For too long, security has been cast as a bottleneck – swooping in after developers build and engineers test to slow things down. The reality is blunt; if it’s bolted on, you’ve already lost. The ones that win make security part of every decision, from the first line of code to the last boardroom conversation...
The post Cultural Lag Leaves Security as the Weakest Link appeared first on Security Boulevard.
AI-generated code is reshaping software development and introducing new security risks. Organizations must strengthen governance, expand testing and train developers to ensure AI-assisted coding remains secure and compliant.
The post Securing AI-Generated Code in Enterprise Applications: The New Frontier for AppSec Teams appeared first on Security Boulevard.
Alan reflects on a turbulent year in DevSecOps, highlighting the rise of AI-driven security, the maturing of hybrid work culture, the growing influence of platform engineering, and the incredible strength of the DevSecOps community — while calling out the talent crunch, tool sprawl and security theater the industry must still overcome.
The post What I’m Thankful for in DevSecOps This Year: Living Through Interesting Times appeared first on Security Boulevard.
Discover what’s changed in the OWASP 2025 Top 10 and how GitGuardian helps you mitigate risks like broken access control and software supply chain failures.
The post OWASP Top 10 2025 Updates: Supply Chain, Secrets, And Misconfigurations Take Center Stage appeared first on Security Boulevard.
Securing the Digital Frontier: How AI is Reshaping Application Security The software development landscape is transforming at breakneck speed. Developers now generate code faster than ever, but this acceleration comes...
The post Innovator Spotlight: Harness appeared first on Cyber Defense Magazine.
Yet Another Testing & Auditing Solution
The goal of YATAS is to help you create a secure AWS environment without too much hassle. It won't check for all best practices but only for the ones that are important for you based on my experience. Please feel free to tell me if you find something that is not covered.
YATAS is a simple and easy to use tool to audit your infrastructure for misconfiguration or potential security issues.
| No details | Details |
|---|---|
| |
Loginbrew tap padok-team/tap
brew install yatasyatas --initModify .yatas.yml to your needs.
yatas --installInstalls the plugins you need.
yatas -hFlags:
--details: Show details of the issues found.--compare: Compare the results of the previous run with the current run and show the differences.--ci: Exit code 1 if there are issues found, 0 otherwise.--resume: Only shows the number of tests passing and failing.--time: Shows the time each test took to run in order to help you find bottlenecks.--init: Creates a .yatas.yml file in the current directory.--install: Installs the plugins you need.--only-failure: Only show the tests that failed.| Plugins | Description | Checks |
|---|---|---|
| AWS Audit | AWS checks | Good practices and security checks |
| Markdown Reports | Reporting | Generates a markdown report |
You can ignore results of checks by adding the following to your .yatas.yml file:
ignore:
- id: "AWS_VPC_004"
regex: true
values:
- "VPC Flow Logs are not enabled on vpc-.*"
- id: "AWS_VPC_003"
regex: false
values:
- "VPC has only one gateway on vpc-08ffec87e034a8953"You can exclude a test by adding the following to your .yatas.yml file:
plugins:
- name: "aws"
enabled: true
description: "Check for AWS good practices"
exclude:
- AWS_S3_001To only run a specific test, add the following to your .yatas.yml file:
plugins:
- name: "aws"
enabled: true
description: "Check for AWS good practices"
include:
- "AWS_VPC_003"
- "AWS_VPC_004"You can get the error logs by adding the following to your env variables:
export YATAS_LOG_LEVEL=debugThe available log levels are: debug, info, warn, error, fatal, panic and off by default
You'd like to add a new plugin ? Then simply visit yatas-plugin and follow the instructions.
The post How to reduce your attack surface appeared first on Detectify Blog.
The post Web security trends to watch for 2020 appeared first on Detectify Blog.
The post Scaling up Security with DevOps and CI/CD practices appeared first on Detectify Blog.
Security is too often an afterthought in the software development process. It’s easy to understand why: Application and software developers are tasked with getting rid of bugs and adding in new features in updates that must meet a grueling release schedule.
Asking to include security testing before an update is deployed can bring up problems needing to be fixed. In an already tight timeline, that creates tension between developers and the security team.
If you’re using traditional pentesting methods, the delays and disruption are too great to burden the development team, who are likely working a continuous integration and continuous delivery process (CI/CD). Or if you’re using an automatic scanner to detect potential vulnerabilities, you’re receiving a long list of low-level vulns that obscures the most critical issues to address first.
Instead, continuous pentesting, or even scanning for a particular CVE, can harmonize development and security teams. And it’s increasingly important. A shocking 85% of commercial apps contain at least one critical vulnerability, according to a 2021 report, while 100% use open-source software, such as the now infamous Log4j. That’s not to knock on open-source software, but rather to say that a critical vulnerability can pop up at any time and it’s more likely to happen than not.
If a critical vulnerability is found–or worse, exploited–the potential fines or settlement from a data breach could be astronomical. In the latest data breach settlement, T-Mobile agreed to pay $350 million to customers in a class action lawsuit and invest additional $150 million in their data security operations.
This is why many companies are hiring for development security operations (DevSecOps). The people in these roles work in concert with the development team to build a secure software development process into the existing deployment schedule. But with 700,000 infosec positions sitting open in the United States, it might be hard to find the right candidate.
If you want to improve the security of your software and app development, here are some tips from Synack customers:
Security is a vital component to all companies’ IT infrastructure, but it can’t stand in the way of the business. For more information about how Synack can help you integrate security checkpoints in your dev process, request a demo.
The post Testing Early and Often Can Reduce Flaws in App Development appeared first on Synack.
Yet Another Testing & Auditing Solution
The goal of YATAS is to help you create a secure AWS environment without too much hassle. It won't check for all best practices but only for the ones that are important for you based on my experience. Please feel free to tell me if you find something that is not covered.
YATAS is a simple and easy to use tool to audit your infrastructure for misconfiguration or potential security issues.
| No details | Details |
|---|---|
| |
brew tap padok-team/tap
brew install yatasyatas --initModify .yatas.yml to your needs.
yatas --installInstalls the plugins you need.
yatas -hFlags:
--details: Show details of the issues found.--compare: Compare the results of the previous run with the current run and show the differences.--ci: Exit code 1 if there are issues found, 0 otherwise.--resume: Only shows the number of tests passing and failing.--time: Shows the time each test took to run in order to help you find bottlenecks.--init: Creates a .yatas.yml file in the current directory.--install: Installs the plugins you need.--only-failure: Only show the tests that failed.| Plugins | Description | Checks |
|---|---|---|
| AWS Audit | AWS checks | Good practices and security checks |
| Markdown Reports | Reporting | Generates a markdown report |
You can ignore results of checks by adding the following to your .yatas.yml file:
ignore:
- id: "AWS_VPC_004"
regex: true
values:
- "VPC Flow Logs are not enabled on vpc-.*"
- id: "AWS_VPC_003"
regex: false
values:
- "VPC has only one gateway on vpc-08ffec87e034a8953"You can exclude a test by adding the following to your .yatas.yml file:
plugins:
- name: "aws"
enabled: true
description: "Check for AWS good practices"
exclude:
- AWS_S3_001To only run a specific test, add the following to your .yatas.yml file:
plugins:
- name: "aws"
enabled: true
description: "Check for AWS good practices"
include:
- "AWS_VPC_003"
- "AWS_VPC_004"You can get the error logs by adding the following to your env variables:
export YATAS_LOG_LEVEL=debugThe available log levels are: debug, info, warn, error, fatal, panic and off by default
You'd like to add a new plugin ? Then simply visit yatas-plugin and follow the instructions.
