.
During the coding and building phases, automated tools like static, dynamic, and interactive analysis can flag bugs and other defects that could be exploited. Fuzz testing can check how the software responds to random, malformed input. Software composition analysis (SCA) can help find open source components that may have security defects and/or licensing conflicts.
Denne historien er fra February 2021-utgaven av HWM Singapore.
Start din 7-dagers gratis prøveperiode på Magzter GOLD for å få tilgang til tusenvis av utvalgte premiumhistorier og 9000+ magasiner og aviser.
Allerede abonnent ? Logg på
Denne historien er fra February 2021-utgaven av HWM Singapore.
Start din 7-dagers gratis prøveperiode på Magzter GOLD for å få tilgang til tusenvis av utvalgte premiumhistorier og 9000+ magasiner og aviser.
Allerede abonnent? Logg på
How To Secure Your Smartphone
WE COVERED THE IMPORTANCE OF A STRONG password earlier. And this also applies to your smartphone too. While using your birthdate can seem convenient, if you wouldn't use that on your PC, then you shouldn't use it on your phone either.
Ryzen AI Enters The Fray
This review covers the flagship processor in the lineup, the Ryzen AI 9 HX 370, which features a powerful 12-core, 24-thread configuration, 36MB of cache, and Radeon 890M graphics.
IT'S UPGRADE TIME
As the tenth anniversary of the Apple Watch approached, rumours about a revolutionary device with a dramatic design change swirled-the Apple Watch X. But as it turns out, we got the Apple Watch Series 10 instead.
Intel Core Ultra 2 Shines
With a week of hands-on experience with the ASUS Zenbook S 14 powered by Intel's Core Ultra 7 258V, it's clear that Intel has created a chip that's a serious contender in the ultraportable space.
Smaller, Lighter, Smarter
When it comes to second-generation products, you expect improvements, and the Google Pixel Buds Pro 2 certainly delivers.
AN ATMOSPHERIC ATTEMPT
Taking on a remake of Konami's classic Silent Hill 2 was always going to be a daunting task. Enter Bloober Team, the studio behind other psychological horror titles like The Medium and Blair Witch. While those were solid efforts in their own right, Silent Hill holds a special place in the hearts of horror fans, and any attempt to update it was bound to be scrutinized.
BASIC, BUT COMPETENT
Following the success of the Nothing Phone (2) and Nothing Phone (2a), the company launched its sub-brand, CMF by Nothing, aimed squarely at the budget-conscious.
LENOVO YOGA SLIM 7X
The Lenovo Yoga Slim 7x stands out in terms of build quality and design. With a thickness of just 12.9mm and weighing a mere 1.28kg, this laptop is incredibly portable.
COMFY, SECURE, AND OPEN
With the Nothing Ear (Open), the company has focused on elevating the open-fit experience with a stylish design, secure fit, and surprisingly solid audio quality.
The Emperor Of Mankind Approves
Warhammer 40,000: Space Marine 2 puts you right in the middle of the Imperium's most brutal battles, and it does so with an unapologetic embrace of its own absurdity.