Enterprise organizations face big challenges in managing software application risk at scale. With hundreds of developers working on thousands of applications across numerous business units, the complexity of ensuring security throughout the software development life cycle (SDLC) is staggering.

A week ago, on March 29th, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned that two versions of xz Utils, were found to have been compromised. The xz Utils code had been tampered with to include a malicious “backdoor” that would ultimately give attackers the same level of control over affected systems as authorized administrators.

Major shifts in application development are creating new and significant security risks. Continuous integration/continuous delivery (CI/CD) pipelines and technology advances like automation and AI mean the development process is now so complicated and fast-moving that corporations, DevOps directors, and security groups struggle to understand and manage it, let alone defend it from assaults.

If you’re a software developer, you’re probably using open source components and libraries to build software. You know those components are governed by different open source licenses, but do you know all the license details? In particular, do you know the sometimes-convoluted licensing conditions that could pose compliance challenges for your organization?

In the late 1980s, a buffer overflow in UNIX’s fingerd program allowed Robert T. Morris to create a worm which infected 10% of the Internet—in two days. This event launched cybersecurity to the forefront of computer science headlines for one of the first times in history. Nearly three decades later in 2014, a buffer overflow vulnerability in the OpenSSL cryptography library was disclosed to the public.

The newly released update in early 2024 of the NIST Cybersecurity Framework (CSF) from 1.1 to 2.0 represents a significant step forward in cybersecurity management and reflects the latest advancements in technology and threat mitigation.

Successful software projects are managed well. To manage a project efficiently, the manager or development team must choose the software development methodology that will work best for the project at hand. All methodologies have different strengths and weaknesses and exist for different reasons. Here’s an overview of the most commonly used software development methodologies and why different methodologies exist.

The Synopsys Cybersecurity Research Center (CyRC) has identified problems in Zephyr OS related to protecting against internet protocol (IP) address spoofing attacks. Zephyr OS is a popular real-time operating system used in connected, resource-constrained systems like Internet of Things and embedded devices. It is highly customizable and supports multiple architectures, systems-on-a-chip, and boards, making it useful for a wide range of applications.

Today, we're excited to announce the availability of fAST Dynamic, the latest offering on the Polaris Software Integrity Platform®. As web applications become more complex, so too does the task of testing them for security issues at the pace of modern development pipelines. Polaris fAST Dynamic simplifies dynamic application security testing (DAST) for modern web applications, while also making it faster and easier for the teams developing them.