DevelopSec

Developsec is dedicated to helping develop security awareness.

[DevelopSec @DevelopSec]

Ep. 125: From Flat Tires to AppSec: The Power of Tools and Processes has just been released.

Just like changing a flat tire, the right tools, process and knowledge can make all the difference in a successful outcome.

https://t.co/r4Egx8maXq

[DevelopSec @DevelopSec]

Curious about AI security testing? Check out the OWASP AI Testing Guide.

https://t.co/qMqoyPaVLp

[DevelopSec @DevelopSec]

In the latest episode of the DevelopSec podcast, I dive into a new attack technique: Double-ClickJacking. Here's what you need to know to keep your apps safe!

Check out the full episode: https://t.co/cp0JrHgXxK

[DevelopSec @DevelopSec]

Just posted Ep. 123: Goals of Security Culture - Sort of?

I share some thoughts on how security is a part of everyone's roles and some ideas of how to help build that awareness.

https://t.co/fPnK9LMiQM

[DevelopSec @DevelopSec]

Should secure development be part of a developer's required skillset / experience?

Ep. 122: Integrating Security Responsibilities into Development has just been released!!

Check out the full episode: https://t.co/NXoW3AamqR

[James Jardine @james__jardine]

It is no longer just the company paying, ransomware attacks are coming after your money.

James: "They are sending out emails directly to those patients, those users and demanding, in this case it was $213 US dollars that they had to pay within 24 hours."

Full Video: https://t.co/jary5ApRJi

[DevelopSec @DevelopSec]

Ep. 121: Evolving Ransomware: Unique Tactics for Payment is now available.
Check out some unique tactics we have seen used to collect payment.

https://t.co/uzufJhk2JN

[DevelopSec @DevelopSec]

if you are using Firebase, here is their security checklist: https://t.co/FGTCQc7Ew9

[DevelopSec @DevelopSec]

Does the ASP:TextBox TextMode provide input validation?

I posted some information about what that attribute does and does not do.

https://t.co/lNUZ9dqNVJ

[DevelopSec @DevelopSec]

One way to help build secure applications is to hire developers, QA, business analysts, and product owners that have secure development experience.

Here are some thoughts on some first steps. https://t.co/A8wku35Ef1

[DevelopSec @DevelopSec]

Does your site require HTTPS?
It should. While this article cites sensitive info, don't overlook the tampering of responses to inject malicious code.
Article: https://t.co/INGUmDFjUQ

Insights: https://t.co/IbkIJJfmKR

[DevelopSec @DevelopSec]

You can access the tool directly at: https://t.co/i9tme6djYr

[DevelopSec @DevelopSec]

Do you use HAR files for troubleshooting? Whether you are the person receiving the HAR file or sending it, it is important that it doesn't contain sensitive information.

Cloudflare has made a HAR sanitizer available. https://t.co/1cjVdyjbK8.

[James Jardine @james__jardine]

Stack traces and other error information are often seen as low risk, but there are those outliers where it can be much more.
https://t.co/peYCzOb3UN

[DevelopSec @DevelopSec]

We all know about being cautious clicking links in emails, but what about QR codes?
https://t.co/b0SqBVQIby

[DevelopSec @DevelopSec]

Curious why you can't just rely on client-side validation? Check out this quick post. https://t.co/Jt3snMdCFf

[James Jardine @james__jardine]

9 years ago, I started my @DevelopSec Podcast. Ep. 2 was all about passwords. While there is a push to get rid of passwords, much of the ideas I shared haven't changed a whole lot.
https://t.co/fqFJfx9NMq

[DevelopSec @DevelopSec]

Private secrets, keys and tokens are a common issue in code repositories. GitHub just added a feature to help detect/block these on push requests.
https://t.co/DB7pXFTiIm
#cybersecurity, #appsec

[DevelopSec @DevelopSec]

https://t.co/hRAHNiw7Dt
#cybersecurity, #appsec

[DevelopSec @DevelopSec]

Private secrets, keys and tokens are a common issue in code repositories. GitHub just added a feature to help detect/block these on push requests.