Here's a fact about mobile apps that is as true for Fortune 100 companies as mom-and-pops: Rare is the company that understands what data its mobile app retains. I used to prove this theory routinely. All it requires is a security consultant who is willing to do some penetration testing on the app. In some cases, 20 minutes was all the time needed. We found passwords in the clear in Starbucks... READ MORE›

Here's an uncomfortable truth for IT to internalize: enabling access for a friend facilitates access for an enemy. This is what was behind the anti-backdoor argument that Apple aggressively made, albeit for non-altruistic sell-more-hardware reasons. In effect, if you provide an easy way for government investigators to access data, there's no reason to believe that bad guys won't use a... READ MORE›

Regardless of where your development team is in the DevOps journey, you’re likely aware that detecting and fixing quality issues as early in the software development lifecycle (SDLC) as possible increases efficiency and reduces costs. Today, development teams are running static assessments during the integration and even code stages, giving developers more time to fix policy-violating flaws... READ MORE›

It seems like every summer there’s another horror story about shark sightings and attacks at local beaches. JAWS taught us all that sharks are scary and should be avoided in the open ocean. That’s pretty solid advice and I can’t argue with it. But you know what else is good advice for enjoying the perfect beach day? Knowing how to swim, wearing sunscreen, staying under an... READ MORE›

Here's a delightful bit of survey happiness out of Ireland: a vendor survey found that "almost half of Irish businesses wouldn’t disclose a data security breach to impacted third parties, including customers and suppliers." Even worse, these results likely underestimate how many execs agree with that thinking, but are shrewd enough to not share that with someone taking a... READ MORE›

Take Steps to Protect the Data before the Ransomware Attack Happens In a recent study conducted by Radware, C-level executives revealed that they had no interest in paying up if their network was hit by ransomware, but that response came before they were locked out from their data. Once they were actually attacked, nearly half of those executives admitted they have, indeed, paid the ransom. The... READ MORE›

Your web communities are an important way to engage your customers and solicit their feedback, but web forums are yet another website to secure, another potential entry point for attackers. A recent data breach shows just what can happen when community forums are left vulnerable. Canonical, the developer of the open-source Ubuntu operating system, announced last Friday that a database for its... READ MORE›

It’s not a secret that applications have been a top vector for data breaches over the last five years (DBIR 2015). As organizations wade deeper into the DevOps era, it’s clear that a mature Application security program is a key pillar for organizational success. In this article I would like to present to you three ways to improve your application security program. 1. Establish a risk... READ MORE›

There's a very interesting new Ponemon Institute report on app encryption, which concludes that app encryption usage is sharply increasing, as it has consistently for years. The report found 37 percent of the companies examined this year embrace enterprise encryption, up from 15 percent in 2005. The report sees this as a good thing and the upward trend is certainly encouraging. But to find... READ MORE›