A CISO having a bad day finds out the hard way that cutting corners on software security testing might end up costing him more than he saved.
Continue Reading...
Posted in Cloud Security, Featured, Interactive Application Security Testing (IAST), Maturity Model (BSIMM), Mobile Application Security, Open Source Security, Security Training, Software Architecture and Design, Software Composition Analysis | Comments Off on What happens when your CISO has one of those days?
The software flaws and weaknesses on our top 10 software vulnerability list for 2019 are easy to find and fix with the right application security guidance.
Continue Reading...
Posted in Mobile Application Security, Web Application Security | Comments Off on Top 10 software vulnerability list for 2019
Taylor Armerding, Synopsys Software Integrity Group senior strategist, gives you the scoop on application security and insecurity in this week’s Security Mashup.
What’s in this week’s Security Mashup, you ask?
Fixing the CVE program, your personal data has already “checked out,” and it even “may potentially” have taken flight. Watch this week’s episode below to see why these stories are trending or read the transcript below.
Continue Reading...
Posted in General, Mobile Application Security | Comments Off on Fixing the CVE program, your personal data checking out and taking flight
Nobody with any connection to, or interest in, the FIFA World Cup can say they weren’t warned.
Continue Reading...
Posted in General, Mobile Application Security | Comments Off on Golden Cup was a world cup of trouble
Google started releasing monthly security updates for Android back in August 2015. Modern Android devices show you the latest monthly patch level that has been applied. The responsibility for deploying the patches ultimately falls on original equipment manufacturers (OEMs) and carriers, who need to test the security updates on their devices to ensure that they do not break any functionality. Google does provide updates for its Nexus and Pixel devices directly to end users, but given how Android is designed, Google cannot simply push out arbitrary security updates to all Android devices.
Do OEMs have to push out updates?
The problem is that OEMs and carriers are responsible not only for pushing out the updates but also for displaying the latest month for which Google’s monthly updates have been applied to a device. There may be legitimate reasons why an OEM or carrier may choose not to push out a security update for a particular type of device. For example:
Continue Reading...
Posted in Mobile Application Security | Comments Off on Are Android OEMs responsible for the gap in mobile security updates?
A Synopsys survey reveals that the security of customer-facing web and mobile apps is the top security challenge for IT professionals in Asia.
Continue Reading...
Posted in Mobile Application Security, Web Application Security | Comments Off on Survey: Mobile and web apps are top security challenge
Several frameworks have been proposed to evaluate the security of biometric systems. Popular ones include the simpler Ratha’s framework [1] and the enhanced Bartlow and Cukic framework [2].
Continue Reading...
Posted in Mobile Application Security | Comments Off on iPhone X Face ID: Evaluating the security of biometric systems
Written in coordination with Grant Douglas
Continue Reading...
Posted in Mobile Application Security, Software Architecture and Design | Comments Off on How secure is iPhone X Face ID facial recognition?
Modern mobile device users often have their devices tightly integrated into daily life. From banking apps to social media feeds, these applications are high visibility targets for hackers and thieves looking to exploit weaknesses or hijack vulnerabilities. By ramping up mobile app security, vendors ensure the safety and security of their users and their infrastructure.
Recent mobile attacks and vulnerabilities
The latest high-profile mobile threat is the Broadpwn attack. This threat targets the Broadcom chipset used in many popular mobile devices. Broadpwn takes advantage of low-level communications combined with flaws in the Android platform. Thus, allowing a malicious payload to travel from one phone to the next virtually undetected. Fuzz testing tools are an ideal method of detecting this type of flaw.
Continue Reading...
Posted in Mobile Application Security | Comments Off on 3 tips to ramp up your mobile application security
There’s been a fair share of attention paid to the security inside the connected car. There’s also been a significant uptick in new devices and apps that communicate with the vehicle from afar. These devices and apps use traditional means of communication (e.g., Bluetooth, Wi-Fi, etc.). They also make some very common software mistakes. For instance, lacking proper authentication of users and commands, potentially putting the end user at risk, both for physical harm and data loss.
Continue Reading...
Posted in Automotive Security, Mobile Application Security | Comments Off on Automotive security goes beyond the car